Yes, cold email is legal in most tier one markets, including the United States, the United Kingdom, and most of the EU, as long as you follow the rules that apply where your recipient sits. Canada and Australia are stricter because both are built on consent. The law does not ask whether your email was cold. It asks who you sent it to, what it said, whether you identified yourself, and how you handled the person who said stop.
I am a sender, not a lawyer. What follows is the working understanding I have sent under for years across twenty plus B2B clients, written the way I wish someone had written it for me. Use it to send responsibly. For anything specific to your exact situation, get a real lawyer.
Is cold email legal in the United States? CAN-SPAM
The US is the most permissive of the five. The CAN-SPAM Act does not require prior consent to send a commercial email. You can email a business prospect you have never spoken to. What the law demands is honesty and an exit.
Your headers and routing information must be accurate. Your subject line must not mislead anyone about what is inside. You must include a real physical postal address for your business in the footer. Every email needs a working opt out, a person must be able to unsubscribe without logging in, paying, or jumping through hoops, and you have to honor that opt out within 10 business days. Once someone opts out, you cannot sell or transfer their address either.
Notice what is not in there: no requirement that they opted in, and no ban on cold outreach to businesses. CAN-SPAM trouble mostly finds senders who hide who they are, fake their headers, or keep mailing people who unsubscribed. Send like a real business and the US rules are very manageable.
Is cold email legal in the UK? PECR and UK GDPR
The UK runs on two overlapping sets of rules. PECR covers the sending itself. For companies and other corporate subscribers, businesses can generally be sent marketing email as long as each message clearly identifies you and carries a simple way to opt out. The stricter PECR consent rules bite on individuals, and this is the part senders miss: sole traders and ordinary partnerships count as individuals in the UK, not as businesses. Mailing a named person at a limited company is one thing. Mailing a sole trader's inbox is another, and it is treated more like consumer email.
Alongside PECR sits UK GDPR, which governs the personal data side, the name and work email address you are processing. Most legitimate B2B senders rely on legitimate interests as their lawful basis: the outreach is relevant to the person's role, the impact on them is minimal, and they can object at any time. That balancing act needs to be real, not a slogan. Relevant offer, right person, easy objection, and records of where the data came from. Keep the targeting honest and the UK is workable.
Is cold email legal in the EU? GDPR and national rules
In the EU, GDPR is the layer everyone has heard of, and legitimate interests is the basis most B2B senders use for work related outreach, the same way as in the UK. The email itself also falls under the ePrivacy rules, and those are set country by country, which is where senders get caught out. Some member states are relatively workable for B2B email to corporate addresses with a clear opt out. Others are noticeably stricter about prior consent, Germany being the famous example.
The practical approach most careful operators take: target business addresses, keep the offer plainly relevant to the recipient's job, identify yourself and your company, include an easy opt out in every message, and respect objections immediately and permanently. If a large part of your list sits in one stricter country, that country's rules deserve their own look before you send, not after a complaint.
Is cold email legal in Canada? CASL is the strict one
Canada's Anti-Spam Legislation, CASL, is consent based and it is the strictest of the five regimes on this page. You generally need consent before sending a commercial electronic message to a Canadian recipient, and the proof burden sits on you, the sender.
There is a form of implied consent that matters for B2B: if someone has conspicuously published their business email address, for example on their company website, without a note saying they do not want unsolicited messages, and your message is relevant to their role and functions, consent may be implied. That is a narrower door than most senders assume. It is not a license to scrape and blast. Your messages still need to identify you and carry a working unsubscribe, and unsubscribes have to be honored promptly. If Canada is a serious market for you, treat consent records as part of the infrastructure, because under CASL you are the one who has to prove it.
Is cold email legal in Australia? The Spam Act
Australia's Spam Act is also consent based. Commercial messages need the recipient's express consent, or consent that can reasonably be inferred from an existing relationship or their conduct. The inferred side is where B2B senders operate: a business contact whose address is published in connection with their role, receiving a message relevant to that role, can fall on the acceptable side of the line. A purchased list of strangers usually cannot.
Australian messages must clearly identify the person or business sending them, include accurate contact details, and carry a functional unsubscribe that gets honored within the timeframe the law sets, five business days. As with Canada, the sender carries the responsibility, so keep your sourcing clean and your identification honest.
The rules I send by, in every market
Whatever the country, my sending follows one checklist, because it keeps me on the right side of all five regimes at once:
- Real names, real company, real address in the footer. If a prospect cannot tell who sent the email in five seconds, it does not go out.
- One clear purpose per email, relevant to the recipient's actual role. Relevance is both a legal basis and a reply rate strategy.
- An opt out in every single message, honored fast and permanently. Someone who says no is doing you a favor compared to someone who says spam.
- Lists built from sources I can explain. If I cannot say where an address came from, it does not get mailed, which is another reason every list runs through a free email verifier and gets cleaned before loading.
- Business addresses, found properly. When I need to reach a named person at a company, I build the address from real patterns with an email permutation generator and verify it, instead of buying mystery data.
One more thing that sits under all of this: legality and deliverability are cousins. The same behavior regulators dislike, fake identity, no opt out, irrelevant blasting, is exactly what spam filters punish. Send legally and your mail also lands better. And none of it works without correct authentication, which is why the deliverability side, SPF, DKIM, and a DMARC record that actually exists, matters just as much; my guide to DMARC for cold email domains covers that half.
Frequently asked questions
Can you get sued for emailing someone?
In the US, regulators enforce CAN-SPAM more than individuals do, and the senders who get into real trouble are usually faking headers, hiding their identity, or ignoring opt outs. In stricter consent markets like Canada, penalties for careless bulk sending are a genuine risk. Ordinary, honest B2B outreach with a working opt out is not what enforcement goes after, but the rules are the reason to stay ordinary and honest.
Are you allowed to send cold emails to businesses?
In the US and the UK, yes, businesses can generally be cold emailed within the rules described above. In the EU it depends partly on the country. In Canada and Australia you need consent, express or properly inferred, which limits true cold outreach to carefully sourced business contacts.
Do I need permission before sending a cold email?
It depends where the recipient is, not where you are. The US does not require prior permission. Canada and Australia are consent based. The UK and EU sit in between, with legitimate interests doing the work for relevant B2B email in many cases. When you send across borders, the recipient's rules are the ones that count.
Does adding an unsubscribe link make my cold email legal?
It is necessary almost everywhere, but it is not the whole law. You also need honest identification, truthful headers and subject lines, a business address in US mail, a lawful basis or consent depending on the market, and opt outs that are actually honored. Our done for you infrastructure builds set up the technical side, but no setup replaces sending like a real business.
One more time, plainly: I run sending infrastructure for a living and this page is my working understanding, not legal advice. Laws change and details matter. Before a big campaign into a new market, an hour with a lawyer who knows that market is money well spent.