Is Cold Emailing Legal? US, UK, EU and Canada in Plain English

Cold emailing is legal in all four of these places, but each one sets different conditions. The US (CAN-SPAM) lets you email anyone, including businesses, as long as you identify yourself honestly and offer a working opt-out. The UK (PECR) is stricter for individuals than for companies. The EU (GDPR) generally wants a lawful basis before you email a named person, though "legitimate interest" can sometimes cover it. Canada (CASL) is the strictest: you need the recipient's consent, express or implied, with only narrow exceptions. This is a summary of public regulator and government text, not legal advice — check the current rules yourself, or with a lawyer, before you rely on it for a real campaign.

Is cold emailing legal in the US?

Yes, under the CAN-SPAM Act, and it explicitly applies to B2B email: "The law makes no exception for business-to-business email," according to the FTC's CAN-SPAM Act compliance guide (checked October 2026). You don't need the recipient's consent first. You do need to follow the rules in every message:

• Your "From," "To," "Reply-To," and routing information must "be accurate and identify the person or business who initiated the message."
• Your subject line "must accurately reflect the content of the message" — no bait-and-switch subject lines.
• Include a valid physical postal address (a registered PO box is acceptable).
• Give "a clear and conspicuous explanation of how the recipient can opt out," with a method that keeps working for at least 30 days after you send, and honor any opt-out request within 10 business days.

The FTC guide states a penalty "of up to $53,088" per violating email, a figure the FTC last adjusted for inflation in January 2024 — check the FTC's current penalty page before assuming that number still holds, since these adjust periodically.

Is cold emailing legal in the UK?

It depends on who you're emailing. The UK's Privacy and Electronic Communications Regulations (PECR) say you "must not send marketing emails or texts to individuals without specific consent" (ICO's electronic mail marketing guidance, checked October 2026). That rule has one major exception and one major distinction:

• Soft opt-in: you can email your own existing customers without fresh consent if they already bought or seriously discussed buying something similar from you, provided you gave them a clear opt-out when you collected their details and in every message since. It doesn't cover cold prospects or a bought-in list.
• Companies versus individuals: corporate bodies — companies, Scottish partnerships, LLPs and government bodies — can be emailed without the same consent requirement, though the ICO recommends keeping a do-not-contact list for any that object. Sole traders and most ordinary partnerships are treated as individuals, so the stricter rule applies to them. The ICO's guidance doesn't spell out generic inboxes specifically, but it flags that emailing an employee's personal corporate address can raise separate data protection issues worth checking in its business-to-business guidance.

The ICO notes this guidance is currently under review because of the UK's Data (Use and Access) Act, so confirm it hasn't changed before you rely on it.

Is cold emailing legal in the EU?

Generally, you need a lawful basis under the GDPR before emailing a named person, and consent is the obvious one — but it isn't the only one. Article 6(1)(f) allows processing, including sending a marketing email, when it's "necessary for the purposes of the legitimate interests pursued by the controller," unless that's "overridden by the interests or fundamental rights and freedoms of the data subject." Recital 47 says directly: "The processing of personal data for direct marketing purposes may be regarded as carried out for a legitimate interest" — but it also requires weighing whether the person could reasonably expect it, given your relationship (or lack of one) with them.

That's the EU-wide baseline. In practice, each member state also has its own national law implementing the ePrivacy Directive alongside GDPR, and those can set additional, stricter conditions on unsolicited commercial email — the UK's PECR above is one country's version of the same underlying directive. Don't assume "legitimate interest" alone clears you in every member state; check the specific country's rule if you're emailing there regularly. GDPR's own penalties reach the highest tier for violations of its lawful-basis rules: up to "20 000 000 EUR, or in the case of an undertaking, up to 4% of the total worldwide annual turnover" of the prior year, whichever is higher (GDPR Article 83).

Is cold emailing legal in Canada?

This is the one place where the default answer is no without consent. Canada's Anti-Spam Legislation (CASL) requires that "the person to whom the message is sent has consented to receiving it, whether the consent is express or implied" before you send a commercial electronic message (Section 6(1)(a) of the Act). The exceptions are narrow, not a general B2B carve-out:

• A message that's "solely an inquiry or application" related to the recipient's own commercial activity.
• Messages between people with an existing personal or family relationship (as defined in the regulations).
• Messages that "provide information directly related to an employment relationship or related benefit plan."

Where CASL applies, every message also needs to identify the sender, give contact information the recipient can "readily" use, and include an unsubscribe mechanism that stays valid for at least 60 days. CASL's administrative penalties are the steepest of the four: Section 20(4) caps them at "$1,000,000 in the case of an individual, and $10,000,000 in the case of any other person," such as a business.

What's the one rule that holds everywhere?

Identify yourself honestly, and give the recipient an easy, working way to tell you to stop — then actually stop. Every regime above requires some version of that, even the ones (US, and UK for corporate bodies) that don't require consent upfront. It's also the one thing a founder sending outreach by hand controls completely, regardless of which country the recipient is in. Larvabot's email drafts go out in small batches, one at a time, with nothing sent until you approve it — which makes it easy to actually honor a stop request the day it comes in, instead of discovering three queued follow-ups went out anyway (see how the email drafts work).

For the templates themselves — including a baked-in opt-out line — see our cold email guide for SaaS founders. If you're also wondering how many follow-ups is reasonable once someone hasn't replied, our guide to following up after no response covers timing and when to stop.

Frequently asked questions

Do I need opt-in consent before sending a cold email in the US?

No. CAN-SPAM is an opt-out law, not opt-in — you can send the first email without prior consent, but you must honor an opt-out request within 10 business days and keep the opt-out mechanism working for at least 30 days after sending.

Can I email a company's general inbox in the UK without consent?

PECR's consent requirement is aimed at individuals; corporate bodies (companies, LLPs, Scottish partnerships, government bodies) can generally be emailed without the same specific consent, though the ICO recommends respecting any objection and keeping a do-not-contact list. Sole traders and most partnerships are treated as individuals, so check which category your recipient falls into.

Is "legitimate interest" enough to cold email someone in the EU?

It can be, under GDPR Article 6(1)(f) and Recital 47, but it requires a genuine balancing test — would this person reasonably expect to hear from you, and do your interests outweigh theirs? It's not a blanket permission, and individual EU member states can layer stricter national rules on top through their own ePrivacy implementation.

What happens if I cold email someone in Canada without consent?

You're outside one of CASL's narrow exceptions unless the message is purely an inquiry about the recipient's own commercial activity, relates to an existing personal relationship, or concerns an employment relationship. Administrative penalties for violations can reach $1,000,000 for an individual and $10,000,000 for an organization under Section 20(4), though enforcement in practice typically starts with a warning or a much smaller penalty.

Is there a single email that's compliant in all four places at once?

Not automatically, but the same habits get you most of the way: identify yourself and your organization accurately, don't fake the subject line, include a real way to opt out, honor it immediately, and don't send to anyone who has already told you no. Layer on the UK/EU consent questions and Canada's consent requirement before you email individuals there specifically.