Is cold email legal? Yes, if you follow these rules

It depends on where the recipient is, not where you are. The world splits into two models.

• Opt-out countries. You may email business contacts without asking first, as long as you identify yourself and stop when they opt out. The US works this way. So does the UK for limited companies.
• Opt-in countries. You need consent before sending marketing email. Canada and Australia accept implied consent when a business address is published openly and your email relates to the person's role. Germany requires prior express consent, even for business addresses.

The EU sits in between. GDPR lets you rely on legitimate interest, but each country also has its own email marketing law, and some are strict.

The CAN-SPAM Act covers any email whose main purpose is to advertise or promote a product or service. It makes no exception for business-to-business email, so treat every cold sales email as covered. You don't need permission to send. You do need to follow eight rules from the FTC.

1. Accurate header information. The From, To, Reply-To and routing details must identify you or your business.
2. An honest subject line. It must reflect what the email is about.
3. Identify the message as an ad. You must clearly disclose that a commercial email is an advertisement. The FTC gives you leeway in how, so a plain line in the footer is a common approach.
4. A valid physical postal address. A street address, a PO box registered with the postal service, or a registered private mailbox.
5. A clear way to opt out. A link or a reply works. You can't charge a fee, ask for more than an email address, or make people visit more than one page.
6. Keep the opt-out working. It must process requests for at least 30 days after you send.
7. Honour opt-outs within 10 business days. After that you can't email them again or sell or pass on their address.
8. Watch your vendors. If an agency or tool sends on your behalf, you are both responsible. You can't contract the duty away.

The penalty: each separate email that breaks the law can cost up to $53,088 in civil penalties. That is the inflation-adjusted maximum the FTC set in January 2025, and it still applies in 2026 because the FTC made no inflation adjustment for 2026.

GDPR applies when your recipients are in the EU, wherever you are based. A work email like maya.lindqvist@fernway.example identifies a person, so it is personal data even though she uses it for business. That doesn't stop you emailing her. It means you need a legal basis and a few habits.

Use legitimate interest as your legal basis

Article 6(1)(f) lets you process personal data when you have a legitimate interest that isn't overridden by the person's rights. Recital 47 of GDPR says direct marketing may be regarded as a legitimate interest. For B2B cold email, this is the basis almost everyone uses, and it means you don't need prior consent under GDPR itself.

Write a legitimate interest assessment

Before you send, write down a short three-part test: purpose, necessity and balance. Do it once per campaign or segment, keep it on file, and update it when the audience or offer changes.

Collect only what you need

Data minimisation, Article 5(1)(c), means keeping only what the purpose needs. For cold email that is name, job title, company, work email and the company website. Don't store personal phone numbers, home addresses or anything sensitive.

Tell people where you got their data

When you didn't collect data from the person directly, Article 14 says you must tell them who you are, why you have their data, where it came from, your legal basis and their rights. If you use the data to contact them, you must do it at the latest in that first email. A two-line notice in the footer with a link to your privacy notice does the job.

Honour the right to object, every time

Under Article 21, anyone can object to direct marketing, and that right is absolute. When someone says stop, stop, and add them to a suppression list so they never come back from a new export.

Keep records

GDPR expects you to show your work. Keep your assessment, the source of each list, the date you got it, and your suppression list. If a regulator or a recipient asks, you can answer in minutes.

Check the national email law too

GDPR isn't the only rule. The EU ePrivacy Directive requires consent for marketing email to individuals and lets each country decide how to treat business addresses. That is why rules differ between, say, France and Germany. GDPR fines reach up to €20 million or 4% of global annual turnover, whichever is higher.

In the UK, the Privacy and Electronic Communications Regulations split recipients by the type of organisation they work for.

UK GDPR still applies when the address names a person, such as tom.reid@harborgrid.example, so the legitimate interest steps above apply too. The ICO says you should honour a corporate subscriber's opt-out, and an individual's right to object to direct marketing is absolute. The Data (Use and Access) Act 2025 raised the maximum PECR fine from £500,000 to £17.5 million or 4% of global turnover, whichever is higher.

Run through this before every campaign. It takes five minutes.

Put this under your signature. It covers identity, address, ad disclosure, data source and opt-out in five short lines.

Tip: Sending 5,000 or more emails a day to Gmail? Gmail also requires one-click unsubscribe headers on marketing mail. Most sending platforms add them for you.

Compliant cold email starts with the right data. ContactYard gives you business contact data, not consumer data: a professional's name, employer, job title, company details, work email and business phone. It doesn't intend to provide sensitive personal data, personal consumer profiles or data about children.

• Clear sources. Records come from licensed business-data providers. The Business Contact Data Notice explains where the data comes from, why it is used, and the rights people have, including opting out.
• Suppression built in. When a professional asks ContactYard to suppress their record, ContactYard can keep a minimal suppression token so the record isn't reintroduced.
• Role-relevant targeting. Filter by job title, industry and company size, so every email relates to the recipient's role, which is exactly what legitimate interest, CASL and the Spam Act look for.
• Fresh, checked emails. Every work email is checked before delivery and data is refreshed every 30 days, so you write to people in their current job, not their last one.
• Rules that match the law. The acceptable use policy bans spam, deceptive subject lines and contacting people after an opt-out, and requires every customer to document their purpose and apply suppression lists before outreach.

Is cold emailing illegal?

No. Cold emailing business contacts is legal in the US and most countries when you identify yourself honestly, include a postal address and a working opt-out, and stop when asked. It is illegal when it is deceptive or ignores opt-outs, and in countries such as Germany it needs prior consent.

Is it illegal to send emails without permission?

Not in the US, which uses an opt-out model under CAN-SPAM, and not to UK limited companies under PECR. Canada and Australia need consent, though an openly published business address can count when the email relates to the person's role. Germany needs prior express consent.

Is GDPR cold email allowed for B2B?

Yes. Most B2B senders rely on legitimate interest under Article 6(1)(f). Write a legitimate interest assessment, collect only what you need, tell people where you got their data in the first email, and honour every objection. Check the national email law too.

Do I need consent to cold email in the UK?

Not for corporate subscribers such as limited companies, LLPs and government bodies. You do for sole traders and most partnerships, unless the soft opt-in applies. UK GDPR still applies to emails that name a person.

What is the penalty for breaking CAN-SPAM?

Up to $53,088 per email. The FTC set that inflation-adjusted figure in January 2025 and made no change for 2026.

Do I need an unsubscribe link in a cold email?

You need a working way to opt out. Under CAN-SPAM a reply option or a link works. Large senders to Gmail also need one-click unsubscribe on marketing mail, so include both a reply option and a link.

Can I cold email personal Gmail addresses?

Avoid it. Personal addresses bring consumer rules into play, which are stricter in most countries. Stick to the work emails of named people whose role fits your offer.

Rules covered, now send something worth reading. Learn how to write and send a cold email, then start free on ContactYard to build a verified, role-relevant list.