Is B2B Cold Email Legal? US, UK, EU, Canada Rules
Yes, B2B cold email is legal in the United States. The CAN-SPAM Act does not ban unsolicited commercial email. It sets rules for how the message is sent, and those rules apply to business-to-business email as well as consumer email. Outside the US the picture changes. Canada requires consent, the EU and UK layer data protection law on top of email rules, and fines can be steep. This guide covers what each market requires, what a compliant message contains, and which records protect a sender if a complaint arrives.
This is general information, not legal advice. A brand sending at scale across several countries should have a lawyer who handles marketing and privacy law review its campaign setup.
KingpinReach the Right Retail BuyersKingpin is an AI-powered wholesale team that finds retailers that fit your brand, reaches their buyers in their language and hands interested buyers to you.Explore Kingpin
TL;DR
In the US, cold email to business contacts is allowed if it follows CAN-SPAM: accurate sender details, a clear advertisement disclosure, a physical address and a working opt-out.
Canada is stricter: CASL requires prior express or implied consent before a commercial message is sent.
The UK and EU treat the personal data inside a business email address as regulated. Senders usually rely on legitimate interests and must document that choice.
Honor every opt-out and keep a suppression list. Both the brand being promoted and the company sending can be held responsible.
Penalties are per email in the US and can reach millions in Canada and the EU, so a documented process matters more than any single template.
Table of Contents
The short answer by region
United States: CAN-SPAM
Canada: CASL requires consent
United Kingdom: PECR and UK GDPR
EU: GDPR and national rules
How legitimate interests works for business contacts
Australia: APP 7 and the opt-out statement
What a compliant cold email contains
Records and safeguards that protect you
Why cold email is only one route to retail buyers
Perspective: why compliance and targeting go together
Starting outreach to retail buyers with Kingpin
FAQ
Sources
The short answer by region
The same email can be lawful in one country and a violation in another. The table below summarizes the starting point for each market, based on the regulators’ own guidance.
Region | Core model | What the sender needs |
|---|---|---|
United States | Opt-out | Accurate header and sender identity, advertisement disclosure, physical postal address, working opt-out |
Canada | Opt-in (express or implied consent) | Consent, sender identification and contact details, working unsubscribe |
United Kingdom | Corporate subscribers exempt from PECR consent; UK GDPR still applies | A lawful basis, usually legitimate interests, plus clear identity and an opt-out address |
European Union | GDPR plus national rules | A lawful basis, information to the recipient, and the ability to object |
Australia | Direct marketing rules under the Privacy Act | Simple opt-out and a prominent opt-out statement |
The sections below take each region in turn.
United States: CAN-SPAM
The Federal Trade Commission’s compliance guide is the primary reference. It states that the law covers all commercial email, including messages to business contacts. A cold email promoting a product or service falls inside it. The practical requirements are short:
Accurate sender information. The “From,” “To,” and routing details must correctly identify the person or business sending the message. Subject lines must not mislead the recipient about the content.
Advertisement disclosure. The email must make clear that it is an ad. A short, plain line in the body does the job.
A physical postal address. The message must include a valid postal address for the sender.
A clear opt-out. Every message needs an easy way to stop future emails. The FTC guide says senders must honor opt-out requests within 10 business days, and the opt-out mechanism must keep working for at least 30 days after the email goes out.
Two points catch teams out. First, a company cannot contract away responsibility. The same FTC guide says both the business whose product is promoted and the business that actually sends the email can be held legally responsible. A brand that hires an outside agency or list vendor still owns the compliance outcome. Second, the penalty is applied per message: the FTC lists penalties of up to $53,088 for each separate email in violation. That figure is adjusted over time, so check the FTC page for the current amount.
CAN-SPAM is an opt-out regime. A US sender does not need permission before the first message, provided every rule above is followed and every opt-out is respected.
Canada: CASL requires consent
Canada is where US senders most often get surprised. The CRTC explains that Canada’s Anti-Spam Legislation requires prior express or implied consent, identification and contact information, and a working unsubscribe mechanism for any commercial electronic message. The law reaches messages sent to Canadian recipients, so a US company emailing buyers in Toronto or Vancouver needs to take it seriously.
Enforcement is not theoretical. The CRTC states that maximum administrative monetary penalties are $1,000,000 per violation for an individual and $10,000,000 per violation for an organization. Its guidance also says directors who authorized or took part in violations can be held liable. In 2016 the regulator imposed a $50,000 penalty on Blackstone Learning Corp. for nine violations involving commercial emails sent without consent.
For a brand prospecting Canadian retailers, the safe approach is to confirm which consent basis applies to each contact before the first message, and to record it.
United Kingdom: PECR and UK GDPR
The UK splits the question in two. PECR governs the email itself. UK GDPR governs the personal data used to send it. The Information Commissioner’s Office explains that PECR’s rule on direct marketing by electronic mail does not apply to corporate subscribers, so consent is not required under PECR to email them. Marketers must still avoid disguising or concealing their identity and must give a valid address for opt-outs.
The UK GDPR still applies to the personal data involved. An email address such as a named buyer at a company is personal data. The ICO says legitimate interests may be used only when PECR does not require prior consent and the three-part test is passed. The reverse is also true: if PECR requires consent for a marketing activity, consent must be the lawful basis under UK GDPR too.
The corporate subscriber exemption matters for sole traders and some partnerships, which the ICO treats differently from limited companies. A sender who emails the owner of a small unincorporated business may be outside the exemption, so list segmentation is worth doing.
EU: GDPR and national rules
The EU does not have one cold email rule. GDPR sets the data protection baseline, and each country applies its own electronic marketing rules and has its own data protection authority. France shows how differently one country can approach it. The CNIL says commercial email prospecting is possible if people are informed. Individuals generally must consent beforehand, while professionals must be able to object.
Enforcement does happen. In 2025 the CNIL fined data broker CALOGA €80,000 for commercial email prospecting without consent and for passing prospects’ data to partners without a valid legal basis. That case is a reminder that the source of a list matters as much as the message.
Industry compliance guidance puts the ceiling for serious GDPR infringements at €20 million or 4% of worldwide annual turnover, enforced by independent data protection authorities in each member state. Most cold email programs will never approach that range, but it explains why European legal teams take list sourcing seriously.
How legitimate interests works for business contacts
When consent is not the route, most B2B senders in the UK and EU rely on legitimate interests. The ICO frames it as a three-part test: a legitimate purpose, a need to process the data for that purpose, and a balance against the individual’s rights and expectations. Its guidance notes that business contacts are more likely to reasonably expect their information to be used in a business context, which helps when the message is relevant to their role.
Australia: APP 7 and the opt-out statement
Australia’s direct marketing rules sit in Australian Privacy Principle 7. The OAIC guidelines say an organization must provide a simple means to opt out and include a prominent opt-out statement in each direct marketing communication. The statement should be in plain English, placed prominently, and set in a font that is easy to read, such as at least the size of the main text. A footer in tiny gray type is the pattern to avoid.
What a compliant cold email contains
Across these regimes, a handful of elements keep a message defensible almost anywhere:
A real sender identity. Use a genuine name and company in the From line, with no disguised domains or misleading subject lines.
A clear reason for contact. State why this person is receiving the email. It supports both the legitimate interests test and the recipient’s expectations.
An advertisement disclosure. Required in the US, and good practice everywhere.
A physical address. Required by CAN-SPAM, expected by most regulators.
A visible opt-out. One plain sentence and a working method, whether a link or a reply instruction, which is processed promptly.
These five elements cost nothing and satisfy most of what the US, UK and Australian guidance asks for. Canada and some EU countries additionally require a consent basis before the message is sent.
Records and safeguards that protect you
The ICO says businesses should keep a suppression list of people who object or opt out and screen new marketing lists against it. This is the single most useful safeguard, because it prevents the most common complaint: being emailed again after asking to stop.
A defensible program also keeps the following on file:
List source. Where each contact came from and when. Regulators in the CALOGA case focused on how data was obtained and shared.
Lawful basis record. For UK and EU contacts, the legitimate interests assessment, or the consent record where consent applies.
Opt-out log. The date each request arrived and the date it was processed, so the 10-business-day US limit can be shown as met.
Vendor agreements. Because responsibility cannot be contracted away under CAN-SPAM, a brand should know how any agency or tool handles lists, opt-outs and sender details.
Compliance also supports results. Complaints damage sender reputation and inbox placement, so the same hygiene that limits legal risk keeps campaigns reaching buyers.
Why cold email is only one route to retail buyers
A brand can follow every rule and still struggle if the outreach lacks targeting. Retail buyers receive large volumes of pitches, and the ones that get answered are relevant to the buyer’s category, market and assortment gaps. Channels such as B2B Google Ads for pipeline can complement outbound email by capturing buyers who are already searching, which reduces dependence on any single tactic.
Perspective: why compliance and targeting go together
We work with consumer brands that want to reach retailers, and our research agent finds retailers that fit each brand, with the reason for each one. The brands with the fewest compliance problems are the ones with the tightest targeting. When outreach goes only to buyers whose category and market match the product, complaints stay low, replies rise and the legitimate interest case is easy to explain.
We also believe a brand should own its buyer relationships. That is why we charge 0% commission and why every conversation, record and opt-out belongs to the brand rather than to an intermediary. Clear ownership makes compliance simpler: the brand knows who was contacted, why and what they said.
Our view is that legal review should be part of campaign setup, not an afterthought. Decide the markets first, confirm the consent rules for each one, then build the buyer list and message around them.
Starting outreach to retail buyers with Kingpin
Brands that want a managed route to relevant retail buyers can work with Kingpin, an AI-powered wholesale team for consumer brands. Six AI employees, run by an account manager from the brand’s category, find relevant retailers, reach their buyers in their language and keep accounts warm. The account manager reviews every list and message, the brand approves which retailers to approach, and every buyer relationship stays with the brand. Kingpin reports $700M+ in wholesale GMV since 2021 and 3,500+ retailers on Kingpin. Every plan has one monthly fee, set on the strategy call, and 0% commission. See how Kingpin works, or read our manifesto for the thinking behind the approach. On a strategy call, bring three shops you sell to and see the next ones that look like them.
FAQ
Can you cold email businesses in the US without permission?
Yes. CAN-SPAM does not require prior consent for commercial email, including messages to businesses. The sender must use accurate header information, disclose that the message is an ad, include a physical address and offer a clear opt-out that is honored within 10 business days.
Does GDPR apply to B2B cold email?
Yes, where the email address identifies a person, such as a named buyer, because that is personal data. Senders in the EU and UK commonly rely on legitimate interests, which requires passing a three-part test and documenting it. Some EU countries add stricter rules of their own, so check the national authority’s guidance for each market.
What happens if someone opts out and I email them again?
In the US, each separate non-compliant email can carry penalties of up to $53,088 according to the FTC guide. Beyond fines, repeat messages drive complaints that hurt sender reputation. Keep a suppression list and check every new list against it before sending.
Is cold emailing Canadian businesses allowed?
Only with prior express or implied consent under CASL, along with sender identification and a working unsubscribe. Penalties can reach $10,000,000 per violation for an organization. Confirm the consent basis for each Canadian contact before sending and consult a Canadian privacy lawyer for edge cases.
Sources
Yes, B2B cold email is legal in the United States. The CAN-SPAM Act does not ban unsolicited commercial email. It sets rules for how the message is sent, and those rules apply to business-to-business email as well as consumer email. Outside the US the picture changes. Canada requires consent, the EU and UK layer data protection law on top of email rules, and fines can be steep. This guide covers what each market requires, what a compliant message contains, and which records protect a sender if a complaint arrives.
This is general information, not legal advice. A brand sending at scale across several countries should have a lawyer who handles marketing and privacy law review its campaign setup.
KingpinReach the Right Retail BuyersKingpin is an AI-powered wholesale team that finds retailers that fit your brand, reaches their buyers in their language and hands interested buyers to you.Explore Kingpin
TL;DR
In the US, cold email to business contacts is allowed if it follows CAN-SPAM: accurate sender details, a clear advertisement disclosure, a physical address and a working opt-out.
Canada is stricter: CASL requires prior express or implied consent before a commercial message is sent.
The UK and EU treat the personal data inside a business email address as regulated. Senders usually rely on legitimate interests and must document that choice.
Honor every opt-out and keep a suppression list. Both the brand being promoted and the company sending can be held responsible.
Penalties are per email in the US and can reach millions in Canada and the EU, so a documented process matters more than any single template.
Table of Contents
The short answer by region
United States: CAN-SPAM
Canada: CASL requires consent
United Kingdom: PECR and UK GDPR
EU: GDPR and national rules
How legitimate interests works for business contacts
Australia: APP 7 and the opt-out statement
What a compliant cold email contains
Records and safeguards that protect you
Why cold email is only one route to retail buyers
Perspective: why compliance and targeting go together
Starting outreach to retail buyers with Kingpin
FAQ
Sources
The short answer by region
The same email can be lawful in one country and a violation in another. The table below summarizes the starting point for each market, based on the regulators’ own guidance.
Region | Core model | What the sender needs |
|---|---|---|
United States | Opt-out | Accurate header and sender identity, advertisement disclosure, physical postal address, working opt-out |
Canada | Opt-in (express or implied consent) | Consent, sender identification and contact details, working unsubscribe |
United Kingdom | Corporate subscribers exempt from PECR consent; UK GDPR still applies | A lawful basis, usually legitimate interests, plus clear identity and an opt-out address |
European Union | GDPR plus national rules | A lawful basis, information to the recipient, and the ability to object |
Australia | Direct marketing rules under the Privacy Act | Simple opt-out and a prominent opt-out statement |
The sections below take each region in turn.
United States: CAN-SPAM
The Federal Trade Commission’s compliance guide is the primary reference. It states that the law covers all commercial email, including messages to business contacts. A cold email promoting a product or service falls inside it. The practical requirements are short:
Accurate sender information. The “From,” “To,” and routing details must correctly identify the person or business sending the message. Subject lines must not mislead the recipient about the content.
Advertisement disclosure. The email must make clear that it is an ad. A short, plain line in the body does the job.
A physical postal address. The message must include a valid postal address for the sender.
A clear opt-out. Every message needs an easy way to stop future emails. The FTC guide says senders must honor opt-out requests within 10 business days, and the opt-out mechanism must keep working for at least 30 days after the email goes out.
Two points catch teams out. First, a company cannot contract away responsibility. The same FTC guide says both the business whose product is promoted and the business that actually sends the email can be held legally responsible. A brand that hires an outside agency or list vendor still owns the compliance outcome. Second, the penalty is applied per message: the FTC lists penalties of up to $53,088 for each separate email in violation. That figure is adjusted over time, so check the FTC page for the current amount.
CAN-SPAM is an opt-out regime. A US sender does not need permission before the first message, provided every rule above is followed and every opt-out is respected.
Canada: CASL requires consent
Canada is where US senders most often get surprised. The CRTC explains that Canada’s Anti-Spam Legislation requires prior express or implied consent, identification and contact information, and a working unsubscribe mechanism for any commercial electronic message. The law reaches messages sent to Canadian recipients, so a US company emailing buyers in Toronto or Vancouver needs to take it seriously.
Enforcement is not theoretical. The CRTC states that maximum administrative monetary penalties are $1,000,000 per violation for an individual and $10,000,000 per violation for an organization. Its guidance also says directors who authorized or took part in violations can be held liable. In 2016 the regulator imposed a $50,000 penalty on Blackstone Learning Corp. for nine violations involving commercial emails sent without consent.
For a brand prospecting Canadian retailers, the safe approach is to confirm which consent basis applies to each contact before the first message, and to record it.
United Kingdom: PECR and UK GDPR
The UK splits the question in two. PECR governs the email itself. UK GDPR governs the personal data used to send it. The Information Commissioner’s Office explains that PECR’s rule on direct marketing by electronic mail does not apply to corporate subscribers, so consent is not required under PECR to email them. Marketers must still avoid disguising or concealing their identity and must give a valid address for opt-outs.
The UK GDPR still applies to the personal data involved. An email address such as a named buyer at a company is personal data. The ICO says legitimate interests may be used only when PECR does not require prior consent and the three-part test is passed. The reverse is also true: if PECR requires consent for a marketing activity, consent must be the lawful basis under UK GDPR too.
The corporate subscriber exemption matters for sole traders and some partnerships, which the ICO treats differently from limited companies. A sender who emails the owner of a small unincorporated business may be outside the exemption, so list segmentation is worth doing.
EU: GDPR and national rules
The EU does not have one cold email rule. GDPR sets the data protection baseline, and each country applies its own electronic marketing rules and has its own data protection authority. France shows how differently one country can approach it. The CNIL says commercial email prospecting is possible if people are informed. Individuals generally must consent beforehand, while professionals must be able to object.
Enforcement does happen. In 2025 the CNIL fined data broker CALOGA €80,000 for commercial email prospecting without consent and for passing prospects’ data to partners without a valid legal basis. That case is a reminder that the source of a list matters as much as the message.
Industry compliance guidance puts the ceiling for serious GDPR infringements at €20 million or 4% of worldwide annual turnover, enforced by independent data protection authorities in each member state. Most cold email programs will never approach that range, but it explains why European legal teams take list sourcing seriously.
How legitimate interests works for business contacts
When consent is not the route, most B2B senders in the UK and EU rely on legitimate interests. The ICO frames it as a three-part test: a legitimate purpose, a need to process the data for that purpose, and a balance against the individual’s rights and expectations. Its guidance notes that business contacts are more likely to reasonably expect their information to be used in a business context, which helps when the message is relevant to their role.
Australia: APP 7 and the opt-out statement
Australia’s direct marketing rules sit in Australian Privacy Principle 7. The OAIC guidelines say an organization must provide a simple means to opt out and include a prominent opt-out statement in each direct marketing communication. The statement should be in plain English, placed prominently, and set in a font that is easy to read, such as at least the size of the main text. A footer in tiny gray type is the pattern to avoid.
What a compliant cold email contains
Across these regimes, a handful of elements keep a message defensible almost anywhere:
A real sender identity. Use a genuine name and company in the From line, with no disguised domains or misleading subject lines.
A clear reason for contact. State why this person is receiving the email. It supports both the legitimate interests test and the recipient’s expectations.
An advertisement disclosure. Required in the US, and good practice everywhere.
A physical address. Required by CAN-SPAM, expected by most regulators.
A visible opt-out. One plain sentence and a working method, whether a link or a reply instruction, which is processed promptly.
These five elements cost nothing and satisfy most of what the US, UK and Australian guidance asks for. Canada and some EU countries additionally require a consent basis before the message is sent.
Records and safeguards that protect you
The ICO says businesses should keep a suppression list of people who object or opt out and screen new marketing lists against it. This is the single most useful safeguard, because it prevents the most common complaint: being emailed again after asking to stop.
A defensible program also keeps the following on file:
List source. Where each contact came from and when. Regulators in the CALOGA case focused on how data was obtained and shared.
Lawful basis record. For UK and EU contacts, the legitimate interests assessment, or the consent record where consent applies.
Opt-out log. The date each request arrived and the date it was processed, so the 10-business-day US limit can be shown as met.
Vendor agreements. Because responsibility cannot be contracted away under CAN-SPAM, a brand should know how any agency or tool handles lists, opt-outs and sender details.
Compliance also supports results. Complaints damage sender reputation and inbox placement, so the same hygiene that limits legal risk keeps campaigns reaching buyers.
Why cold email is only one route to retail buyers
A brand can follow every rule and still struggle if the outreach lacks targeting. Retail buyers receive large volumes of pitches, and the ones that get answered are relevant to the buyer’s category, market and assortment gaps. Channels such as B2B Google Ads for pipeline can complement outbound email by capturing buyers who are already searching, which reduces dependence on any single tactic.
Perspective: why compliance and targeting go together
We work with consumer brands that want to reach retailers, and our research agent finds retailers that fit each brand, with the reason for each one. The brands with the fewest compliance problems are the ones with the tightest targeting. When outreach goes only to buyers whose category and market match the product, complaints stay low, replies rise and the legitimate interest case is easy to explain.
We also believe a brand should own its buyer relationships. That is why we charge 0% commission and why every conversation, record and opt-out belongs to the brand rather than to an intermediary. Clear ownership makes compliance simpler: the brand knows who was contacted, why and what they said.
Our view is that legal review should be part of campaign setup, not an afterthought. Decide the markets first, confirm the consent rules for each one, then build the buyer list and message around them.
Starting outreach to retail buyers with Kingpin
Brands that want a managed route to relevant retail buyers can work with Kingpin, an AI-powered wholesale team for consumer brands. Six AI employees, run by an account manager from the brand’s category, find relevant retailers, reach their buyers in their language and keep accounts warm. The account manager reviews every list and message, the brand approves which retailers to approach, and every buyer relationship stays with the brand. Kingpin reports $700M+ in wholesale GMV since 2021 and 3,500+ retailers on Kingpin. Every plan has one monthly fee, set on the strategy call, and 0% commission. See how Kingpin works, or read our manifesto for the thinking behind the approach. On a strategy call, bring three shops you sell to and see the next ones that look like them.
FAQ
Can you cold email businesses in the US without permission?
Yes. CAN-SPAM does not require prior consent for commercial email, including messages to businesses. The sender must use accurate header information, disclose that the message is an ad, include a physical address and offer a clear opt-out that is honored within 10 business days.
Does GDPR apply to B2B cold email?
Yes, where the email address identifies a person, such as a named buyer, because that is personal data. Senders in the EU and UK commonly rely on legitimate interests, which requires passing a three-part test and documenting it. Some EU countries add stricter rules of their own, so check the national authority’s guidance for each market.
What happens if someone opts out and I email them again?
In the US, each separate non-compliant email can carry penalties of up to $53,088 according to the FTC guide. Beyond fines, repeat messages drive complaints that hurt sender reputation. Keep a suppression list and check every new list against it before sending.
Is cold emailing Canadian businesses allowed?
Only with prior express or implied consent under CASL, along with sender identification and a working unsubscribe. Penalties can reach $10,000,000 per violation for an organization. Confirm the consent basis for each Canadian contact before sending and consult a Canadian privacy lawyer for edge cases.
Sources
About The Author
Ysabella Louise
Hi, I'm Ysabella, PMM at Kingpin. We believe that growing revenue shouldn't be a challenge, it should be a no-brainer. So sales teams can focus less on the struggle and more on the wins. I'm here to make sure that vision comes through in every story we tell, and to share what's working, what's changing, and what you should actually know to sell smarter.
