Is cold email legal? GDPR, CAN-SPAM, CASL and PECR in plain English

It depends on where the recipient is. US CAN-SPAM lets you send B2B cold email without prior consent if you follow its rules, including opt out within 10 business days. The UK exempts emails to company addresses from PECR consent, but UK GDPR can still apply. Canada's CASL needs consent, express or implied. This is not legal advice.

This post is a plain English map of four regimes for someone sending B2B cold email. We read the regulators' own pages on 19 October 2026 and quote them where the wording matters. Laws change, and your facts matter: where you are, where the recipient is, who the recipient is and how you got the address. Speak to a lawyer in the countries you target before you run a campaign. Nothing here is legal advice.

How do the four regimes compare?

The rest of this post explains each column. Where the regulator's page we read did not state a point, we say so rather than fill it in.

What does CAN-SPAM require in the US?

The FTC's compliance guide lists eight requirements for commercial email:

1. Do not use false or misleading header information.
2. Do not use deceptive subject lines.
3. Identify the message as an ad.
4. Tell recipients where you are located.
5. Tell recipients how to opt out of future marketing email from you.
6. Remember that subscribers and members can opt out too.
7. Honor opt out requests promptly.
8. Monitor what others are doing on your behalf.

The guide says the law makes no exception for business to business email. It describes an opt out model: you do not need prior consent to send, but you must stop when asked. The opt out mechanism must work for at least 30 days after you send, and you must honor a request within 10 business days. The FTC states that each separate email in violation is subject to penalties of up to $53,088.

Item 8 matters if an agency or a tool sends for you. You remain responsible.

What does GDPR mean for B2B cold email in the EU?

GDPR is about personal data, not about email as such. A work address that names a person, such as a first name and a surname at a company domain, is personal data. Using it for outreach is processing, and you need a lawful basis. For cold B2B outreach, companies commonly rely on legitimate interests. Article 6(1)(f) allows processing "necessary for the purposes of the legitimate interests pursued by the controller or by a third party", except where those interests are overridden by the interests or fundamental rights and freedoms of the data subject.

That is a balancing test, not a free pass. The ICO's B2B guidance, written for the UK but built on the same text, says you must identify the interest, show the processing is necessary and balance it against the individual's rights.

Two more points matter in practice.

• The right to object. Article 21 says the data subject has the right to object "at any time" to processing for direct marketing, and that after an objection the personal data "shall no longer be processed for such purposes". Treat an objection like an unsubscribe and apply it everywhere.
• National ePrivacy laws. Email marketing rules in each EU country sit in national laws that implement the ePrivacy Directive, and they differ. Some countries require consent for marketing email even in B2B settings. We did not read each country's law for this post, so ask a local lawyer before you send into a country you have not checked.

Penalties are set in Article 83. The text allows fines of up to EUR 20,000,000, or in the case of an undertaking up to 4% of total worldwide annual turnover (the higher figure applies), for breaches of basic processing principles, consent and lawfulness rules and data subject rights. Up to EUR 10,000,000 or 2% applies to other listed obligations. These are ceilings, not typical fines.

What does the UK require?

The UK splits email marketing between PECR (which covers the sending) and UK GDPR (which covers the personal data).

The ICO's PECR guidance says individuals need to have specifically consented to marketing email, with a narrow soft opt in for your own past customers. It says "You can email or text any corporate body", such as companies, LLPs and government bodies. Even so, you must not conceal your identity and you must provide a valid address for opt outs. The ICO recommends a do not email list for businesses that object.

The ICO's B2B guidance adds two cautions. First, sole traders and some partnerships are individual subscribers, treated like individuals with greater protection. Second, a work address that identifies a person still falls under UK GDPR "even if they are acting in their business capacity". There, the right to object to direct marketing is absolute, and the ICO says there are no grounds to refuse. The page also notes that this guidance is under review because of the Data (Use and Access) Act, so check it for updates. The ICO pages we read did not state the maximum PECR penalty, so we do not give one.

What does Canada require?

Canada is the strictest of the four on consent. The Government of Canada's page on getting consent explains two kinds.

• Express consent means someone has agreed, verbally or in writing, to receive a commercial electronic message from you.
• Implied consent applies only in certain circumstances, such as an existing business relationship, and is generally time limited.

For business contacts, the page sets two conditions for relying on a conspicuously published address: it was not accompanied by a statement that the person does not want unsolicited commercial messages, and your message is relevant to the person's business, role, functions or duties. Every unsubscribe request must be actioned within 10 business days or less, at no cost to the recipient.

Penalties are in section 20 of the Act. Section 20(4) sets the maximum penalty for a violation at $1,000,000 for an individual and $10,000,000 for any other person.

What does this mean in practice?

A short working checklist for B2B cold email across these regions. It is a starting point for the conversation with your lawyer.

• [ ] You know the country of each recipient, and your list is split by country.
• [ ] In Canada, you can show express consent or a valid implied consent reason for each contact.
• [ ] In the EU and UK, you have written down your lawful basis and your balancing test.
• [ ] Every message identifies you and carries a way to opt out.
• [ ] Opt outs are honored well inside 10 business days, across all channels and campaigns.
• [ ] Your physical address is in the email where the US rules apply.
• [ ] Subject lines and headers are accurate.
• [ ] You keep a suppression list and screen new lists against it.
• [ ] Anyone sending on your behalf follows the same rules.

What does Sellinger enforce, and what is left to you?

The outreach rules page lists what the product does. In short:

• When a contact replies with a clear opt out, the contact goes on the team's suppression list, the agent stops and the lead is closed out. An unclear phrase never writes the permanent record; the agent stops and a person decides.
• Before every send on email, LinkedIn and WhatsApp, the platform checks the suppression list and refuses the send when the contact is on it or when the check cannot be completed.
• Cold email can carry an unsubscribe line and the standard one click headers. It is a per mailbox setting, off by default.
• An erasure function takes an email address, phone number or LinkedIn address, anonymizes the matching leads in the workspace and adds the identifiers to the suppression list.
• Daily limits per account and quiet hours apply.

The product does not check whether your campaign is lawful. You are responsible for who you contact and why, for any consent the law requires, and for honoring opt outs you receive outside Sellinger. Those duties are set out in the Terms of Service and the DPA covers how Sellinger handles personal data on your behalf.

For how the mailbox providers treat the same questions, read what Google and Yahoo require. For whether the channel works at all, read does cold email still work. And again: this is a plain English summary of public regulator pages, not legal advice.