← All articles

Is Cold Email Legal? GDPR, CAN-SPAM and B2B Outreach

November 2, 2026 · 11 min read · by the 0effort team

TL;DR: Whether cold B2B email is legal depends on the recipient's country, and two layers apply: data-protection law such as GDPR governs holding the contact's data, marketing-email law governs sending. The US allows cold email with an opt-out; Canada and Australia require consent, sometimes implied; Germany requires prior consent. General information, not legal advice.

Search "is cold email legal" and most results give a yes or a no. Both are wrong. A specific message to a specific person in a specific country is legal or not, and the same template can be fine in Texas, borderline in London and a cease-and-desist letter in Munich.

We build an AI SDR, so we care about this: software that sends at machine speed breaks a rule at machine speed. What follows is our read of the primary sources.

Is cold email legal at all, and why does the recipient's country decide?

Mostly yes, with conditions that change at every border. Our reading is that your home country's rules follow you out the door and the recipient's meet you at the inbox. GDPR reaches a non-EU sender that targets people in the EU (Art. 3(2) (accessed 2026-11-02)), and CASL covers a message accessed from a computer system in Canada (s. 12 (accessed 2026-11-02)). So apply the stricter of the two to each contact.

That is why one "cold email policy" fails the moment a list crosses a border. A list of 5,000 contacts is several legal situations, and the honest answer is a matrix with one row per recipient country.

What are the two legal layers every cold email has to clear?

Layer one is data protection: GDPR in the EU, UK GDPR in Britain. It asks whether you may hold and use this person's data. Layer two is electronic-marketing law: whether you may send this message. In the EU that comes from Article 13 of the ePrivacy Directive 2002/58/EC, as amended by 2009/136/EC (accessed 2026-11-02), which each member state wrote into its own statute. Elsewhere it is CAN-SPAM, CASL or the Spam Act.

Most guides merge these into one blob called "GDPR compliance," and that is how teams end up with a flawless legitimate-interest assessment and a banned campaign. Passing layer one tells you nothing about layer two.

What does CAN-SPAM actually require for B2B email sent to US recipients?

It is an opt-out regime, and it covers B2B. The statute regulates any email whose primary purpose is promoting a commercial product or service, with no business-to-business exemption and no prior-consent rule for a first message. What it does require is in 15 U.S.C. § 7704 (accessed 2026-11-02); § 7702(2) (accessed 2026-11-02) defines the covered message by its primary purpose, not by who it is sent to:

• No false or misleading headers and no deceptive subject line.
• Clear identification that the message is an advertisement, unless the recipient consented.
• A valid physical postal address for the sender.
• A clear and conspicuous notice of the opportunity to decline further messages, plus a working way to opt out, which must keep functioning for at least 30 days after the message goes out (§ 7704(a)(3)–(5) (accessed 2026-11-02)).
• Opt-outs honored within 10 business days.

The money part: civil penalties run up to $53,088 per email. That is the 2025 inflation-adjusted figure (Federal Register, 17 January 2025 (accessed 2026-11-02)). The FTC's notice of 15 September 2026 (accessed 2026-11-02) says its amounts remain unchanged during 2026, and the current 16 CFR 1.98 (accessed 2026-11-02) lists $53,088. It moves most years, so look it up before quoting it.

Does GDPR ban cold email, or only govern the contact data?

It governs the data. It does not ban the email, and it does not exempt B2B either. A work address like jane.doe@company.com identifies a person, so it is personal data (Art. 4(1) (accessed 2026-11-02)): you need a lawful basis, an Article 14 (accessed 2026-11-02) notice and a working right to object.

B2B teams usually rely on legitimate interest under Article 6(1)(f) (accessed 2026-11-02), and Recital 47 (accessed 2026-11-02) names direct marketing as an interest that can qualify. "Can" carries weight there: you need a documented balancing test, transparency to the person and a working objection route. The right to object to direct marketing is absolute. Under Article 21(2)–(3) (accessed 2026-11-02), once someone objects, you stop.

The operational playbook lives in GDPR-Compliant Cold Outreach in the EU; we won't repeat it here.

Why can a cold email be GDPR-compliant and still be illegal in Germany?

Because GDPR is not the rule that decides whether you may send. In Germany that rule is UWG § 7 (accessed 2026-11-02), which treats advertising by electronic mail as an unreasonable nuisance unless the recipient gave prior express consent. The wording speaks of the "Adressat," not of consumers, so B2B is inside it. The main exception, § 7(3), covers an address received from a customer in connection with a sale. A stranger found in a database doesn't qualify.

So a German prospect can sit on a flawless legitimate-interest file and still be off limits. If Germany is a real slice of your market, we'd treat it as opt-in and not stretch the exception. Enforcement doesn't wait for a regulator. Competitors and qualified trade associations have standing under UWG § 8(3) (accessed 2026-11-02), and § 13(1) (accessed 2026-11-02) says they should send a warning letter (Abmahnung) before suing. The recipient's own company is the other route: an unwanted advertising email can be treated as interference with an established business, which supports an injunction claim under BGB §§ 823(1) and 1004 (accessed 2026-11-02). That is how a single cold email typically ends in a cease-and-desist.

Nor is Germany "the EU." In France, the regulator's CNIL guidance on electronic prospecting (accessed 2026-11-02), which applies art. L34-5 of the Code des postes et des communications électroniques, accepts B2B email without prior consent when the message relates to the recipient's profession, as long as the person is informed and can object. The EU is 27 implementations, not one rule.

How do the UK, Canada and Australia treat unsolicited B2B email?

Three answers, none of them CAN-SPAM.

UK. PECR regulation 22 (accessed 2026-11-02) applies its consent rule to unsolicited marketing email sent to individual subscribers. Corporate subscribers, meaning limited companies and the like, fall outside it. Sole traders and some partnerships count as individuals (regulation 2 (accessed 2026-11-02)), so a one-person consultancy can need consent where a plc doesn't. Identity and a valid opt-out address are required for everyone under regulation 23 (accessed 2026-11-02), and UK GDPR still covers the data.

Canada. CASL (S.C. 2010, c. 23, accessed 2026-11-02) is a consent law, not an opt-out law. You need express or implied consent before the first message. Implied consent by conspicuous publication is narrow: the address must be published with no statement that the person doesn't want unsolicited commercial messages, and the message must be relevant to their business role or duties. Sender identification and an unsubscribe mechanism honored within 10 business days are mandatory. Penalties reach C$10 million per violation for a business (s. 20). The B2B carve-out in the Electronic Commerce Protection Regulations, SOR/2013-221, s. 3(a)(ii) (accessed 2026-11-02) needs a relationship between the two organizations, which a cold email by definition lacks.

Australia. The Spam Act 2003 (accessed 2026-11-02) bans unsolicited commercial electronic messages (s. 16) and requires accurate sender information (s. 17) and a functional unsubscribe facility (s. 18). Consent can be express or inferred, and Schedule 2 allows inference from a published address, again tied to relevance. Withdrawals take effect within five working days.

Does a role-based or generic company address change the picture?

Sometimes, and not in the direction people hope. The two layers answer differently for the same address.

Under PECR, what counts is the subscriber, not the local part. jane.doe@bigco.co.uk and info@bigco.co.uk both go to a corporate subscriber, so the consent rule bites on neither. Under GDPR it flips: the named address is personal data, while info@ usually isn't, unless it resolves to one identifiable person, as it does at a two-person firm. Germany's consent rule doesn't turn on the local part; in Canada the consent rule doesn't either, but the implied-consent argument does. CAN-SPAM never asked.

One more trap: the "relevant to their role" tests in CASL and the Spam Act. A generic inbox has no role, which thins that argument fast.

What does a country-by-country checklist look like before you hit send?

One row per recipient country, checked per contact, not per campaign. Treat this as a summary of the sections above, not a substitute.

EU and UK rows also carry the data-protection layer; other countries' privacy laws may too, so confirm.

When an AI SDR sends on your behalf, who is legally responsible and what should it enforce?

You are. Hiring a tool moves the typing, not the liability. CAN-SPAM's "initiate" covers procuring a message as well as sending it, and the "sender" is the initiator whose product is promoted (15 U.S.C. § 7702(9) and (16), accessed 2026-11-02); § 7705 (accessed 2026-11-02) can also reach a business that knowingly lets itself be promoted in a non-compliant email. CASL reaches anyone who sends, causes or permits a message to be sent (s. 6(1), accessed 2026-11-02). Under GDPR, for sending, the vendor is usually your processor, which is why Article 28 (accessed 2026-11-02) wants a written contract. A vendor that supplies the contact data is often a controller for that data in its own right, so check which role its DPA gives it.

Our position: the matrix has to be a gate in the send path, not a PDF in a shared drive. A human SDR forgets a prospect is in Berlin now and then. Software never hesitates, so a rule that isn't coded in repeats across the whole list before anyone notices. Ask any AI SDR vendor to show you these:

1. The recipient's country resolved per contact, with a visible hold when that country needs consent you haven't recorded.
2. One suppression list shared across every campaign.
3. Sender identity, a postal address and a working unsubscribe in every template.
4. A stored source for each contact: where the address came from, and when.
5. An exportable log, since the record is what a regulator asks for first.

Our vendor due-diligence checklist has the wider questions. A tool that also sources your buyers decides who is on the list, so provenance matters more.

This article is general information from our reading of the primary sources, not legal advice. The law differs by country and changes. Before a campaign into a market you haven't cleared, take advice from a qualified lawyer there.

FAQ

Is it legal to send cold emails to businesses in the US without permission?

Generally yes. CAN-SPAM is opt-out with no B2B exemption, so a first message needs no consent if you meet the requirements of 15 U.S.C. § 7704 (accessed 2026-11-02): honest headers and subject lines, ad identification, a postal address and an opt-out honored within 10 business days. If the recipient is outside the US, their country's rules apply as well.

Can I rely on legitimate interest under GDPR to send B2B cold emails?

For the data layer, often yes: document the balancing test under GDPR Art. 6(1)(f) (accessed 2026-11-02), give the Article 14 (accessed 2026-11-02) notice and honor objections at once. It doesn't answer the sending layer. Germany's UWG § 7 (accessed 2026-11-02) requires prior consent whatever your GDPR basis, and other member states differ.

Is buying an email list legal for cold outreach?

Buying is processing too, and sending adds a second layer. Under GDPR you become a controller of data you didn't collect, so you need a lawful basis, an Article 14 (accessed 2026-11-02) notice and a record of origin. Where UK law needs consent, PECR regulation 22(2) (accessed 2026-11-02) requires consent to mail sent "by, or at the instigation of, the sender", which a list seller's generic opt-in rarely gives you. Australia prohibits supplying, acquiring or using harvested-address lists (Spam Act 2003, Part 3, ss. 20-22, accessed 2026-11-02), and CAN-SPAM adds aggravated penalties for harvested addresses (15 U.S.C. § 7704(b), accessed 2026-11-02). If a seller can't say where records came from, don't send.

Do I need an unsubscribe link in a one-to-one cold email?

In practice, yes. CAN-SPAM, CASL and the Spam Act turn on whether the message is commercial, not on how many copies exist, so a hand-typed email gets no carve-out. CAN-SPAM covers any message whose primary purpose is commercial (15 U.S.C. § 7702(2), accessed 2026-11-02), CASL prohibits sending a commercial electronic message without consent (s. 6, accessed 2026-11-02) and the Spam Act bans unsolicited commercial electronic messages (s. 16, accessed 2026-11-02). A reply-to-opt-out line can satisfy some rules, but a link is the safest default.

What are the penalties for violating CAN-SPAM or GDPR with cold email?

CAN-SPAM: up to $53,088 per email at the 2025 inflation-adjusted level (16 CFR 1.98, accessed 2026-11-02), which the FTC's September 2026 notice (accessed 2026-11-02) keeps unchanged for 2026. GDPR: up to €20 million or 4% of worldwide annual turnover, whichever is higher, for breaches of data-subject rights and transparency (Art. 83(5), accessed 2026-11-02). CASL: up to C$10 million per violation for a business (s. 20, accessed 2026-11-02). These are ceilings, not forecasts. Sending-layer fines in the EU, UK and Australia are set by national statutes, so check the regulator.

Does the law of my company's country or the recipient's country apply?

Both can, and the recipient's is the one that tends to bite. GDPR reaches non-EU senders that target people in the EU (Art. 3(2), accessed 2026-11-02), and CASL covers messages accessed from a computer system in Canada (s. 12, accessed 2026-11-02). Work from the stricter of the two for each contact, which is why we recommend a per-recipient-country rule table over one blanket policy.