Is cold email legal or illegal?

Cold email is not illegal in most countries, but it is regulated. In the US, CAN-SPAM allows unsolicited commercial email if it is honest, includes a physical address and offers an opt-out honoured within 10 business days. The EU, UK, Canada and Australia set stricter rules, such as a lawful basis under GDPR or consent under CASL, so the answer depends on where recipients are.

Region	Main law	B2B cold email allowed?	Key requirements
United States	CAN-SPAM Act	Yes, opt-out model	Honest headers and subject, physical address, opt-out honoured within 10 business days
European Union	GDPR + ePrivacy rules (national)	Varies by country	Lawful basis (often legitimate interest), privacy notice, right to object; some countries require prior consent
United Kingdom	PECR + UK GDPR	Yes to corporate addresses	Identify the sender, easy opt-out; sole traders need consent
Canada	CASL	Only with consent	Express or implied consent, sender identification, unsubscribe within 10 business days
Australia	Spam Act 2003	Only with consent	Express or inferred consent, sender identification, unsubscribe within 5 business days

Short answer: legal, but regulated

Sending an unsolicited email to a business contact is not a crime in itself in most countries. What the law regulates is how you do it: whether you need consent first, what the email must contain, how you handle opt-outs and how you process the personal data you used to find the person.

The rule that matters is usually the recipient's location, not yours. A US company emailing a prospect in Berlin is dealing with German and EU rules, not only CAN-SPAM. That is why the honest answer to "is cold email legal" is "yes in many places, with conditions, and no in some places without consent."

This page is a general overview, not legal advice. If you send at volume into several countries, have a lawyer review your process. If you are new to the term itself, start with what a cold email is.

United States: CAN-SPAM

The US uses an opt-out model. Under the CAN-SPAM Act you can email people who have never heard of you, business or consumer, as long as you follow these rules:

No false or misleading header information. The From, To and Reply-To lines must identify you accurately.
No deceptive subject lines. The subject must reflect the content.
Identify the message as an ad where it is commercial, in a clear way.
Include a valid physical postal address.
Offer a clear way to opt out and honour it within 10 business days. You cannot charge a fee or ask for more than an email address to process it.
Stay responsible for agencies. If someone sends on your behalf, both of you can be liable.

Each violating email can carry civil penalties of more than $50,000, a figure the FTC adjusts for inflation. Harvesting addresses from websites with automated tools or generating them by guessing combinations makes violations more serious.

In Europe two layers apply. GDPR covers the personal data (a work email like maya.chen@northwind.co is personal data because it identifies a person). National ePrivacy rules cover the act of sending electronic marketing.

Lawful basis. Most B2B senders rely on legitimate interest. That means documenting a legitimate interest assessment showing your outreach is relevant to the person's role and does not override their rights.
Transparency. When you collect data from a source other than the person, GDPR expects you to tell them where it came from and how to object, at the latest in your first message.
Right to object. An objection to direct marketing must always be honoured.
Country differences. Some EU countries, such as Germany, require prior consent even for B2B marketing email, so legitimate interest alone is not enough there.
UK. Under PECR you can send unsolicited marketing to corporate addresses without consent if you identify yourself and offer a simple opt-out. Sole traders and some partnerships are treated like individuals and need consent. UK GDPR still applies to the personal data.

GDPR fines can reach EUR 20 million or 4% of global annual turnover, whichever is higher.

Canada's CASL and Australia's Spam Act 2003 both start from consent, which makes them stricter than CAN-SPAM.

Canada (CASL). You need express or implied consent. One form of implied consent covers addresses that are conspicuously published, for example on a company website, where the person has not said they do not want messages and your email relates to their business role. Every message must identify the sender and include an unsubscribe mechanism, honoured within 10 business days. Penalties for businesses can reach CAD 10 million per violation.
Australia. Consent can be express or inferred, including from conspicuous publication when the message relates to the person's role. Messages must identify the sender and include a functional unsubscribe honoured within 5 business days.

A practical compliance checklist

Most of the legal risk in cold email comes from a handful of habits. Here is a checklist that works across most regions:

Know where recipients are. Segment by country and apply the strictest rule that fits each segment.
Target by role. Email people whose job makes your offer relevant. This supports legitimate interest and conspicuous publication arguments.
Use honest sender details and subjects. Real name, real company, a subject that matches the body.
Include identity and an address. A physical postal address in the footer covers CAN-SPAM and helps elsewhere.
Make opting out easy. A one-line "reply stop" or an unsubscribe link, processed quickly and permanently.
Keep a suppression list that every sequencer and every teammate uses.
Record your sources so you can tell a recipient where you got their address.
Send low volume, relevant messages. This also protects deliverability; see how to improve email deliverability.

A concrete example: Maya Chen, VP Revenue Operations at Northwind Analytics (northwind.co), plans outreach to RevOps leads at Stackfold and Parcelry. Stackfold's leads are in the US, so she includes Northwind's postal address and a reply-to-opt-out line. Two Parcelry contacts are in Germany, so she holds them back until she has consent or legal sign-off. Her first email to UK and EU contacts says where she found their work address and how to object, and every opt-out goes into one shared suppression list. For tone and structure, see how to write a cold email.

Where your data provider fits

A data provider cannot make your outreach legal on your behalf; the sender stays responsible. It can make compliance easier or harder depending on how it sources and handles data.

Leadsets, a B2B data API and MCP server for AI agents, serves business contact data only from licensed suppliers and public sources it is permitted to use, with nothing scraped from behind a login. Each field carries its source and last-checked date, which helps when a recipient asks where you got their address. Leadsets runs a GDPR-aligned program with a legitimate-interest assessment and a DPA with standard contractual clauses, described on its compliance page. Anyone can opt out without an account, and suppressed records are never served again. SOC 2 is planned, not complete.

Leadsets' terms are clear that customers remain responsible for outreach laws such as CAN-SPAM, GDPR and CASL, for honouring unsubscribes and for keeping their own suppression lists. Email verification labels addresses verified, catch-all, unknown or invalid, which helps reduce bounces, but verification is a deliverability measure, not a legal one.

Questions and answers

Is cold email illegal in the US?

No. The CAN-SPAM Act allows unsolicited commercial email without prior consent. You must use accurate headers and subject lines, include a physical postal address and honour opt-outs within 10 business days.

Do I need consent for B2B cold email under GDPR?

Not always. Many B2B senders rely on legitimate interest, backed by a documented assessment, a privacy notice and an easy way to object. Some EU countries, such as Germany, require prior consent for marketing email even between businesses.

Is cold email legal in the UK?

Yes for corporate email addresses under PECR, provided you identify yourself and offer a simple opt-out. Sole traders and some partnerships need consent, and UK GDPR still governs how you handle the personal data.

Is cold email legal in Canada?

Only with consent under CASL, which can be express or implied. Implied consent can apply when an address is conspicuously published, the person has not refused messages and your email relates to their business role.

Is it legal to send cold email to a purchased list?

Buying a list is not banned by CAN-SPAM, but you are still responsible for every email sent and for honouring opt-outs. Under GDPR you become responsible for the data and must have a lawful basis and tell recipients where their data came from, and many sending platforms prohibit purchased lists in their terms.

Do cold emails need an unsubscribe link?

They need a clear way to opt out in the US, UK, EU, Canada and Australia. A link is common, but a plain instruction such as replying to opt out can work if it is easy and every request is honoured promptly.

Go deeper