Cold email is legal in the United States. The CAN-SPAM Act does not ban unsolicited commercial email. It sets rules for how you send it and gives recipients the right to make you stop. Outside the US the answer depends on the country. Canada and Australia generally require consent first. The UK and EU treat business contacts more gently than consumers, but data protection law still applies. This guide covers each regime, what a compliant message contains, what breaking the rules can cost, and how to keep a multi-country outbound program in line.

Table of Contents

• Key Takeaways
• Is cold email legal?
• United States: CAN-SPAM in practice
• United Kingdom: PECR plus UK GDPR
• European Union: ePrivacy rules and GDPR
• Canada: CASL
• Australia: the Spam Act 2003
• What breaking the rules can cost
• A compliance workflow for high-volume senders
• Compliant and effective are the same goal
• Our perspective
• Run compliant campaigns with PlusVibe
• FAQ
• Sources

Key Takeaways

• In the US, cold email is allowed under an opt-out model: accurate headers, a real postal address, a working opt-out, and no deceptive subject lines.
• Honor US opt-outs within 10 business days. Australia is stricter at 5 working days.
• Canada and Australia generally require consent before you send. The UK and EU have more room for B2B outreach, but GDPR still demands a lawful basis and an easy way to object.
• Outsourcing does not move the risk. The company whose product is promoted and the sender can both be liable.
• Segment campaigns by country and apply the strictest relevant rule to each segment.

This is general information, not legal advice. If you send into several jurisdictions or handle EU personal data at volume, have a privacy lawyer review your process once.

Is cold email legal?

In most major markets, yes, but “legal” means different things in each one. The mistake that gets senders in trouble is assuming the US rules apply everywhere.

The US treats cold email as a conduct problem. You may email a stranger about your product as long as the message is honest and the recipient can leave your list. The FTC’s own guide states that CAN-SPAM covers any message whose primary purpose is the commercial advertisement or promotion of a product or service, and it makes no exception for B2B. A message to a procurement manager is covered just as a message to a consumer is.

Canada and Australia treat it as a consent problem. You need permission, express or implied, before the first commercial message. The UK and EU sit in between: the rules turn on who the recipient is, what data you hold and which lawful basis you rely on.

The quick comparison:

United States: CAN-SPAM in practice

The CAN-SPAM Act is the rule most cold emailers worry about, and it is the easiest to meet. According to the FTC’s compliance guide, a compliant commercial email must:

1. Use accurate header information. The “From”, “To” and “Reply-To” fields and routing details must identify the real sender.
2. Avoid deceptive subject lines. The subject must reflect what is inside the message.
3. Disclose that it is an advertisement. The FTC requires clear disclosure, though it leaves the wording to you.
4. Include a valid physical postal address. This is your street address, a registered P.O. box or a private mailbox.
5. Give a clear way to opt out. The mechanism must work, and you must honor requests within 10 business days.

That last point deserves attention. Once someone opts out, you cannot sell or transfer their address, and you cannot keep emailing them. In practice that means a suppression list shared across every campaign and every inbox you send from, not one per campaign.

What CAN-SPAM does not require

There is no requirement to get permission first. That is the reason the US is called an opt-out country. There is also no exemption for small senders, for B2B, or for a “one-off” email that is clearly promotional.

Who is liable

If you hire an agency or a platform to send for you, the responsibility stays with you. The FTC says that compliance is mandatory whether or not you outsource email marketing, and that both the business whose product is promoted and the company that sends the message can be legally responsible. Agencies running campaigns for clients should write compliance duties into the contract and check them in practice.

Gray areas people ask about

Does a personal sign-off count as non-commercial? If the primary purpose is to promote a product or service, the message is commercial. A friendly tone does not change that.

Can I email an address I found on LinkedIn or a company site? CAN-SPAM does not prohibit it. But the FTC lists harvesting email addresses among the aggravated offenses that can bring criminal penalties, which in the guide cover things like harvesting addresses and unauthorized access. Sourcing matters, so use legitimate sources and verify what you collect.

Is a follow-up covered? Yes. Each commercial message in a sequence must carry the same elements.

United Kingdom: PECR plus UK GDPR

In the UK, the Privacy and Electronic Communications Regulations (PECR) govern electronic marketing, and UK GDPR governs the personal data behind it. The ICO’s guidance explains that rules for marketing to companies are generally less strict than rules for individuals, and that individuals include sole traders and some partnerships.

That has a practical consequence. Emailing a named person at a limited company is usually easier than emailing a sole trader at a personal-looking address. Whichever applies, you still need to identify yourself, offer an easy opt-out and handle the personal data lawfully, because a work address like firstname.lastname@company.com is personal data.

The UK also has a “soft opt-in” for existing customers. A business can market similar products to people who bought from it, provided it offered a chance to opt out when collecting their details and in every later message. It does not help with cold prospects who have never bought anything.

European Union: ePrivacy rules and GDPR

The EU has no single cold email statute. Each member state implements the ePrivacy Directive in its own law, and some are stricter on marketing to companies than others. The ICO notes that EU countries have similar laws based on the ePrivacy Directive, with some stricter rules for marketing to companies. Before you send into Germany, for example, check the national rule rather than assuming the general one.

Cold email and GDPR

GDPR applies because you are processing personal data: a name, a work email address, a job title. For B2B prospecting, most senders rely on legitimate interest as their lawful basis. The European Data Protection Board summarizes it as three tests: a clear interest, processing that is necessary for it, and a balance that does not override the individual’s rights and freedoms.

To apply that to a prospecting program, work through four questions and write the answers down:

• Purpose. Why do you want to contact this person? “They run procurement at a company that buys what we sell” is a purpose. “They have an email address” is not.
• Necessity. Is email a reasonable way to reach them, and are you collecting only the data you need?
• Balance. Would this person reasonably expect to hear from a vendor in their field? A relevant offer to the right role passes more easily than a generic blast.
• Transparency and objection. Tell them who you are, where you got their data and how to object. Then act on an objection.

The last point is not theoretical. The Belgian data protection authority fined an association EUR 1,000 for failing to facilitate a recipient’s right to object to direct marketing. The amount was small, but the case shows regulators look at the unsubscribe experience, not only at the sending.

What a GDPR-aware cold email adds

Beyond the standard elements, add a short line saying why you are writing (for example, that you contacted them because of their role), a link to your privacy notice, and a plain opt-out. Keep a record of the source of each contact so you can answer if someone asks where you found their details.

Canada: CASL

Canada’s Anti-Spam Legislation is among the strictest. The CRTC says CASL requires prior consent, express or implied, for commercial electronic messages, clear sender identification and an easily performed unsubscribe mechanism. Cold email to a stranger therefore needs a basis for implied consent or an exception.

There are narrow B2B routes. One is when the recipient’s address is conspicuously published and the message is relevant to their professional role, and this exception is interpreted narrowly. If you rely on it, document where the address was published and why your offer relates to the person’s job. Where you cannot, do not send.

The CRTC also recommends that businesses collecting an address, for example at checkout, secure express consent rather than assume implied consent. The principle carries over to prospecting: when in doubt, ask.

Australia: the Spam Act 2003

Australia’s Spam Act requires prior consent, which may be express or inferred, along with clear sender identification and an easy unsubscribe facility, according to the ACMA. The same page sets two operational numbers worth building into your tooling: unsubscribe requests must be processed within 5 working days, and the unsubscribe mechanism must keep working for at least 30 days after you send.

Some organizations, including registered charities and government bodies, can be exempt from the consent requirement for certain messages, though they must still give contact details. Commercial B2B senders should not assume they fall under an exemption.

The ACMA also says businesses are liable for their third-party providers’ compliance and cannot outsource their risk. That matters for anyone using a mailbox provider, an agency or a sending platform. If you are choosing how to set up business mailboxes, this business email setup walkthrough covers the practical side of getting working inboxes in place before you add identification and unsubscribe details.

What breaking the rules can cost

Penalties vary widely, and the headline numbers are the reason legal review is worth the time:

The per-email figure in the US is what makes volume dangerous. A mistake in a template is multiplied by every contact in the list. Reputation is the quieter cost: complaints and spam reports damage your domain and inbox placement long before a regulator calls.

A compliance workflow for high-volume senders

Compliance fails at scale when it depends on people remembering. Build it into the process.

1. Segment by country before you write

Tag every prospect with the country where they work. Then apply the right rule set to each segment. A common approach is to segment campaigns by country and apply the local compliance standard. For a US-only list, the CAN-SPAM elements are enough. For Canada and Australia, hold the segment back unless you can show consent or a valid exception. For the UK and EU, record your lawful basis and send only to relevant roles.

2. Verify and source cleanly

Send only to addresses you collected from legitimate sources, and run them through verification. Bounces hurt deliverability, and scraping addresses indiscriminately is the pattern regulators single out. Keep a note of where each contact came from.

3. Standardize the template footer

Every template carries the same block: sender name, company name, physical postal address, a one-click opt-out line and, for EU and UK segments, a link to your privacy notice. Lock it so that individual reps cannot delete it.

4. Share one suppression list

When someone opts out, they should disappear from every campaign, every sender inbox and every client workspace within hours, not days. This also keeps you comfortably inside the 10-business-day US limit and the 5-working-day Australian one. Tools that process unsubscribes automatically make the difference here, and this B2B sales engagement platform is an example of how outreach software can support unsubscribe handling and relationship management.

5. Write honest subject lines and headers

Use a real sender name and a subject that matches the content. Do not fake a reply thread (“Re:”) or imply a prior relationship. Misleading headers are the core CAN-SPAM violation.

6. Keep records

Keep your lawful-basis notes, consent evidence, source records and opt-out logs. If a recipient or regulator asks, a documented answer closes most disputes quickly. Our cold email compliance checklist for teams turns these steps into a review you can run before every launch.

7. Review each region’s rules on a schedule

Laws and guidance change. Check the regulator pages linked in this article every few months, and recheck whenever you add a new country to your target list.

Compliant and effective are the same goal

Treating compliance as a cost misses the point. A message that is relevant to the recipient’s role, honest about who is writing and easy to decline is also the message that earns replies and keeps spam complaints low. Complaints push mail toward the spam folder, which is a deliverability problem as much as a legal one.

For deeper reading on specific regimes, see our guides to CAN-SPAM and cold email and GDPR and cold email for B2B senders. If you are building templates, our guide to sales email templates shows how to keep them short and relevant, which helps on both counts.

Our perspective

Most cold email problems we see are not exotic legal questions. They are process problems. A rep edits a footer, a list gets imported twice, an unsubscribe sits in one inbox and never reaches the others.

We built PlusVibe around the idea that good infrastructure makes good habits easier. Private warm-up, isolated sending infrastructure and deliverability monitoring are designed to protect your sender reputation, and verification helps you send only to addresses that are real. Clean lists, honest sending and fast opt-outs support each other.

Our advice is simple: pick the strictest rule that applies to a segment, build it into the template and the sequence, and let the platform do the repetitive work. Compliance then stops being a task someone has to remember.

Yaro

Run compliant campaigns with PlusVibe

If you are setting up outbound across several inboxes or client accounts, we designed PlusVibe to give you the controls this guide describes: sequencing and automation, email verification, personalization, private warm-up and deliverability monitoring in one place. You can start with a free trial. Paid Personal plans are listed at $37 to $58 per month, and agencies and larger teams can look at the Business and Agency plans.

See the plans and pricing, or check your list first with our free email verification tool. Teams that want help with mailbox setup can look at our done-for-you email setup.

FAQ

Is cold email legal in the US?

Yes. CAN-SPAM does not require permission before you send a commercial email. It requires accurate headers, a non-deceptive subject line, ad disclosure, a valid postal address and a working opt-out that you honor within 10 business days. Breaking these rules can cost up to $53,088 per email.

Does GDPR ban cold email?

No, but it applies whenever you process personal data, including a work email address. Most B2B senders rely on legitimate interest, which needs a clear purpose, necessity and a balance that respects the person’s rights. You must also be transparent about your identity and data source, and make objecting easy.

Can I cold email people in Canada or Australia?

Only with consent. Both countries require express or implied (Australia: inferred) consent before a commercial message, plus sender identification and an unsubscribe option. Canada has narrow B2B exceptions, such as a conspicuously published address with a relevant message. Australia requires opt-outs to be processed within 5 working days.

Am I responsible if an agency or tool sends the emails?

Yes. The FTC says CAN-SPAM compliance applies even when you outsource, and both the sender and the promoted business can be liable. The ACMA takes the same view on third-party providers. Put compliance duties in writing and check the unsubscribe flow yourself.

Sources

• CAN-SPAM Act: A Compliance Guide for Business (FTC)
• Electronic and telephone marketing (ICO)
• Legitimate interest summary (EDPB)
• Frequently Asked Questions about Canada’s Anti-Spam Legislation (CRTC)
• Avoid sending spam (ACMA)
• Dealing with spam (ACMA)
• Email and SMS unsubscribe rules (ACMA)
• Action on scams, spam and telemarketing, January to March 2024 (ACMA)
• Email Marketing Laws: Australia, UK, EU, Canada and US
• Cold Email Laws by Country: US, UK, EU, Canada, and Australia

Recommended

• Can-Spam and Cold Email: What the Law Allows in 2026
• Cold email compliance: a simple checklist for teams
• GDPR and Cold Email: What B2B Senders Need to Know
• 8 Cold Email Best Practices for 2026: A Deep Dive