Is cold email legal? CAN-SPAM, GDPR and UK PECR for B2B outreach
Updated 18 October 2026 · 8 min read
Short answer
B2B cold email is legal in the United States under CAN-SPAM if you use honest headers and subject lines, include a physical postal address and honour opt-outs within 10 business days. In the UK and most of the EU you can usually email business contacts under GDPR's legitimate interest basis, provided the email is relevant to their role, you say who you are and where you got their data, and every email offers an easy opt-out. Germany and a few other countries are stricter and often require prior consent, so many teams exclude them or use other channels there.
The rules by region
| Region | Main law | B2B cold email allowed? | Key requirements |
|---|---|---|---|
| United States | CAN-SPAM Act | Yes, opt-out model | Accurate From/subject, physical postal address, clear opt-out honoured within 10 business days |
| United Kingdom | UK GDPR + PECR | Yes to corporate addresses (e.g. jane@company.co.uk) | Identify yourself, legitimate interest assessment, opt-out in every email; sole traders and partnerships are treated like consumers |
| EU (most countries) | GDPR + national ePrivacy rules | Usually, under legitimate interest | Relevance to the role, transparency about data source, easy objection, data minimisation |
| Germany, Austria | UWG / national ePrivacy | Often requires prior consent | Many teams exclude these countries from cold email |
| Canada | CASL | Limited (implied consent cases) | Publicly listed business address + relevance to role, or prior consent |
United States: CAN-SPAM
- No misleading headers. The From name, address and domain must identify the sender. Lookalike sending domains are fine when they clearly belong to your company and forward to your real site.
- Honest subject lines that reflect the content of the email.
- A valid physical postal address in every email (a registered PO box or mailbox service works).
- A clear way to opt out, honoured within 10 business days, with the address removed from all future sends.
- You are responsible even if an agency sends on your behalf.
UK and EU: GDPR legitimate interest
- 1
Target by role
Email people whose job makes your offer relevant (e.g. Head of Sales for a sales tool). Avoid broad consumer-style lists.
- 2
Document a legitimate interest assessment
One page: your interest, why the email is necessary, and why it doesn't override the recipient's rights. Keep it on file.
- 3
Be transparent
Say who you are, why you're contacting them, and where you got their details, with a link to your privacy notice.
- 4
Make objecting easy
One-line opt-out in every email, honoured immediately and kept on a suppression list across all your mailboxes.
- 5
Minimise and expire data
Store only name, role, company and work email; delete prospects who don't engage after a set period.
Deliverability rules apply everywhere
Separately from the law, Gmail, Yahoo and Microsoft require SPF, DKIM and DMARC, a spam complaint rate under 0.3%, and one-click unsubscribe for bulk senders. See bulk sender requirements. Sending from separate, authenticated domains also keeps complaints away from your main domain: protect your main domain.
Compliance checklist
- Business email addresses only, relevant to the recipient's role
- Real sender name and company; sending domain forwards to your website
- Postal address and one-line opt-out in every email
- Shared suppression list across every mailbox and sequencer
- Legitimate interest assessment on file for UK/EU prospects
- Germany/Austria excluded or consent-based
- Low volume per mailbox (about 30/day) and warmed mailboxes
Get authenticated sending domains and warmed Google Workspace mailboxes, billed in USD or EUR.
Domains, DNS, Google Workspace mailboxes and warmup. From $2.69 per mailbox ($35 for 10).
FAQ
Is cold email legal in the US?
Yes. CAN-SPAM allows unsolicited commercial email if headers and subject lines are honest, you include a physical postal address and you honour opt-outs within 10 business days.
Is cold email legal under GDPR?
B2B cold email is usually possible under the legitimate interest basis when the message is relevant to the recipient's role, you are transparent about who you are and where you got their data, and you offer an easy opt-out. Some countries, notably Germany, are stricter.
Can I cold email UK businesses?
Under PECR you can email corporate subscribers (limited companies, LLPs, public bodies) without prior consent if you identify yourself and offer an opt-out. Sole traders and some partnerships need consent, as consumers do.
Does using separate sending domains break CAN-SPAM?
No, as long as the domain clearly identifies your company and isn't used to disguise who is sending. Forward the domain to your real website and use your real company name.