Is Cold Email Legal in 2026? CAN-SPAM, GDPR, PECR, CASL

Is cold email legal? In most readings, yes in the United States, yes in the United Kingdom and most of the European Union when you are writing to a named business contact for a business reason, and generally no without prior consent in Germany, Austria and Switzerland. The interesting part is everything under that sentence: the same message can be lawful in Ohio, defensible in Ireland and actionable in Munich, and the difference is not the copy. It is the recipient's country, the recipient's legal form, and whether you can show where the address came from.

This is general information, not legal advice, and outbound programs get the details wrong in expensive ways. Before you scale a list across borders, have counsel in your main target markets read your actual sequence and your actual sourcing.

Key takeaways

• The United States runs an opt-out model. You may send without consent, but seven CAN-SPAM rules apply and, per the FTC, the law makes no exception for business-to-business email.
• The European Union and the United Kingdom generally allow B2B cold email under legitimate interest, subject to an absolute right to object that you must honor immediately.
• Germany, Austria and Switzerland are consent countries. Legitimate interest does not rescue an unsolicited commercial email there, and German enforcement runs largely through competitor cease-and-desist letters.
• Canada's CASL is a consent statute with a workable implied-consent route for conspicuously published business addresses, plus a 60-day unsubscribe validity rule.
• Penalties are per-message in the US and Canada, which is what makes volume outbound legally risky rather than merely annoying.

Is cold email legal? The short answer by country

Four regimes cover most B2B outbound: CAN-SPAM in the US, the GDPR plus national ePrivacy implementations across the EU, PECR plus UK GDPR in the UK, and CASL in Canada. They differ on one question above all: do you need permission before the first message?

Read the table as a routing rule, not a verdict. The practical move is to segment your list by recipient country before the first send, because a single sequence blasted at everyone applies the weakest rule set to the strictest jurisdiction.

United States: CAN-SPAM's seven rules and no B2B exception

The FTC's CAN-SPAM compliance guide sets out seven requirements: do not use false or misleading header information, do not use deceptive subject lines, identify the message as an advertisement, include your valid physical postal address, tell recipients how to opt out, honor opt-out requests promptly, and monitor what others are doing on your behalf.

Two of those are routinely missed by outbound teams. The first is the postal address: it belongs in the message, not on a landing page. The second is the last item on the FTC's list, monitoring what others do on your behalf. Hiring an agency or a freelancer to send for you does not, in most readings, move that obligation off you, so treat an outsourced sender as part of your own program and audit what it sends.

The line that surprises most founders is explicit in the guide: "The law makes no exception for business-to-business email." There is no B2B carve-out in CAN-SPAM, only an opt-out model that happens to be permissive about the first message.

The timing and penalty rules

Opt-out requests must be honored within 10 business days. The opt-out mechanism has to keep working for at least 30 days after you send, and opting out cannot require more than replying to the email or visiting a single page. No login, no survey, no preference center maze.

The number that concentrates the mind: "Each separate email in violation of the CAN-SPAM Act is subject to penalties of up to $53,088." Per email. A 5,000-address campaign with a broken unsubscribe link is not a small compliance issue.

European Union: legitimate interest, Recital 47 and the right to object

In the EU the analysis splits in two. GDPR governs the personal data (a named work address such as first.last@company.com is generally treated as personal data). National implementations of the ePrivacy Directive govern the act of sending unsolicited commercial email, and they differ sharply from country to country.

On the GDPR half, the direct marketing case is unusually well supported by the text. Recital 47 states that "the processing of personal data for direct marketing purposes may be regarded as carried out for a legitimate interest" under Article 6(1)(f). That is a lawful basis, not a loophole, and it is generally read as carrying conditions: a genuine interest, processing that is necessary for it, and a balancing test that the recipient's rights do not override.

The condition that matters operationally is Article 21(2). It gives data subjects an absolute right to object to direct marketing, with no justification required, after which the controller must stop. "Absolute" is the key word: there is no balancing test on the objection side, no retention of the address on an active list, no "let me send one more".

In practice, an EU-facing program that generally holds up looks like this: a documented legitimate interest assessment, business addresses only, relevance to the recipient's actual role, transparency about who you are and where the data came from, a one-click opt-out in every message, and immediate and permanent suppression on objection.

Germany, Austria and Switzerland: consent countries

This is where sequences designed for US rules break. Germany's UWG §7(2) No. 2 generally requires prior express consent for advertising by email, and it is applied identically to B2B and B2C; the OLG München (29 U 857/12) confirmed that businesses are protected from unsolicited commercial email at any address. The §7(3) existing-customer exception is narrow and cumulative: the address must have been obtained from the customer during a sale, the promotion must cover only similar products or services, the customer must not have objected, and a clear no-cost opt-out must be offered both at collection and in every message.

Enforcement is the part that catches foreign senders off guard. It runs mainly through competitor Abmahnung, a cease-and-desist demand with cost recovery, so the complainant is often a rival rather than a regulator, and the response time is measured in days.

Austria is similar in effect. TKG 2021 §174, in force since November 2021, requires the addressee's consent for electronic mail sent for direct marketing, with an existing-customer exception only where the address was collected during a sale, a clear rejection right is given at collection and in each mailing, and the Robinson list is checked. There is no distinct B2B exemption. In Switzerland, mass advertising by electronic communication without the prior consent of the customer is unfair under the Swiss UWG, again with an existing-customer exception.

The operational conclusion is simple and unpopular: if your list includes DACH addresses, either build consent first or route those contacts to another channel. Sending anyway because the GDPR permits legitimate interest is, in most readings, a mistake. The barrier in those three countries is national law on unsolicited advertising, not the GDPR.

United Kingdom: PECR regulation 22 and the sole trader trap

The UK looks permissive until you look at legal forms. PECR regulation 22 prohibits unsolicited email marketing to an "individual subscriber" without prior consent. Corporate subscribers, meaning a body corporate, an LLP, a Scottish partnership or a public body, fall outside regulation 22, which is why B2B cold email to UK limited companies is generally lawful.

The trap is everything that is not incorporated. Sole traders, unincorporated partnerships outside Scotland and personal-domain addresses are generally individual subscribers and require consent. A list scraped from a directory of consultants and agencies will contain plenty of them. UK GDPR still applies on top for named individuals' work addresses, typically relying on legitimate interest, with the same objection rights as the EU.

The stakes rose recently. The Data (Use and Access) Act 2025 received Royal Assent on 19 June 2025 and raises the maximum PECR fine from £500,000 to £17.5 million or 4% of worldwide turnover, commencing in phases. Notably, the government considered extending PECR's email restrictions to corporate subscribers and declined, so the B2B exemption survives, with much larger penalties attached to getting the individual-subscriber question wrong.

Canada: CASL implied consent, and the 60-day rule

CASL is a consent statute, but the implied-consent routes in sections 10(9) and 10(10) are broad enough for real outbound. Consent is implied where there is an existing business relationship, defined to include a purchase within the two-year period before the message or an inquiry or application within the six-month period before it.

The route most cold outreach relies on is different: consent is implied where the recipient has conspicuously published or disclosed their electronic address without a statement that unsolicited commercial messages are unwanted, and the message is relevant to their business, role or official capacity. Three conditions, all of which need to be true. A publicly listed address on a company site generally qualifies. A guessed address pattern generally does not, because nothing was conspicuously published, and neither does an irrelevant pitch sent to a published address.

Section 11 sets the mechanics: the unsubscribe mechanism must be free, must remain valid for a minimum of 60 days after the message is sent, and requests must be given effect "without delay, and in any event no later than 10 business days." Section 20(4) sets the ceiling: "The maximum penalty for a violation is $1,000,000 in the case of an individual, and $10,000,000 in the case of any other person."

The 60-day rule quietly rules out disposable sending domains. If you rotate a domain out of service a month after a campaign, the unsubscribe link in those messages dies before its statutory life is over.

The 14-item cold email compliance checklist

Work through this before a cross-border campaign, and keep the artifacts. Most of compliance is documentation you can produce a year later.

1. Map every recipient to a country before the first send, and segment the list accordingly.
2. Pick a lawful basis per segment (opt-out for the US, legitimate interest for the UK and most of the EU, consent for DACH) and write it down.
3. Route consent-required countries out of your default sequences entirely.
4. In the UK, screen for sole traders, unincorporated partnerships and personal-domain addresses and treat them as individual subscribers.
5. Record the source and date of every address, especially where you are relying on conspicuous publication.
6. Run a legitimate interest assessment for EU and UK contacts: purpose, necessity, balancing. Keep it current.
7. Keep the message relevant to the recipient's actual role. Relevance is a legal condition in Canada and a balancing factor in Europe, not just good copy.
8. Use accurate header, From and Reply-To information on every send.
9. Keep subject lines honest about what the message is.
10. Make the commercial nature of the message and your identity obvious in the body.
11. Include a valid physical postal address in messages to US recipients.
12. Provide a no-cost opt-out that stays live: at least 30 days after sending under CAN-SPAM, at least 60 days under CASL. Use both a one-click header and a visible link.
13. Honor opt-outs well inside 10 business days. Aim for immediate, since Google recommends fulfilling unsubscribe requests within 48 hours and Yahoo's Sender Hub tells senders to "honor unsubscribes within 2 days."
14. Keep one permanent do-not-contact list across every mailbox and campaign, check it before every send, and supervise anyone sending on your behalf.

How to enforce this inside the sending workflow

A checklist that lives in a document gets skipped under quota pressure. The parts worth wiring into the tool are the ones that fail silently.

One-click unsubscribe and visible opt-out links. A working, no-cost opt-out is a legal requirement under CAN-SPAM and CASL. One-click unsubscribe is a separate, platform-side rule: Google and Yahoo require it of bulk senders, while Microsoft's high-volume guidance asks for a visible functional unsubscribe link without explicitly mandating the one-click header. SDRclose adds one-click List-Unsubscribe headers and opt-out links to outbound messages so the mechanism is not something a rep can forget to paste. The platform-side rules are covered in our guide to bulk sender rules for cold email.

A permanent do-not-contact list. Suppression has to survive list re-imports, new sequences, new mailboxes and new team members, which is why it belongs at the workspace level rather than inside a campaign. An opt-out that only stops one sequence is the most common way a compliant program becomes non-compliant three months later.

Authentication and mailbox health. SPF, DKIM and DMARC are not legal requirements, but they are how mailbox providers decide whether your compliant mail is even seen. SDRclose runs mailbox health checks that cover SMTP and IMAP connectivity, credentials and SPF, DKIM and DMARC DNS records, and alerts when one breaks. If mail is authenticated and still filtered, the diagnostic sequence is in cold emails going to spam.

Your own mailboxes, not a shared pool. Sending from your own domains and mailboxes keeps the sender identity accurate, keeps reputation attached to you rather than to a pooled resource, and makes the "who sent this" question answerable. That tradeoff is examined in own mailbox versus a shared warmup pool.

Data subject rights. Access, export and deletion requests are operational work, not legal theory. Our GDPR documentation and security overview set out how data is handled, exported and deleted.

Where this leaves you

Cold email is legal in the largest B2B markets, on conditions that are mostly knowable in advance. The programs that get into trouble are rarely the ones with aggressive copy. They are the ones that treated a global list as a single audience, could not say where an address came from, or let an opt-out apply to one campaign instead of forever.

Get the segmentation and the suppression right and the legal surface shrinks to something a small team can actually manage. If you want the opt-out plumbing, the permanent do-not-contact list and the authentication checks handled by the tool rather than by a checklist, start a 7-day trial. Then have counsel in your target markets review the sequence you actually intend to send.