Is cold email legal? GDPR, CAN-SPAM and PECR, in plain English

The honest answer to “is cold email legal?” is that it depends on three things you probably haven’t written down: who the recipient is, where they are, and what the message is for. Most advice collapses those into a single rule, usually “you need consent” or “you can email anyone who doesn’t object,” and both versions lead teams wrong. Cold email is legal in most markets when it is done with care. It becomes illegal in specific, predictable ways, and the cases are not hard to understand once you separate the questions.

This is an explainer from a practitioner, not legal advice. Rules change, regulators interpret them differently, and your own counsel should review your specific setup. What follows is how the framework works, where teams most often trip, and what to document so you can show your reasoning if anyone asks.

Is cold email legal? The three questions that decide it

Before you look up any law, answer these three questions for each segment of your list.

Who is the recipient? A corporate mailbox at a company, such as jane.doe@acme.com, is treated differently from a named individual, such as a sole trader at jane.doe@gmail.com or a freelancer using their personal name at their own domain. Many regimes give business addresses lighter treatment and protect individuals more strictly. A role address like info@acme.com usually sits on the business side, though its legal status is less settled in some countries.

Where is the recipient? The law that applies generally follows the recipient’s location, not your company’s. A US company emailing a London office is subject to UK rules as well as US ones, and a sender in Lisbon writing to someone in Ohio is covered by CAN-SPAM. Teams that build one global sequence should assume the strictest rule that applies to any recipient in it.

What is the message for? Commercial messages, meaning those that promote a product or service, carry most of the obligations. A pure service notice to an existing customer, such as a password reset or an invoice, sits in a different category. Cold outreach is commercial by definition, so it lives in the stricter bucket.

Answer those three questions and most of the legal picture comes into focus. The rest is applying the specific rules for each jurisdiction.

United States: CAN-SPAM is opt-out, and more lenient than people think

The US regime is the one most cold senders encounter first, and it is more permissive than the European approach. CAN-SPAM does not require prior consent for commercial email to business or consumer recipients. It requires that the email follow a set of conduct rules, and that you honor opt-outs.

The core requirements are straightforward. Header information must be accurate, meaning the From, To and routing information cannot be false or misleading. The subject line cannot deceive the reader about the content. The message must identify itself as an advertisement or solicitation, unless the recipient has opted in. It must include a valid physical postal address. It must provide a clear way to opt out, and the sender must honor that request within 10 business days. Once someone has opted out, you cannot sell or transfer their address to anyone else for the purpose of email marketing.

Two points trip up cold senders. First, the 10-business-day window is a ceiling, not a target. Your suppression should take effect the same day, and any sequence that continues emailing someone after they have asked to stop is a violation regardless of how many days it took. Second, CAN-SPAM contains rules against “address harvesting” and “dictionary attacks,” which are treated as aggravated violations. Generating addresses by brute-forcing common name combinations at a domain is the kind of activity these provisions target, and it is a bad idea for deliverability reasons too.

Penalties under CAN-SPAM are assessed per message, and they run into the tens of thousands of dollars per violation, so a sequence sent to a long list can produce a very large exposure. Enforcement is uneven, but the arithmetic is the reason to get the opt-out mechanics right on day one.

United Kingdom: PECR splits business from individual

The UK regime adds a layer that catches many teams off guard. The Privacy and Electronic Communications Regulations (PECR) govern electronic marketing, and they draw a sharp line between corporate subscribers and individuals.

Under PECR, you can email a corporate subscriber, such as a limited company, without prior consent, provided you identify yourself and offer a simple way to opt out. Sole traders and some partnerships are treated as individuals, and for them you generally need consent before sending unsolicited marketing. A freelancer with a personal business email may therefore sit on the stricter side even though they run a business.

The UK GDPR also applies whenever you process personal data, and a named person’s email address is personal data. That means you need a lawful basis for holding and using the address. For cold B2B outreach, legitimate interests is the usual basis, and it requires a documented balancing test. You must show that your interest in reaching the person is not overridden by their rights, and that the person would reasonably expect to be contacted about this kind of offer. Writing that assessment down is part of the work, not a formality.

Transparency is the other requirement. When you collect a person’s data from a source other than the person themselves, you must tell them where you got it, generally within one month of collecting it and no later than your first contact with them. Your first email should therefore be able to answer the question “how did you get my address?” in a sentence or two, with a link to more detail.

European Union: GDPR plus national ePrivacy rules

The EU picture is a combination of two layers. The GDPR governs the processing of personal data, and the ePrivacy Directive, as implemented in each member state, governs electronic marketing. The two interact, and the rules differ across countries.

Under the GDPR, legitimate interests under Article 6(1)(f) is commonly used as the lawful basis for B2B prospecting. Like the UK, it requires a documented assessment and a real consideration of the recipient’s expectations. You also have to honor objections to direct marketing, which means your opt-out needs to be honored every time, not only when it is convenient.

The ePrivacy Directive is where the country differences appear. It requires prior consent for unsolicited electronic marketing to natural persons, with narrow exceptions such as existing customers. It leaves the protection of legal persons, meaning companies, to each member state, and the states have made different choices. That is the reason a message that is routine in one country can require explicit consent in the next.

As a rough picture, Germany treats unsolicited marketing email as needing consent even to business addresses, because courts have applied unfair competition law strictly. France has historically allowed B2B prospecting when the message relates to the recipient’s professional role and offers a clear way to object. Many other states sit somewhere between. If you prospect across the EU, check the rule for each country you send into, rather than assuming one answer covers the bloc.

Canada and elsewhere: stricter regimes to know about

Canada’s Anti-Spam Legislation (CASL) is among the strictest in the developed world. It requires express or implied consent for commercial electronic messages, and its business-to-business exceptions are narrow. The most useful one is the conspicuous publication exception, which can apply when a recipient has published a business address without a statement against unsolicited messages, and when the message is relevant to their business role. Outside those narrow paths, consent is the default, and the penalties for organizations are large.

Australia’s Spam Act 2003 also works on a consent model, with express or inferred consent and a required, functional unsubscribe in every message. Other regimes vary, and the point is the same as in the EU: the country of the recipient governs, and you need to know what that country’s rule is before you send.

Documenting your position

Compliance is partly about what you do and partly about what you can show. If a regulator, a recipient or a customer’s procurement team asks how you justified a campaign, you want a short, honest document that answers the question. Keep three things on file.

A legitimate interests assessment. For EU and UK prospecting, write down the purpose of the outreach, why it is necessary, how you balanced it against the recipient’s interests, and what safeguards you put in place. A page is usually enough. The safeguards are the part people skip, and they matter most: a clear opt-out, honest identification, data minimization, and a stated source for each contact.

A source record for each list. For every list or batch, record where the contacts came from, when they were collected, and what the collection method was. A list bought from a vendor without that record is hard to defend, because you cannot explain how the data was gathered. Your legal basis doesn’t transfer with a purchase, and the origin of the data is part of the basis.

A suppression list. Every opt-out, every complaint and every request to delete must go into one list that every sequence checks before sending. Teams that keep suppression per campaign routinely email people who unsubscribed from a different campaign a month earlier. That is the most common and most embarrassing compliance failure in cold email, and it is entirely avoidable.

Mistakes that are not technicalities

Some of the most common compliance failures are not subtle. They happen because a team treated outreach as a volume exercise rather than a series of decisions about people.

Sending from a personal mailbox to hide a campaign is one. A message from a rep’s personal address, sent in bulk, looks deceptive and usually breaks the identification rules in every jurisdiction that has them. Subject lines that imply a prior conversation, such as a “Re:” on a first email, are another. Under CAN-SPAM a subject line must not mislead the reader about the content, and a fake reply prefix is a clear example. Personalization that goes beyond what the reader would expect is a third. Pulling a person’s family details or personal social posts into a cold email may be defensible in some circumstances, but it fails the expectation test that legitimate interests depends on, and it reads as intrusive, which is a reputation risk as well as a legal one.

The fix in each case comes down to one question. Would a reasonable person in this recipient’s position expect to receive this message, from this sender, containing this information? If the honest answer is no, change the message or drop the contact. Keep the personal data you use to what the message actually needs, and nothing more.

What to do on Monday

The practical checklist is shorter than the law, and it covers most of the risk.

1. Segment your list by recipient type, separating corporate mailboxes, role addresses, and named individuals or sole traders. Treat individuals in the UK and EU with the strictest rules until you have checked them.
2. Map each segment to a country and note the rule that applies. Keep the note next to the list, not in someone’s head.
3. Write the assessment for any EU or UK segment that relies on legitimate interests, and keep the source record for every batch.
4. Build one suppression list that every sequence checks before every send, and make honoring an opt-out a same-day action.
5. Put identification and a working opt-out in every message, including a physical postal address where required, and test the unsubscribe link yourself.
6. Review the setup with counsel before you scale into a new country or a new kind of list.

None of this makes cold email riskier than it has to be. It makes the risk visible, and it turns each decision into something you can explain. The senders who get into trouble are rarely the ones who thought carefully about the rules and made a judgment call. They are the ones who never asked the three questions at the start.

OutboundLeadPro is built around the operational side of this: a suppression step that runs before each send, an unsubscribe in every message, and DNS auto-fix so that the authentication underneath is correct. It doesn’t decide your lawful basis for you, and nothing should. Your team still owns the list, the source and the reasoning. If you want the sending side handled consistently, you can look at how the platform runs sequences, or start from the main page at OutboundLeadPro. For the list-building side of this, the guide to building a clean, targeted lead list covers where good sources come from, and the inbox placement guide covers what happens when a compliant campaign still lands in spam.

Keep reading

Playbook

Cold Email A/B Testing: Why Most Tests Prove Nothing

Cold email A/B testing is often too small to mean anything. Here is the sample-size math at real reply rates, and how to read the results.

Daniel Khoury September 19, 20263 min read

Playbook

How to avoid spam folder placement: 12 causes and fixes

Want to avoid spam folder placement? These 12 causes, from authentication to list quality to complaints, each come with a concrete fix you can check.

Daniel Khoury September 24, 20263 min read

Playbook

How to build a lead list that stays clean after the first send

Build a lead list around a real ICP, with stage gates that reject bad rows before they cause bounces and complaints. Includes a worked example.

Daniel Khoury October 7, 20263 min read

Explainer

SPF, DKIM and DMARC explained for cold email

The three email authentication records decide whether you reach the inbox — and most cold outreach fails because one is missing or wrong. Here's each one in plain English.

The OutboundLeadPro Team October 11, 20262 min read