Cold Email Laws 2026: CAN-SPAM, GDPR, CASL and More

Cold email laws decide whether your outbound program builds pipeline or builds legal risk. The rules depend mostly on where your recipients are, and they range from an opt-out model in the US to consent-first regimes in Canada and Germany.

This guide covers what each major law actually requires: CAN-SPAM, GDPR and national ePrivacy rules, UK PECR, Canada's CASL, and Australia's Spam Act. Every rule and penalty links to the regulator or the statute itself.

TL;DR

• US (CAN-SPAM): no prior consent needed, and B2B email is not exempt. You need honest headers and subject lines, an ad disclosure, a physical postal address, and opt-outs honored within 10 business days.
• EU (GDPR + ePrivacy): a named work email is personal data. Most B2B senders rely on legitimate interest, but national law decides whether B2B email needs consent, from an easy opt-out in France to prior express consent in Germany.
• UK (PECR + UK GDPR): you can email corporate subscribers without consent if you identify yourself and offer an opt-out. Sole traders and some partnerships need consent, and PECR fines now reach £17.5 million or 4% of global turnover.
• Canada (CASL): consent first. Implied consent can cover a conspicuously published business address when the message fits the person's role, and the person claiming consent must prove it.
• Australia (Spam Act 2003): consent, identify, unsubscribe. Inferred consent can come from a conspicuously published work address, and unsubscribes must be honored within 5 working days.
• Everywhere: record where each contact came from, your basis for emailing them, and every opt-out.

Overview: Is Cold Email Legal?

Cold email is legal in the US, UK, EU, Canada and Australia, but none of them treat it the same way. What changes is whether you need consent first, what every message must contain, and how fast you must act on an opt-out.

This guide is for founders, SDR leaders, RevOps teams and agencies who run B2B cold emailing across more than one country. It covers the five regimes most outbound teams hit, then the parts most guides skip: record keeping, compliant data sourcing, and a checklist you can run before each campaign.

We used primary sources only: the FTC, the ICO, EUR-Lex, Canada's Justice Laws website, ACMA, the CNIL and the German statute text. Where a figure changes over time, we give it with its source and date.

Cold Email Laws at a Glance

The table below summarizes cold email laws in the five regions B2B teams email most. The prior consent column covers the email-marketing rule only, and data protection law can still apply on top.

United States: CAN-SPAM Act

Cold email is legal in the US without prior consent, as long as each commercial email follows the CAN-SPAM Act's content and opt-out rules. The FTC's compliance guideis direct about B2B: "The law makes no exception for business-to-business email."

CAN-SPAM covers commercial messages, meaning email whose primary purpose is to advertise or promote a product or service. A sales email is commercial; transactional or relationship content, like an order confirmation, is treated differently.

What CAN-SPAM Requires

The FTC lists these requirements for every commercial email, including one-to-one cold outreach:

1. No false or misleading header information. Your From, To, Reply-To and routing details must accurately identify who is sending.
2. No deceptive subject lines. The subject must reflect what is in the message.
3. Identify the message as an ad. The FTC says the law gives "a lot of leeway in how to do this," but the disclosure must be clear and conspicuous.
4. Tell recipients where you are located. Include a valid physical postal address: a street address, a USPS-registered PO box, or a private mailbox registered with a commercial mail receiving agency.
5. Tell recipients how to opt out. The opt-out must be clear and easy to spot.
6. Honor opt-outs promptly. Process requests within 10 business days, and keep the mechanism working for at least 30 days after you send.
7. Monitor what others do on your behalf. Hiring an agency does not move the obligation off you.

You also cannot charge a fee for opting out or ask for personal information beyond an email address. Once someone opts out, you cannot sell or transfer their address, except to a company you hired to help you comply.

CAN-SPAM Penalties and Liability

Each separate email that violates the Act is subject to penalties of up to $53,088, according to the FTC. The amount is adjusted for inflation, so check the guide for the current figure before you quote it internally.

The FTC also says both the company whose product is promoted and the company that sends the message may be held legally responsible. That matters if a lead gen agency or contractor runs your sequences.

The guide adds that aggravated violations, such as address harvesting and dictionary attacks, can bring additional fines. Some practices, such as using false information to register multiple email accounts or domain names, carry criminal penalties that can include imprisonment.

European Union: GDPR and National ePrivacy Rules

B2B cold email can be lawful in the EU, but two layers of law apply. GDPR governs the personal data you hold and use, and each country's ePrivacy law governs the act of sending marketing email.

A named work address such as jane.doe@company.com is personal data, so GDPR applies even in pure B2B outreach. Under Article 3(2), it also generally applies to companies outside the EU that offer goods or services to people in the EU.

Our guide on how GDPR affects B2B sales covers CRM data and data subject rights in more depth.

Legitimate Interest and the Three-Part Test

Most B2B senders rely on legitimate interest under GDPR Article 6(1)(f). It covers processing "necessary for the purposes of the legitimate interests pursued by the controller," except where those interests are overridden by the person's rights and freedoms.

Recital 47 adds that processing personal data for direct marketing "may be regarded as carried out for a legitimate interest." The word "may" matters: legitimate interest is something you assess and document, not a default.

The ICO's legitimate interests guidance frames that assessment as a three-part test, recorded in a legitimate interests assessment (LIA):

• Purpose: is there a legitimate interest? Offering a product relevant to the recipient's job is the usual answer for B2B outreach.
• Necessity: is this processing necessary for it? Hold only what the outreach needs, such as name, role, company and work email.
• Balancing: do the person's interests override yours? Relevance to their role, how you obtained the data, and whether they would reasonably expect the email all feed into this.

Transparency, Objections and GDPR Fines

If you did not collect the data from the person directly, Article 14 requires you to give them privacy information, including the source of the data. When the data is used to contact them, Article 14(3)(b) sets the deadline "at the latest at the time of the first communication."

A common approach is a short line in the first email that says where you found their details, plus a link to your privacy notice. Check the exact wording with counsel, since Article 14 lists specific items the notice must cover.

Article 21(2) gives everyone the right to object to direct marketing "at any time." Under Article 21(3), once they object, "the personal data shall no longer be processed for such purposes," and there is no balancing test to argue.

Fines for breaching the core principles, the lawful basis rules, or data subject rights reach up to EUR 20 million or 4% of total worldwide annual turnover for the preceding financial year, whichever is higher (Article 83(5)).

Why EU Countries Differ: Germany vs France

The ePrivacy Directive (2002/58/EC)requires prior consent for email marketing, but Article 13(5) applies that rule to "subscribers who are natural persons." How subscribers that are legal persons, such as companies, are protected is left largely to each member state.

That is why the answer to "is B2B cold email legal?" changes at each border. Two examples show the range:

• France: the CNIL says B2B email prospecting does not need prior consent when the message relates to the recipient's professional role, the person is told how their data is used, and they can object simply.
• Germany: UWG section 7(2) no. 2 treats advertising by email without the addressee's prior express consent as an unreasonable nuisance, and the wording is not limited to consumers. Section 7(3) has a narrow existing-customer exception, so treat cold email into Germany as consent-first and get local advice.

Other member states sit somewhere along this range. Check the national rule for every country before you add it to a campaign, rather than assuming one EU standard.

United Kingdom: PECR and UK GDPR

In the UK, PECR governs marketing emails and UK GDPR governs the personal data inside them. For B2B, PECR is relatively permissive: the ICOsays "you can email or text any corporate body" without consent.

You still must not disguise or conceal your identity, and every message needs a valid contact address for opt-outs. The ICO also recommends keeping a "do not email or text" list of businesses that object.

Corporate Subscribers vs Sole Traders

The corporate subscriber rule does not cover every business. The ICO says "sole traders and some partnerships are treated as individuals," so you can only email them if they have specifically consented or the soft opt-in applies.

The soft opt-in only covers existing customers who bought, or negotiated to buy, a similar product or service from you. The ICO is explicit that it "does not apply to prospective customers or new contacts (eg from bought-in lists)."

UK GDPR also still applies when you email a named person at a company. The ICO notes you "may also need to consider data protection implications if you are emailing employees at a corporate body," so the legitimate interest, transparency and objection rules above apply too.

In practice, tag each UK contact by business type before you send. A limited company's staff fall under the corporate subscriber rule; a sole trader's address needs consent.

PECR Fines After the Data (Use and Access) Act

The Data (Use and Access) Act 2025 raised PECR fines to UK GDPR levels. In a 5 February 2026 statement, the ICO said it can now "issue fines of up to £17.5 million or 4% of global turnover" under PECR, up from the previous £500,000 cap.

The ICO's PECR email guidance notes that it is under review because of the Act. Recheck it before relying on any specific point.

Canada: CASL

Canada's Anti-Spam Legislation (CASL) is consent-first. Under section 6, a commercial electronic message needs the recipient's express or implied consent, sender identification, and an unsubscribe mechanism.

Section 12 applies the rule when a computer system located in Canada is used to send or access the message, so a US team emailing prospects in Toronto is covered. The government's CASL hub has guidance for businesses.

Implied Consent for B2B Outreach

Section 10(9) lists when consent is implied. Three routes matter for B2B teams:

• Existing business relationship: for example, a purchase from you within the past two years, or an inquiry or application within the past six months.
• Conspicuous publication: the person has conspicuously published the address, the publication does not say they do not want unsolicited commercial messages, and your message "is relevant to the person's business, role, functions or duties in a business or official capacity."
• Disclosure: the person gave you the address without saying they did not want such messages, and the message is relevant to their role.

An address derived from a naming pattern was never published by the person, so the conspicuous publication route is hard to rely on for it. Keep a dated record of where each published address appeared.

Section 13 puts the burden on you: a person who alleges they have consent "has the onus of proving it."

CASL Unsubscribe Rules and Penalties

The unsubscribe mechanism must be free to use and point to an email address or web page that stays valid for at least 60 days after sending. You must act on a request "without delay, and in any event no later than 10 business days."

Section 20(4) sets the maximum administrative monetary penalty at CAD 1,000,000 per violation for an individual and CAD 10,000,000 for any other person, including businesses.

Australia: Spam Act 2003

Australia's Spam Act 2003 rests on three rules that ACMA summarizes as consent, identify and unsubscribe. It applies to commercial electronic messages with an Australian link, including messages to people who access them in Australia, and it has no B2B exemption.

• Consent: express or inferred. Consent can be inferred from a conspicuously published work address when publication was not accompanied by a statement refusing commercial messages and your message relates to the person's work role.
• Identify: every message must clearly identify the sender and how to contact them.
• Unsubscribe: include a functional unsubscribe facility, honor requests within 5 working days, and keep it working for at least 30 days after sending.

ACMA expects you to be able to show how you got consent, so keep records. Inferred consent is narrower than many senders assume, so read ACMA's guidance before relying on it.

On penalties, ACMA said in October 2024 that the maximum court penalty for a company is $626,000 per day without a prior record and $3,130,000 per day with one. These amounts are tied to the Commonwealth penalty unit, which is indexed, and the same release covered a $7.5 million penalty paid by the Commonwealth Bank for more than 170 million non-compliant emails.

Opt-Out Rules Compared

Every cold email law above requires a working opt-out, but the deadlines differ. This table puts them side by side.

If one sequence reaches several regions, use the strictest setting everywhere: process every opt-out within 5 working days and suppress it across every tool you send from. Many teams also treat a clear "not interested, stop emailing me" reply as an opt-out, which keeps you inside every regime.

Record Keeping: What to Log for Every Contact

Several of these laws put the burden of proof on the sender. CASL says the person claiming consent has the onus of proving it, and GDPR Article 5(2) makes the controller responsible for being able to demonstrate compliance.

A simple contact-level log covers most of it:

• Source and date: where the contact came from (data provider, public web page URL, event) and when you collected it.
• Basis for emailing: legitimate interest with a link to your LIA, express consent with the form and timestamp, or the CASL and Spam Act route you rely on, with evidence such as a dated screenshot of a published address.
• Relevance: the person's role and company at the time of sending, which supports the "relevant to their role" tests in CASL, the Spam Act, CNIL guidance and your GDPR balancing test.
• Region and subscriber type: recipient country, plus corporate subscriber or sole trader for UK contacts.
• Messages sent: campaign, sending identity and dates.
• Opt-outs and objections: date received, date processed, and the suppression entry.
• Data subject requests: GDPR access and erasure requests and your responses, which Article 12(3) requires without undue delay and within one month.

GDPR Article 30 also requires records of processing activities. Organizations under 250 employees have a limited exemption, but it does not apply where processing is not occasional, which ongoing outbound usually is.

Keep suppression records minimal: enough to stop a contact being re-added, and no more.

How to Source Compliant B2B Data

Cold email laws care about how you got an address and why you are using it, so data sourcing is a compliance decision as much as a cost decision. These are the checks that matter across regimes:

1. Know the provenance. Ask any data provider where its contact data comes from and how it handles deletion requests. You will need the source for your Article 14 notice anyway.
2. Target by role, not volume. Relevance to the recipient's job is the common thread in CASL, the Spam Act, CNIL guidance and the GDPR balancing test. Role, seniority and company data make that relevance something you can show.
3. Verify every address. GDPR Article 5(1)(d) requires personal data to be accurate. Verified addresses also keep bounce rates down, which protects deliverability, as covered in our guide on how to avoid spam filters.
4. Segment by country and business type. Route Canada, Australia and Germany into consent-based flows, and separate UK sole traders from limited companies.
5. Suppress before every send. Check each new list against a global suppression list that holds every past opt-out from every tool.
6. Skip bought lists with no provenance. You cannot document a source or a basis for data you cannot trace.

SyncGTM helps with the data side of this. Its waterfall enrichment checks multiple email providers in sequence and returns verified work emails, and enrichment adds role, seniority and company details you can reference in your legitimate interests assessment.

SyncGTM's Lemlist and Smartlead integrations include actions to unsubscribe or remove a lead from a campaign, so an opt-out recorded in one place can reach your sequencer.

Deciding your lawful basis stays with your team and counsel. See pricing for credit costs.

Inbox Provider Rules: Not Law, Still Enforced

Gmail, Yahoo and Outlook set their own sender requirements, enforced through filtering rather than fines. Google's sender guidelines require bulk senders to authenticate with SPF, DKIM and DMARC, support one-click unsubscribe for marketing messages, and keep spam rates low.

A message can be legal and still land in spam. Our explainer on ISP vs ESP covers who controls inbox placement, and our cold email statistics roundup has current bounce and inbox placement benchmarks.

Cold Email Compliance Checklist

Run this before every new campaign:

1. Tag every contact with country, and UK contacts with business type.
2. Confirm the email-marketing rule for each country: opt-out (US, UK corporate, France), or consent (Canada, Australia, Germany, UK sole traders).
3. For EU and UK contacts, document a legitimate interests assessment for the campaign.
4. Record each contact's source, collection date and basis for emailing.
5. Check the list against your global suppression list.
6. Use accurate From, Reply-To and subject lines, and identify your company clearly.
7. Include a physical postal address and a working opt-out in every email.
8. Add a short privacy line and notice link to the first email for EU and UK contacts.
9. Process opt-outs within 5 working days and sync them to every sending tool.
10. Keep your copy relevant to each recipient's role, which also lifts replies, as our guide to cold email CTAs shows.

Conclusion

Cold email laws share a core: identify yourself honestly, make opting out easy and fast, and be able to explain why each person is on your list. Where they differ is consent, which is optional in the US and for UK companies, depends on the country in the EU, and is required in Canada and Australia.

Build your process around the strictest market you email, keep a record for every contact, and have counsel review it once. After that, compliance is mostly a data hygiene problem, and that starts with the list you send to.