Guide
Cold outreach law matrix: B2B email rules by country, with sources
Rules for B2B cold email differ sharply by country: the US lets you send without prior consent if you follow its rules, the UK exempts company addresses from the PECR consent rule, France allows B2B prospecting that relates to the person's job with a right to object, while Germany and Spain require prior consent. Each row below links the statute or regulator page we read on 25 October 2026. This is not legal advice.
Published by Sellinger AI. Numbers and settings checked on 25 October 2026 against the fact register. Report an error.
- jurisdictions with a source we could read and check
- 8
- how fast the FTC says you must honour an opt out under CAN-SPAM
- 10 business days
- maximum penalty per violating email under CAN-SPAM, per the FTC guide
- $53,088
B2B cold email by jurisdiction
| Jurisdiction | Cold email to a business contact | Opt out and objection | Source | Last verified |
|---|---|---|---|---|
| European Union (GDPR) | A named work address is personal data, so you need a lawful basis. Legitimate interests is one basis, unless the person's rights and interests override it. National ePrivacy laws can add their own rules, so check each country. | A person can object to direct marketing at any time, and then the data may no longer be used for it (Article 21). | GDPR Article 6 | 25 October 2026 |
| United Kingdom (PECR and UK GDPR) | The PECR email consent rule does not apply to corporate subscribers such as companies. Sole traders and some partnerships count as individuals and need consent or the soft opt in. UK GDPR can still apply to a named work address. | Do not hide your identity and give a valid address for opt out. | ICO, business to business marketing | 25 October 2026 |
| United States (CAN-SPAM) | No exception for business to business email. The FTC guide does not require prior consent for commercial email in general. | Honour an opt out within 10 business days. Penalties up to $53,088 per violating email. | FTC CAN-SPAM guide | 25 October 2026 |
| Canada (CASL) | Consent is needed: express, or implied in limited cases. A conspicuously published business address can give implied consent if it carries no notice against unsolicited messages and your message is relevant to the person's business, role, functions or duties. | See the Government of Canada page for the unsubscribe rules. | Government of Canada, getting consent | 25 October 2026 |
| Germany (UWG) | Section 7(2) no. 2 treats email advertising without the recipient's prior express consent as an unreasonable nuisance. Section 7(3) lifts this for existing customers only when four conditions are all met. | The customer must be told clearly, when the address is collected and with every use, that they can object at any time. | UWG section 7 | 25 October 2026 |
| France (CNIL) | For professionals prior consent is not required, but the message must relate to the person's profession. The CNIL gives the example of presenting software to an IT director. Generic company addresses such as info@ are outside these principles. | Opposition must be simple and free, and each message must say who sends it and let the person refuse more. | CNIL, prospection par courrier electronique | 25 October 2026 |
| Spain (LSSI article 21) | Promotional email is prohibited unless the recipient requested or expressly authorised it. The exception is an existing contractual relationship, for similar products or services of your own. | A simple, free way to object must be offered at collection and in every message, with a valid address. | LSSI, BOE consolidated text | 25 October 2026 |
| Australia (Spam Act 2003) | Section 16 provides that unsolicited commercial electronic messages must not be sent. Consent is dealt with in Schedule 2. We could read only the section headings, so read the Act for the detail. | Section 18 requires a functional unsubscribe facility in commercial electronic messages. | Spam Act 2003, Federal Register of Legislation | 25 October 2026 |
Consent models differ: the US and UK treat B2B email as opt out, Canada, Germany and Spain lean on consent, and France sits between with a relevance test. Read the cell, then the source.
Jurisdictions we could not verify
We tried to add Ireland, Italy, the Netherlands, Switzerland and Bulgaria. The primary pages either did not load for us (access refused, a timeout, a page that only runs scripts) or we could not reach the article text, so we left those rows out instead of relying on secondary summaries. The EU ePrivacy Directive text on EUR-Lex also did not load, so the EU row cites the GDPR only and tells you to check national ePrivacy laws. We will add rows when we can read the source.
LinkedIn, WhatsApp and Instagram messages
| Channel | What the sources we read say | Source | Last verified |
|---|---|---|---|
| LinkedIn does not permit browser extensions or bots that automate activity on its site and says accounts using them risk restriction or shutdown. Separately, using a person's data to contact them is processing of personal data, so the GDPR rows above apply in the EU. | LinkedIn Help, prohibited software | 25 October 2026 | |
| The WhatsApp Business Messaging Policy says you may contact someone only if you have opt in permission from the recipient confirming they want to receive subsequent messages. WhatsApp itself limits outbound messaging. | WhatsApp Business Messaging Policy | 25 October 2026 | |
| We did not verify an Instagram source for this matrix, so we make no claim. Check Meta's current terms and the privacy law of the recipient's country. | Not verified | 25 October 2026 |
We found no statute source for LinkedIn or WhatsApp messages in each country, so those rows describe platform rules and the GDPR only. Do not read them as a country by country answer.
What Sellinger enforces
- Before every send on email, LinkedIn and WhatsApp, the platform checks the team's suppression list and refuses the send when the contact is on it or when the check cannot be completed.
- A reply such as STOP or unsubscribe puts the contact on the suppression list and stops the agent.
- Daily limits per account cannot be exceeded by the agent.
- None of this decides whether a campaign is lawful. See the outreach rules.
Read more
For the plain English comparison of four regimes, read is cold email legal. Definitions: CAN-SPAM Act, PECR, CASL and GDPR legitimate interest.
Common questions
Is B2B cold email legal everywhere?
Does the UK need consent to email a company?
How fast must I honour an unsubscribe in the US?
Why are some countries missing?
Is this legal advice?
Sources and method
FTC CAN-SPAM guide, ICO business to business marketing, Government of Canada CASL consent page, UWG section 7, CNIL, BOE LSSI, GDPR Articles 6 and 21, Spam Act 2003, LinkedIn Help and WhatsApp Business Messaging Policy, all read on 25 October 2026. Suppression behaviour from the fact register.
Related: Is cold email legal?, CAN-SPAM Act, PECR, CASL, GDPR legitimate interest, Sellinger outreach rules.
