Compliance

Is cold email legal? CAN-SPAM, GDPR, PECR and CASL explained (2026)

Cold email is legal in many countries if you follow the rules, but the rules depend on where the recipient is. A plain-English guide to the US, UK, EU and Canada, with a compliance checklist.

The Imperagent team·6 November 2026·10 min read

Short answer: B2B cold email is legal in many countries, including the US and the UK, as long as you follow specific rules. In some countries, such as Canada and Germany, it largely isn't without some form of consent. What matters is where your recipient is, not where you are.

This is a practical overview, not legal advice. If outbound is central to your business, have a lawyer check your setup for the countries you target.

United States: CAN-SPAM

The US uses an opt-out model. You don't need permission to send a commercial email, but every email must follow the CAN-SPAM Act. There's no exception for B2B email.

According to the FTC, every commercial email must:

Use accurate header information. From, To, Reply-To and routing must identify who sent it.
Use an honest subject line that reflects the content.
Identify the message as an advertisement, where it is one.
Include a valid physical postal address.
Tell recipients how to opt out, with an easy mechanism such as a reply or a link.
Honour opt-outs within 10 business days, without charging a fee or asking for more information. The opt-out must keep working for at least 30 days after you send.
Remain your responsibility even if someone else sends it for you.

The penalty is up to $53,088 per violating email. That figure was set in the FTC's January 2025 inflation adjustment, and the FTC kept 2025 levels unchanged for 2026. Some states have additional rules.

Two sets of rules apply in the UK.

PECR: who you're emailing matters

The Privacy and Electronic Communications Regulations (PECR) treat two kinds of recipient differently:

Corporate subscribers: companies, LLPs and government bodies. You can send unsolicited marketing emails to people at these organisations (e.g. jane@bigcompany.co.uk) without prior consent. You must still identify yourself and give a valid way to opt out.
Individual subscribers: this includes sole traders and some partnerships. Here you generally need consent, or the narrow "soft opt-in" for existing customers.

So emailing a director at a limited company is very different from emailing a self-employed consultant at their own address.

A work email like jane.smith@company.com is personal data. To process it you need a lawful basis. For B2B outreach that's usually legitimate interests, which means:

doing (and keeping) a legitimate interests assessment: your purpose, why outreach is necessary, and why it doesn't override the person's rights;
only contacting people whose role makes your offer relevant to them;
telling them where you got their data and how to object, at the latest in your first message;
stopping immediately and permanently when they object.

Bigger fines since 2025

The Data (Use and Access) Act 2025, which received Royal Assent on 19 June 2025, raises the maximum PECR fine from £500,000 to the UK GDPR level: £17.5 million or 4% of worldwide annual turnover, whichever is higher. PECR breaches are now a much bigger risk than they used to be.

The EU picture is more fragmented. GDPR applies everywhere and works much like the UK version: you need a lawful basis (typically legitimate interests), transparency about the data source and an easy objection.

The rules on the email itself come from the ePrivacy Directive, implemented differently in each country. Some member states permit B2B emails to corporate addresses with an opt-out. Others are much stricter. Germany is the best-known example: under its unfair-competition law (UWG), advertising by email generally needs the recipient's prior express consent, and that applies to businesses too. Plain cold outreach to German recipients carries real legal risk.

If you sell into the EU, check the specific countries you target. Many teams simply exclude the strict ones.

Canada: CASL

Canada's Anti-Spam Legislation (CASL) is a consent model, and it's one of the strictest in the world. You need express or implied consent before sending a commercial electronic message.

The implied-consent route most relevant to B2B is conspicuous publication: the person has published their email address (for example on their company website) without saying they don't want marketing, and your message relates to their business role. Even then, every message must identify you and include a working unsubscribe.

A cold email compliance checklist

Use this as a baseline for every campaign:

Target by recipient country, and exclude or handle stricter countries (e.g. Canada, Germany) separately.
Email work addresses at companies, and avoid sole traders' personal addresses in the UK.
Only contact people whose role makes the offer relevant.
Document your legitimate interests assessment (UK and EU).
Use a real sender name and an honest subject line.
Include your company name and postal address in every email.
Include a working, one-click unsubscribe, and honour it immediately and across every campaign.
Say where you got their details and how to object (UK and EU).
Keep a suppression list of everyone who has opted out, bounced or complained, and check it before every send.
Keep records of each contact's source and when you got it.

How Imperagent handles this

We built compliance into the product rather than leaving it to a checklist:

Every email includes a one-click unsubscribe (including the List-Unsubscribe header) and your legal name and postal address.
Opt-outs, bounces and complaints go to an organisation-wide suppression list that's checked at enrolment and at send time.
Every lead keeps a record of its source and when it was retrieved.
Countries that require prior consent can be excluded by default.
Nothing sends until you approve the campaign.