Is cold email legal? B2B cold email laws (CAN-SPAM, GDPR, CASL, PECR) in plain English

B2B cold email is legal in the US, UK, Canada, Australia and much of the EU, but the rules differ a lot. The US (CAN-SPAM) lets you email first and requires a working opt-out. Canada (CASL) and Australia (the Spam Act) require consent, but allow it to be implied when a business has published its work address and your message is relevant to their role. The UK (PECR) lets you email companies without consent but not sole traders. In the EU, GDPR allows B2B outreach on legitimate interests, but each country's own rules decide whether you need consent first.

This is a plain-English summary for people sending B2B cold email to local businesses. It isn't legal advice. Laws change, they apply differently to your facts, and penalties are serious. Read the regulator's guidance linked below and talk to a lawyer before a large campaign in a new country.

Cold email laws by country: the short version#

The details for each are below.

What does CAN-SPAM require for B2B cold email?#

CAN-SPAM doesn't require consent, but it applies to B2B email in full. The FTC is explicit: "The law makes no exception for business-to-business email." Every commercial email must meet the FTC's requirements:

1. Don't use false or misleading header information. From, To, Reply-To and routing must identify you accurately.
2. Don't use deceptive subject lines. No fake "Re:" or "Your invoice."
3. Identify the message as an ad where it is one.
4. Tell recipients where you're located: a valid physical postal address, which can be a street address, a registered P.O. box, or a registered private mailbox.
5. Tell recipients how to opt out, clearly and conspicuously.
6. Remember that subscribers and members can opt out too.
7. Honor opt-outs promptly: within 10 business days. The opt-out must keep working for at least 30 days after you send, you can't charge a fee, and you can't ask for more than an email address and opt-out preferences.
8. Monitor what others do on your behalf. Hiring an agency or a sending tool doesn't move the responsibility. The FTC says both the company whose product is promoted and the company that sends the message may be held legally responsible.

How much is the CAN-SPAM penalty per email?#

The FTC states that each separate email in violation is subject to penalties of up to $53,088. That's the inflation-adjusted figure that took effect on January 17, 2025. There's no 2026 increase: the Office of Management and Budget cancelled the 2026 civil penalty inflation adjustment (memorandum M-26-11, April 17, 2026) because the October 2025 inflation data wasn't produced during the government shutdown, so agencies are keeping their 2025 amounts.

Per email means a 1,000-email campaign that breaks the rules is, in theory, 1,000 violations. In practice, the FTC focuses on serious and deceptive senders, but the exposure is real.

Is B2B cold email legal under GDPR?#

GDPR can allow B2B cold email, but GDPR isn't the only EU rule that applies. Two layers matter:

Layer 1: GDPR (data protection). A business email with a person's name in it, such as jane.martin@firm.fr, is personal data. GDPR Recital 47 says processing for direct marketing "may be regarded as carried out for a legitimate interest," so you can rely on Article 6(1)(f) if you:

• Do and record a balancing test: your interest in reaching the business against the person's rights and expectations. Relevance to their job helps; volume and intrusiveness hurt.
• Tell them where you got their data. Article 14 requires this when you didn't collect the data from the person, at the latest when you first contact them.
• Stop immediately when they object. Article 21 gives an absolute right to object to direct marketing. No balancing, no argument.
• Keep the data minimal and accurate, and don't keep it forever.

Layer 2: national electronic marketing rules. The ePrivacy Directive left the rules for emails to businesses (legal persons) largely to each member state, so they vary:

• Germany: the Unfair Competition Act (UWG §7) treats advertising by email without the recipient's prior express consent as an unreasonable nuisance, and doesn't carve out business recipients. Assume you need consent.
• France: the CNIL says B2B prospecting by email can be based on legitimate interest without prior consent when the message relates to the recipient's profession, they're told where their data came from, and they can easily object.

Other countries fall between these. Check the country's regulator before you send.

Penalties. Under GDPR Article 83(5), the maximum fine for breaching the basic principles or data subject rights is €20 million or 4% of worldwide annual turnover, whichever is higher. National ePrivacy penalties vary by country.

Is cold emailing illegal in the UK? The PECR rules for B2B#

In the UK, PECR's email marketing consent rule doesn't apply to corporate subscribers: limited companies, LLPs, Scottish partnerships and government bodies. You can email them without prior consent, but you must not hide your identity and you must give a valid address for opt-outs.

Sole traders and some partnerships are treated as individuals. You need their consent, or the "soft opt-in" (they bought something similar from you and didn't opt out). For local business outreach this matters a lot, because many plumbers, cleaners and salons in the UK are sole traders. The ICO warns you can't tell a sole trader from a company by the email address, and says to treat unclear cases as individuals.

UK GDPR still applies whenever you hold a named person's data, even at a company. Legitimate interests, telling people where you got their data, and honoring objections all apply as in the EU.

Penalties. The Data (Use and Access) Act 2025 raised the maximum PECR fine from £500,000 to £17.5 million or 4% of worldwide turnover, in line with UK GDPR. The ICO confirmed that power was in force as part of the Act's commencement in February 2026.

Is cold email legal in Canada? The CASL rules#

CASL is an opt-in law: you need consent before sending a commercial electronic message. For B2B, the useful route is implied consent by conspicuous publication. Under section 10(9)(b), consent is implied when:

1. the person has conspicuously published their email address, or caused it to be published (for example on their own business website);
2. the publication doesn't say they don't want unsolicited commercial messages; and
3. your message is relevant to their business, role or duties.

The CRTC stresses this is a higher bar than an address simply being findable online, that it's judged case by case, and that you carry the burden of proving consent. Keep a record of where and when each address was published.

Every message must also identify you, give contact details, and include an unsubscribe mechanism that's valid for at least 60 days. Unsubscribes must be honored without delay and no later than 10 business days.

Penalties. The CRTC says the maximum administrative monetary penalty per violation is C$1 million for an individual and C$10 million for a business.

Is cold email legal in Australia? The Spam Act rules#

The Spam Act 2003 requires consent, express or inferred, for commercial electronic messages, including to businesses. Consent can't be inferred just because an address is published. The exception is conspicuous publication: where a work address is conspicuously published, your message relates to the person's work, and the publication doesn't say they don't want commercial messages.

Every message must identify the sender accurately and include a functional unsubscribe. The ACMA says unsubscribes must be actioned within 5 working days, cost nothing, and keep working for at least 30 days after the message is sent.

Penalties. Court penalties are set in penalty units and rise for repeat offenders. Enforcement is real: in 2024 the ACMA announced that Commonwealth Bank paid A$7.5 million for spam breaches, including marketing emails with no way to unsubscribe.

What should every B2B cold email include?#

If you follow the strictest common version of each rule, one template works in most places:

• Your real name, your company's name, and an accurate From and Reply-To.
• An honest subject line.
• A valid physical postal address.
• A clear opt-out ("Reply 'no' and I won't email again" or a link) that works for at least 60 days.
• A line saying where you found their address ("I found your email on smithplumbing.com").
• A message that's about their business and role.
• Opt-outs honored within 2 days, which meets every legal deadline above and matches what Yahoo and Google ask of bulk senders.

And outside the message:

• One suppression list across every campaign and client, checked before every send.
• A record of where each address came from and when.
• Country-specific handling: no unconsented emails to Germany, no sole traders in the UK without consent.

What about where the list came from?#

Email laws govern the message. Separate rules govern the data you used to build the list. Business facts like a company's name, phone and address are generally public business information, but a named person's email is personal data under GDPR, UK GDPR and similar laws, wherever you found it.

The source's own terms matter too. Google's Maps terms prohibit mass downloading or creating bulk feeds of Maps content, and list business listings databases, mailing lists and telemarketing lists among the datasets you may not create or augment with Google Maps for use in a service similar to it. Contract terms are a different question from privacy law, and how they apply depends on what you do. We cover this honestly in is scraping Google Maps legal. If your business depends on it, get legal advice.

A practical decision rule#

Before a campaign, answer five questions per country:

1. Who is the recipient? A company, or a sole trader or person?
2. Do I need consent? US: no. UK companies: no. Canada and Australia: yes, possibly implied by publication. Germany: yes. Elsewhere in the EU: check.
3. Is the message relevant to their role? If not, implied consent and legitimate interest both get weak.
4. Can I prove where the address came from? Keep the source page and date.
5. Does my email carry identity, address and opt-out, and will I honor opt-outs within 2 days?

If any answer is unclear, leave that country out of the campaign until it isn't. The cold-email checklist for agencies covers the setup side, and what's a good cold email bounce rate covers deliverability. For agencies running campaigns for clients, our agencies page explains how shared suppression works across a team.

FAQ#

Is cold email legal in the US?#

Yes, B2B cold email is generally legal in the US if it follows CAN-SPAM. The law doesn't require consent, but every commercial email needs honest headers and subject lines, a valid physical postal address, a clear way to opt out, and opt-outs honored within 10 business days. The FTC lists penalties of up to $53,088 per violating email.

Is B2B cold email legal under GDPR?#

It can be. GDPR allows processing personal data for direct marketing on the basis of legitimate interests if you do a balancing test, tell people where you got their data, and stop immediately when they object. But each EU country also has its own electronic marketing rules, and some, such as Germany, require prior consent even for emails to businesses.

Can I cold email businesses in the UK?#

Under PECR, you can email corporate subscribers (limited companies, LLPs, public bodies) without prior consent, as long as you identify yourself and give a valid opt-out address. Sole traders and some partnerships count as individuals and need consent. UK GDPR still applies to any named person's data.

Is cold email legal in Canada?#

CASL requires consent before most commercial emails. Consent can be implied when a person has conspicuously published their business email address without saying they don't want unsolicited messages, and your message is relevant to their role. You must identify yourself and honor unsubscribes within 10 business days.

Is cold email legal in Australia?#

The Spam Act 2003 requires consent, which can be express or inferred. Consent can be inferred from a conspicuously published work address only if your message relates to the recipient's role and they haven't said they don't want commercial messages. Every message must identify the sender and include an unsubscribe that takes effect within 5 business days.

Does CAN-SPAM apply to B2B emails?#

Yes. The FTC states that the law makes no exception for business-to-business email. A commercial email to a business address must meet the same requirements as one sent to a consumer.

Sources#

1. Federal Trade Commission, CAN-SPAM Act: A Compliance Guide for Business.
2. Federal Register, FTC: Adjustments to Civil Penalty Amounts (January 17, 2025: $53,088 under 15 U.S.C. 45(m)(1)(A)).
3. Federal Register, Department of Justice notice on OMB memorandum M-26-11 (cancellation of the 2026 penalty inflation adjustment).
4. GDPR Recital 47, Article 6, Article 14, Article 21 and Article 83.
5. Germany, Gesetz gegen den unlauteren Wettbewerb (UWG) §7.
6. CNIL, La prospection commerciale par courrier électronique.
7. ICO, Business-to-business marketing.
8. ICO, Statement on the commencement of the Data (Use and Access) Act (February 2026).
9. Justice Laws Website, Canada's Anti-Spam Legislation, sections 10 and 11.
10. CRTC, Frequently Asked Questions about CASL and Guidance on implied consent.
11. Federal Register of Legislation, Spam Act 2003.
12. ACMA, Email and SMS unsubscribe rules fact sheet and Commonwealth Bank pays $7.5m for more spam breaches.
13. Yahoo, Sender best practices and Google, Email sender guidelines FAQ (unsubscribes within 2 days / 48 hours).
14. Google, Google Maps End User Additional Terms of Service (last modified January 27, 2026).