Is cold email legal? US, UK, EU, Germany, Canada, Australia

Cold email is legal in many places, but not everywhere, and the rules depend on where the recipient is. I'm not a lawyer, and this isn't legal advice. It's my plain summary of the regulators' own guidance, checked in October 2026. Before you send into a new country at any real volume, ask a lawyer there.

United States: CAN-SPAM

You don't need consent first, but there are rules, and the FTC says there's no exception for business-to-business email. Every commercial email must:

• have accurate sender details and a subject line that isn't deceptive;
• make clear that it's an advertisement;
• include a valid physical postal address;
• offer a clear way to opt out, honoured within 10 business days.

You stay responsible for email others send on your behalf. Penalties can reach $53,088 per email.

United Kingdom: PECR and UK GDPR

The ICO's guidance says you can email corporate bodies without consent: companies, LLPs and government bodies. Sole traders and some partnerships count as individuals, so they need consent. You must say who you are, give a valid way to opt out, and keep a do-not-email list. A named work address is still personal data under UK GDPR.

European Union: GDPR plus national rules

The EU isn't one rule. GDPR covers how you handle personal data, and a business address like jane@company.com counts. Many senders rely on "legitimate interest", which means documenting why your interest doesn't override theirs and telling people where you got their data. Separately, each country applies its own electronic marketing law, and that decides whether you may send the email at all. Some countries are much stricter for B2B than others, so check each one.

Germany: the strictest I know of

Section 7 of the German Unfair Competition Act (UWG) treats email advertising without the addressee's prior express consent as an unacceptable nuisance. There's a narrow exception for your own existing customers. So a B2B cold email to Germany carries real legal risk, whatever your GDPR basis is, and you need a German lawyer's view before sending there.

Canada: CASL

Canada requires consent, identification and an unsubscribe. The CRTC's guidance allows implied consent when someone has conspicuously published their address, with no statement refusing messages, and your email relates to their business role. It reads this narrowly: an address only found in a corporate database doesn't count. You carry the burden of proof, so keep a record of where and when you found each address.

Australia: the Spam Act

You need consent, express or reasonably inferred from the person's conduct and relationships. Finding an address published online isn't enough on its own, although there's a limited exception for addresses published so the public can reach someone in their role. You must identify yourself and action an unsubscribe within 5 working days.

Business addresses and personal addresses

Across most of these places, the rules are looser for a work address than for a private person. Emailing a company contact about their job is the lower-risk case. Sole traders, and personal Gmail or Hotmail addresses, often count as consumers and usually need consent first.

What every cold email should have, everywhere

• Your real name and company.
• A real postal address.
• A simple way to opt out, honoured quickly and in every mailbox.
• An honest subject line.
• A record of where each address came from.
• A suppression list you check before every send. The suppression builder helps.

Legal and allowed are different things

Email providers have their own rules on top of the law, so read your provider's acceptable use policy. A relevant, low-volume message to a business contact with an easy way out is very different from a blast. Stay firmly on the right side of that line, because it protects both your legal position and your mailboxes.

mailzy helps with the mechanics: the automatic signature can carry your business address, the one-click unsubscribe header is on by default, and a "remove me" reply stops everything for that lead. You're still responsible for who you email and for following the law where they are.