Compliance
Is Cold Email Legal? GDPR, CAN-SPAM, CASL and UK PECR Explained for 2026
By Kaysid Team · · 5 min read
Yes, B2B cold email is legal in many countries, but the rules differ a lot depending on where your recipients are. In the US it's allowed as long as you follow CAN-SPAM. In the EU and UK it's possible under specific conditions. In Canada and some European countries it's much more restricted.
This guide explains the main laws in plain English and ends with a practical checklist. It's general information, not legal advice. If your business depends on outreach to a particular country, it's worth a conversation with a lawyer who knows that market.
The quick answer by region
| Region | Main law(s) | B2B cold email | Key conditions |
|---|---|---|---|
| United States | CAN-SPAM Act | Allowed (opt-out model) | Honest headers and subject, postal address, working opt-out honored within 10 business days |
| European Union | GDPR + national ePrivacy laws | Often possible, varies by country | A lawful basis (usually legitimate interest), relevance, transparency, easy opt-out |
| United Kingdom | UK GDPR + PECR | Allowed to corporate addresses | Identify yourself, opt-out in every email; sole traders and partnerships treated like individuals |
| Canada | CASL | Restricted (consent model) | Express or implied consent, e.g. a published business address relevant to the role |
| Australia | Spam Act 2003 | Restricted (consent model) | Consent, which can be inferred in limited cases; identify sender; unsubscribe |
United States: CAN-SPAM
The US takes an opt-out approach: you may email businesses without prior consent, as long as you follow the CAN-SPAM Act's rules for commercial email:
- No false or misleading header information. The From name and address must identify you.
- No deceptive subject lines. The subject must reflect the content. A fake "Re:" on a first email is deceptive.
- Identify the message as an advertisement where it's commercial (this can be done plainly).
- Include a valid physical postal address (a street address, PO box or registered private mailbox).
- Tell recipients how to opt out, and honor opt-outs within 10 business days. Don't charge for it or ask for more than an email address.
- You're responsible even if someone else sends on your behalf.
Penalties can reach tens of thousands of dollars per email, so the basics matter.
European Union: GDPR and ePrivacy
In the EU, two layers of law apply. GDPR governs processing personal data, and a work email like anna.schmidt@company.de is personal data. The ePrivacy Directive, implemented differently in each country, governs electronic marketing.
Lawful basis: legitimate interest
Most B2B cold email relies on legitimate interest (GDPR Article 6(1)(f)). To use it you should be able to show that:
- You have a genuine business interest in contacting the person.
- The email is relevant to their professional role (selling HR software to the Head of HR, not to the CFO's personal assistant).
- Your interest isn't overridden by their rights, which is why you keep it targeted, proportionate and easy to refuse.
- You've recorded this reasoning (a short legitimate interest assessment).
Transparency and rights
- Say who you are and, on request, where you got their data (GDPR Article 14).
- Offer an easy opt-out in every email and honor it everywhere.
- Delete or stop using data on request, and don't keep lists forever.
- Only collect what you need: name, role, company and work email.
United Kingdom: UK GDPR and PECR
The UK's PECR rules distinguish between corporate subscribers (limited companies, LLPs, public bodies) and individual subscribers (individuals, sole traders and some partnerships). You can send B2B marketing email to corporate addresses without prior consent, as long as you identify yourself and include an opt-out. For sole traders and partnerships, the stricter rules for individuals apply. UK GDPR still applies to the personal data itself, so legitimate interest, relevance and transparency matter too.
Canada: CASL
Canada's Anti-Spam Legislation is a consent law: you need express or implied consent before sending a commercial email. One important form of implied consent for B2B is the conspicuous publication exception: if a person's business email is published (for example on their company website), without a statement saying they don't want unsolicited messages, and your message is relevant to their role, consent can be implied. Every message must identify you, include contact information and a working unsubscribe mechanism.
A cold email compliance checklist
| Do this | Why |
|---|---|
| Email work addresses, about the person's job | Relevance is central to legitimate interest and CASL's publication exception |
| Use a real name, real company and real From address | CAN-SPAM, GDPR transparency |
| Write honest subject lines (no fake "Re:") | CAN-SPAM, trust |
| Include your company's postal address | CAN-SPAM, CASL |
| Include an easy opt-out in every email | Every law above, and fewer spam reports |
| Honor opt-outs everywhere, quickly | CAN-SPAM 10 days; GDPR right to object |
| Keep a do-not-email list across all campaigns | So opt-outs stick |
| Record where each lead came from | GDPR Article 14 requests |
| Write a short legitimate interest assessment | GDPR accountability |
| Delete stale data | GDPR storage limitation |
| Check country-specific rules (e.g. Germany, Canada) | Some require consent |
How Kaysid helps you stay compliant
- One-click unsubscribe headers on every campaign email (Gmail and other apps show an Unsubscribe button), plus an unsubscribe link you can add to your text.
- A workspace-wide do-not-email list: unsubscribes, bounces and people you mark "not interested" are never emailed again by any campaign, and are skipped on future imports.
- Replies stop the sequence automatically in every campaign.
- The pre-launch review flags shared inboxes like info@ and sales@, which tend to be less relevant and more complaint-prone.
- You can delete leads and export your suppression list at any time.
Frequently asked questions
Is cold email legal in the US?
Yes. B2B cold email is legal under CAN-SPAM if you use honest headers and subject lines, include a postal address, provide an opt-out and honor it within 10 business days.
Is cold email legal under GDPR?
B2B cold email can be lawful under GDPR using legitimate interest, if it's relevant to the person's role, transparent and easy to opt out of. National ePrivacy rules vary, and some countries such as Germany are stricter.
Can I cold email in the UK?
Yes, to corporate subscribers (limited companies, LLPs, public bodies) with clear identification and an opt-out. Sole traders and some partnerships are treated like individuals and need consent.
Is cold email legal in Canada?
CASL requires consent. For B2B, implied consent can apply when a business email is conspicuously published without a no-solicitation statement and your message is relevant to the person's role.
Do I need an unsubscribe link in cold emails?
Yes. Laws in the US, EU, UK and Canada all expect a working opt-out, and it reduces spam complaints, which protects your deliverability.
