Cold email sits in a grey area in most people's minds. In practice, the rules are fairly clear, and they depend on where the person you're emailing is, not where you are. In the US and the UK, business cold email is allowed without prior consent if you follow a handful of rules. Parts of the EU are stricter. And whatever the law says, Gmail has its own rules about what reaches the inbox. Here's the summary for B2B senders. It isn't legal advice, so check anything material with a lawyer in the market you're emailing.
- US: legal without consent under CAN-SPAM, with an honest sender and subject, a postal address and an opt-out honoured within 10 business days.
- UK: legal to companies and other corporate bodies without consent under PECR. Sole traders and some partnerships need consent.
- EU: GDPR gives everyone the right to object to marketing at any time, and some countries, such as Germany, require consent even for business email.
- Everywhere: say who you are, make opting out easy, and stop the moment someone asks.
- Gmail's sender rules decide whether a legal email reaches the inbox at all.
United States: CAN-SPAM
CAN-SPAM is an opt-out law: you don't need permission before the first email, but every email has to meet its requirements, and the FTC's compliance guide says plainly that the law makes no exception for business-to-business email.
- Honest headers. The From, To and routing information must be accurate and identify the sender.
- An honest subject line. It has to reflect what's in the email. Fake RE: or FWD: prefixes are a risk.
- A postal address. A valid physical postal address for your business.
- A way to opt out. Clear and easy to use, and still working at least 30 days after you send.
- Fast opt-out handling. Honoured within 10 business days, and never sold or passed on.
- Oversight of anyone sending for you. Using an agency doesn't transfer the responsibility.
The penalty is set per email: up to $53,088 for each separate email in violation, according to the FTC. That's why the opt-out and the address line go into every message we send, follow-ups included.
United Kingdom: PECR and UK GDPR
In the UK, email marketing falls under the Privacy and Electronic Communications Regulations. The ICO's guidance on electronic mail marketing draws the line by type of recipient. You can email any corporate body, which covers companies, LLPs, Scottish partnerships and government bodies, without prior consent. Sole traders and some partnerships are treated as individuals, so they need consent, or must be existing customers who bought something similar and didn't opt out.
Either way, you must not disguise or conceal your identity, and you must give a valid address where people can opt out. The ICO also suggests keeping a do-not-email list of businesses that object and screening every new list against it. Emailing a named employee at their own work address also involves their personal data, so UK GDPR applies alongside PECR. The ICO notes its guidance is under review following the Data (Use and Access) Act, so check it before a large UK campaign.
European Union: GDPR, plus each country's rules
GDPR doesn't ban cold email, but it gives every person a right to object. Article 21 says that where personal data is used for direct marketing, the person can object at any time, and once they do, it can no longer be used for that purpose. In practice, that means an opt-out that works and a suppression list you never email again.
On top of GDPR, each EU country sets its own rules for email marketing, and they differ. Germany is the clearest example of a strict one: its unfair competition law, § 7 UWG, treats email advertising without the recipient's prior express consent as an unacceptable nuisance, and draws no line between consumers and businesses for email. Check the country before you send, not after.
The rules that aren't laws: Gmail's
A legal email can still go to spam. Google's email sender guidelines require SPF or DKIM on every sending domain, and ask senders to keep their reported spam rate below 0.3%, ideally below 0.1%. Anyone sending more than 5,000 messages a day to Gmail also needs SPF, DKIM and DMARC, and one-click unsubscribe on marketing messages. Breaking these doesn't bring a fine. It brings the spam folder, for every email you send afterwards.
A checklist that works almost everywhere
- Know which countries your prospects are in, and check each one's rules.
- Email companies and roles, not consumers. Treat sole traders as individuals in the UK.
- Use your real name, company and a postal address in every email.
- Give a clear way to opt out in every email, follow-ups included, and act on it straight away.
- Keep a suppression list and check every new list against it.
- Send from a separate, authenticated domain, never your main one.
B2B cold email templates and subject lines shows where the opt-out and address lines go, and how to follow up on a cold email covers when to stop.
How we run it
Our cold email agency service builds every campaign to the rules where the prospects are, not where the client is. Cold email never goes out from a client's main domain; each campaign uses separate sending domains with SPF, DKIM and DMARC, warmed for about two weeks, with a capped daily volume per inbox. Opt-outs are honoured straight away and kept on a suppression list. We're not the right fit if a campaign depends on emailing consumers, or on markets that require consent you don't have. What a cold email setup needs covers the technical side.
Questions people ask
Is cold email illegal?
Not in the US or the UK, for business email sent within the rules: an honest sender and subject line, a postal address in the US, and a working opt-out that you honour. Some countries are stricter. Germany, for example, requires prior consent for email advertising, even to businesses.
Do you need consent to send B2B cold email in the US?
No. CAN-SPAM is an opt-out law: you can email without prior consent, but every message needs accurate sender details, an honest subject line, a valid postal address and a clear way to opt out, and opt-outs must be honoured within 10 business days. The FTC says the law makes no exception for business email.
Is cold email legal in the UK?
To companies, LLPs and other corporate bodies, yes: the ICO says you can email any corporate body without consent, as long as you identify yourself and give a valid address to opt out. Sole traders and some partnerships are treated as individuals and need consent.
Is cold email legal under GDPR?
GDPR doesn't ban it, but it gives every person a right to object to direct marketing at any time, and once they object, their data can't be used for marketing again. Each EU country also has its own email marketing rules, and some, such as Germany, require consent even for business email.
What happens if you break CAN-SPAM?
The FTC says each separate email in violation can bring a penalty of up to $53,088. Hiring an agency doesn't move the responsibility: the business being promoted and the sender can both be held liable.
Do cold emails need an unsubscribe link?
They need a clear way to opt out, which can be a link or a simple reply. Separately, Google requires one-click unsubscribe on marketing messages from bulk senders, those sending more than 5,000 messages a day to Gmail, so high-volume senders need the link too.
Planning outbound into a new country? Book a strategy call and we'll tell you what the rules allow there before anything is sent.
