Cold email can be legal in many jurisdictions, but only when you satisfy two separate tests: the data-processing rule (like GDPR's legitimate interest basis) and the local sending rule (like ePrivacy, CASL, or CAN-SPAM). Before your next send, verify both. If your list includes stricter countries such as Germany, pause and apply tighter consent standards, identify your business clearly, and make sure your opt-out actually works.
TL;DR:
- Tag every contact by country: UK corporate subscribers can generally receive B2B email without advance consent, while Germany and Austria require prior consent for unsolicited marketing.
- Before EU campaigns launch, document the specific interest, why processing is necessary, and how it balances against recipients’ rights and reasonable expectations.
- Canadian senders must process unsubscribes within 10 business days, while Australian senders have 5 working days; outsourcing does not shift either business’s liability.
- For US messages, include accurate headers, an honest subject line, a valid postal address, and an unsubscribe option that actually stops future sends.
Table of Contents
- The two-step legal test behind cold email compliance
- Where to send freely and where to slow down: a country comparison
- United States: CAN-SPAM essentials and practical implementation
- Running GDPR-compliant B2B cold email in the EU
- Canada and Australia: consent regimes and unsubscribe deadlines
- Technical controls that protect you from compliance and deliverability risk
- An operational checklist for every cold email campaign
- Building compliance into ICP-first outreach workflows
- Where outbound teams get the balance wrong
- How SDR.ai helps you run compliant outbound without building a compliance team
- FAQ
- Sources
The two-step legal test behind cold email compliance
Every cold email campaign has to answer two separate questions, and conflating them is the most common compliance mistake we see. The first question is whether you are allowed to process the recipient's data at all. The second is whether you are allowed to send that specific message to that specific inbox. These are governed by different bodies of law, and passing one does not mean you pass the other.
Analysis of B2B cold email legality in the EU makes this distinction explicit: satisfying GDPR does not automatically permit sending the message, because national ePrivacy rules act as a separate gate. A lawful basis for processing a contact's name and email is necessary but not sufficient on its own.
Four legal frameworks cover most B2B outreach:
- CAN-SPAM in the United States governs commercial email broadly and focuses on honest headers, identification, and opt-out mechanics rather than requiring prior consent.
- GDPR and the ePrivacy Directive in the EU split the problem into two layers: GDPR covers whether you can hold and use the data, while each country's ePrivacy implementation decides whether you can send unsolicited marketing to that inbox.
- CASL in Canada is a consent-first regime where implied consent for B2B contacts is narrow and time-limited.
- The Spam Act in Australia, enforced by the ACMA, requires consent in most cases along with strict sender identification and unsubscribe handling.
The B2B versus B2C distinction matters because several jurisdictions, including the UK, treat corporate or "role based" addresses differently from personal consumer addresses. A message to a named individual's personal Gmail account faces stricter rules than one sent to a generic sales inbox at a registered company, though this distinction narrows or disappears entirely in stricter markets like Germany.
Where to send freely and where to slow down: a country comparison
Treating "the EU" or "international outreach" as one bucket is where most compliance failures start. Send rules vary sharply by country, and the safest operational approach is to tag every contact with a country field and apply that country's regime automatically rather than relying on a single global policy.
Broadly, jurisdictions fall into three groups:
- Opt-out friendly markets, including the United States under CAN-SPAM and the UK for genuine corporate subscribers under PECR, where you can send first and must honor opt-out promptly rather than obtaining consent in advance.
- Single opt-in or soft consent markets, including Poland and several other EU member states, where a legitimate-interest basis combined with clear relevance to the recipient's role is generally workable for B2B outreach.
- Strict or double opt-in markets, led by Germany and Austria, where unsolicited commercial email to an individual without prior consent carries real legal exposure under national unfair competition law, regardless of how well-documented your GDPR legitimate-interest assessment is.
ICO guidance on business-to-business marketing confirms that under the UK's PECR, corporate subscribers (companies, not sole traders or individuals) do not require prior consent for B2B email marketing. That guidance also notes that other countries' national implementations of the ePrivacy Directive diverge significantly, and Germany's UWG is frequently cited as requiring prior consent even in a B2B context.
France and Belgium sit in a more workable middle ground for role-based addresses (contact@, sales@, info@) where many practitioners treat a legitimate-interest basis as defensible when the outreach is clearly relevant to the recipient's professional role. Poland generally functions as a single opt-in market, where a well-targeted, relevant B2B pitch under legitimate interest is less likely to draw complaints than the same message sent into Germany or Austria.
The operational rule that follows from this: store the recipient's country as a required CRM field, map each country to one of the three regimes above, and apply the matching send rule automatically rather than leaving it to individual rep judgment. Before any campaign goes out to a new region, test the unsubscribe link yourself and confirm it actually removes the contact rather than just displaying a confirmation page. Tools for building targeted Sales Navigator lists can help you segment by country at the list-creation stage, which is the cheapest point to catch a compliance gap.
United States: CAN-SPAM essentials and practical implementation
The FTC's CAN-SPAM compliance guide lays out requirements that apply to every commercial email sent to a US recipient, not just bulk marketing blasts. Cold sales outreach counts.
- Use accurate "From," "To," and routing information so the recipient can tell who actually sent the message.
- Avoid deceptive subject lines. The subject has to reflect the content of the email honestly.
- Identify the message as an advertisement when required, though most relationship-building B2B outreach framed as a genuine business inquiry falls outside this trigger.
- Include your valid physical postal address somewhere in the message.
- Provide a clear and conspicuous way to opt out of future emails.
- Honor opt-out requests promptly and stop sending to that address.
The FTC's own guidance notes that CAN-SPAM's opt-out mechanism can be as simple as a reply-to address and still satisfy the law. A simple, tested reply-to flow often outperforms an over-engineered preference center, because the more moving parts in your unsubscribe process, the more likely something breaks silently and leaves a recipient still receiving email after asking to stop.
A common pitfall is building a preference center that updates a marketing database but never syncs back to the actual sending tool reps use for cold outreach. The recipient believes they unsubscribed, the regulator sees a working opt-out link, but the emails keep arriving. CAN-SPAM enforcement history treats this kind of silent failure as a violation regardless of intent, because the law requires that opt-out requests actually be honored, not just offered.
Running GDPR-compliant B2B cold email in the EU
GDPR and ePrivacy answer different questions, and both have to be satisfied before you send a single message into the EU. GDPR governs whether you have a lawful basis to hold and process a contact's personal data. ePrivacy, implemented separately by each member state, governs whether unsolicited electronic marketing is permitted to that type of recipient in that country at all. Passing the first test does not exempt you from the second.
For most B2B cold outreach, the relevant GDPR basis is Article 6(1)(f), legitimate interest. The EDPB's Guidelines 1/2024 on Article 6(1)(f) set out a three-step test that regulators expect to see documented, not just asserted after the fact.
- Identify the specific legitimate interest you are pursuing, such as reaching professionals whose role plausibly intersects with your product.
- Establish that processing the contact's data is necessary to pursue that interest, meaning there is no clearly less intrusive way to reach them.
- Run a documented balancing test weighing your interest against the individual's rights and reasonable expectations, including what safeguards you put in place.
The guidelines specify that this assessment should happen before the campaign starts, be written down, and be retained for accountability purposes, with the data protection officer involved where one is designated.
Pro Tip: Write your legitimate-interest assessment as a one-page document per campaign segment, dated and saved, so you can produce it immediately if a regulator or a recipient asks why you contacted them.
In practice, four operating rules keep this manageable:
- Only email contacts whose role is genuinely relevant to what you are offering, since relevance is the backbone of the necessity and balancing steps.
- Keep the message itself low-impact: no scraped personal details that feel invasive, no dark patterns in the opt-out.
- Log the assessment, the segment it covers, and the date, and store consent and legitimate-interest fields directly in your CRM alongside the contact record.
- Apply a country filter before sending, treating Germany and Austria as requiring a materially higher bar than France, Belgium, or Poland.
Canada and Australia: consent regimes and unsubscribe deadlines
CASL, Canada's anti-spam law, flips the default compared to CAN-SPAM. The Canadian government's CASL guidance describes a consent-based regime where you generally need express consent to send commercial electronic messages, and the implied consent exception for existing business relationships is narrow and time-limited rather than a general B2B carve-out.
Once a recipient unsubscribes, CASL requires you to process that request within 10 business days at no cost to them. That timeline applies regardless of how the original message was sent, including through a third-party outreach vendor acting on your behalf.
Australia's regime works similarly in practice. ACMA guidance on avoiding spam requires consent in most commercial messaging contexts, clear identification of the sending business, and functional unsubscribe mechanics. Under the Spam Act, unsubscribe requests must be actioned within 5 working days, and the sender has to be identifiable in the message itself.
Both regulators make the same point about accountability: using a third-party sender or outsourced SDR team does not transfer legal responsibility. The ACMA guidance is explicit that the contracting business remains liable for messages sent on its behalf, and Canadian enforcement follows the same logic.
The operational response is consistent across both countries:
- Keep records of how and when consent was obtained for every contact in a Canadian or Australian segment.
- Avoid purchased or scraped lists for these markets, since implied consent exceptions rarely cover them.
- Build vendor oversight into any outsourcing contract: require unsubscribe processing within the statutory window, request periodic audit logs, and run test sends quarterly to confirm the vendor's opt-out flow actually works end to end.
Technical controls that protect you from compliance and deliverability risk
Legal compliance and inbox placement rely on overlapping technical infrastructure, and a misconfiguration in one area tends to create problems in both. SPF, DKIM, and DMARC are the three authentication standards mailbox providers and, increasingly, regulators used to verify that a message actually came from who it claims to be from.
- SPF tells receiving servers which mail servers are authorized to send on behalf of your domain.
- DKIM attaches a cryptographic signature that proves the message wasn't altered in transit.
- DMARC ties the two together and tells receiving servers what to do when a message fails either check, while also giving you visibility into spoofing attempts against your domain.
Missing or broken authentication does not just hurt your spam placement. It can also turn an otherwise compliant message into one with inaccurate header information, which is precisely what CAN-SPAM prohibits. A deceptive or broken header isn't always intentional, but the law does not require intent to find a violation.
Beyond authentication, a few habits materially cut risk:
- Warm up new sending domains gradually rather than blasting volume from day one, which protects both deliverability and your sender reputation with mailbox providers.
- Monitor bounce rates and clean your contact data before each send, since high bounce rates are one of the fastest ways to trigger spam filtering and provider-level scrutiny.
- Track complaint rates by domain and pause sending immediately if they spike, since complaint spikes are often the first signal regulators or mailbox providers act on.
Teams dealing with recurring deliverability problems often benefit from a dedicated technical review. A deliverability audit covering SPF, DKIM, and DMARC setup can catch configuration gaps before they turn into a multi-week sending reputation recovery.
An operational checklist for every cold email campaign
Compliance works best as a repeatable sequence rather than a one-time legal review. Breaking it into pre-send, during-send, and post-send stages keeps the process auditable.
- Pre-send: verify the source of each contact, tag their country, confirm the applicable lawful basis or consent status, and make sure sender identity, physical address, and a tested opt-out link are all in place.
- During-send: throttle volume by domain and by country, watch complaint rates in real time, and pause the campaign immediately if complaints spike in any segment.
- Post-send: process every opt-out request within the statutory window for that country, log the consent or legitimate-interest documentation alongside each unsubscribe event, and periodically audit any third-party vendor's handling of the same obligations.
| Stage | Key action | Why it matters |
|---|---|---|
| Pre-send | Tag country, confirm lawful basis, test opt-out | Catches gaps before legal exposure exists |
| During-send | Throttle volume, monitor complaints | Limits damage if something is wrong |
| Post-send | Log opt-outs, audit vendors | Creates the audit trail regulators ask for |
This same structure covers data subject rights requests. If a recipient asks what data you hold, to correct it, or to delete it, the pre-send logging step is what lets you respond quickly instead of searching through scattered spreadsheets. The same logs double as your audit trail if a regulator ever asks you to demonstrate how a specific campaign was justified.
Building compliance into ICP-first outreach workflows
A compliance checklist only works if it is built into how lists get created, not bolted on afterward. When you build an ICP-based list using Boolean searches in Sales Navigator, the country and role fields that make a list well-targeted are the same fields that determine which consent regime applies. Filtering for relevance and filtering for legal basis become the same step instead of two separate reviews.
Operationally, this means treating send-time testing and reply benchmarks as compliance checkpoints too, not just performance metrics. A 200-contact send-time test tells you which hours get replies, but it also surfaces which segments generate complaints or bounces at a higher rate, which is an early signal that a list or region needs a closer look. LinkedIn-first, research-first sequencing that reaches a 13 to 14% reply rate tends to correlate with lower complaint rates too, since relevance is doing double duty as both a conversion lever and a legitimate-interest safeguard.
Pro Tip: Treat your reply-rate and complaint-rate dashboards as the same dashboard. A segment with low replies and rising complaints is a legal risk signal before it's a performance problem.
Vendor oversight matters just as much when outreach is managed externally:
- Require contractual SLAs specifying unsubscribe processing timelines that match the strictest jurisdiction in your list.
- Request audit logs showing when consent or legitimate-interest assessments were documented for each segment.
- Run a recurring test cadence, at minimum quarterly, to confirm opt-out links and vendor-side processes still work as described.
Where outbound teams get the balance wrong
Most sales teams treat compliance as a one-time legal sign-off rather than a standing operational habit, and that is backwards. The law changes by country faster than most outreach playbooks get updated, which means a list that was clean six months ago can be a liability today if you added new regions without re-checking the send rules.
My honest view is that the teams who stay out of trouble are not the ones with the best lawyers. They are the ones who default to the most conservative country rule when in doubt, rather than finding reasons to justify an aggressive send. A paused campaign costs you a few days of pipeline. A regulator complaint or a blacklisted domain costs you weeks of deliverability recovery and the trust of every contact on that list.
If a segment's complaint rate climbs or a new country is added to a list, pause and get a second opinion before the next send, not after. Repeatable, boring process beats clever ad-hoc fixes every time.
— Chad
How SDR.ai helps you run compliant outbound without building a compliance team
Running country-aware, legitimate-interest-documented, authentication-clean outreach at scale is a full-time operational job, which is exactly what we built our service around. Our AI-Powered Outbound engagement combines ICP-first LinkedIn targeting with intent signals, so the contacts you reach are relevant by design, which is the same relevance that supports a defensible legitimate-interest basis.
Every campaign includes a human SDR who handles replies directly, backed by a transparent, documented process rather than a black box. For teams that want to see the exact model before committing, Sdr walks through the playbook and math behind our approach, and our walkthrough of the model and playbooks covers the same ground in video form.
A few ways this plays out for your team:
- Country and role filters get applied at the list-building stage, before a single message goes out.
- Vendor oversight is built in rather than an afterthought, since we are the ones sending on your behalf and accountable for the process.
- Teams that want calling alongside email can add our AI-Dialer to combine warm calling with outreach under the same operational discipline.
If you want to see what this looks like for your pipeline specifically, book a demo and we will walk through how it maps to your ICP and target regions.
FAQ
What are the legal regulations for cold email?
The main frameworks are CAN-SPAM in the United States, GDPR plus each country's ePrivacy rules in the EU, CASL in Canada, and the Spam Act enforced by the ACMA in Australia. Each requires accurate sender identification and a working opt-out, but they differ on whether prior consent is required before you can send the first message.
What is the 30/30/50 rule for cold emails?
This isn't a legal or regulatory standard, and no named law or regulator defines any specific percentage rule for cold email. If you've seen such figures referenced, they are likely informal marketing heuristics rather than compliance requirements, so they shouldn't be relied on for legal purposes.
Is cold email still effective in 2026?
Relevance-driven, well-targeted outreach built on a genuine ICP match continues to generate replies when it respects both data-processing rules and local send rules. Teams using research-first, LinkedIn-first sequencing report reply rates in the 13 to 14% range, which suggests targeted approaches still outperform generic blasts.
Is cold emailing illegal in the USA?
Cold emailing is not illegal in the United States as long as it follows the CAN-SPAM Act's requirements: accurate headers, no deceptive subject lines, a valid physical address, and a working opt-out mechanism that you honor promptly. CAN-SPAM does not require prior consent before the first message, unlike CASL in Canada or GDPR-adjacent rules in parts of the EU.
Does GDPR apply to B2B cold email even with a legitimate-interest basis?
Yes. A documented Article 6(1)(f) legitimate-interest assessment under the EDPB's Guidelines 1/2024 covers the data-processing question, but you still need to check the national ePrivacy rule for the recipient's country, since some, like Germany, restrict unsolicited sending regardless of your GDPR basis.
Sources
- EDPB: Guidelines 1/2024 on processing of personal data based on Article 6(1)(f) GDPR
- ICO: Business-to-business direct marketing and electronic communications
- FTC: CAN-SPAM Act: A Compliance Guide for Business
- Government of Canada: Canada Anti-Spam Legislation (CASL) guidance
- ACMA: Avoid sending spam — guidance