You have a list of 200 prospects and a finished draft, and then someone on the team asks, "Is cold email legal?" If you send from the United States, the CAN-SPAM law does not ban cold email to a business, and asking first is not one of its eight rules. But every commercial message must pass eight rules from the Federal Trade Commission (FTC), and the footer is easy to get wrong. If your list includes readers in the UK, the EU or Canada, the answer changes, and a table in this post sorts your readers by country.
Copy the sample footer in the checklist, and run the test beside each rule. US only? Read the checklist and footer, then the five steps and the reply templates. This is general information, not legal advice. It reflects what the named government and regulator pages said in November 2026, and laws change. The send, wait and hold labels, the same-day stop routine and the worked example are Accord's own starting points, not legal rules.
Is cold email legal in the US, the UK, the EU and Canada?
- United States: CAN-SPAM does not ban it if each message follows eight rules, and state laws may add more. The FTC's CAN-SPAM compliance guide says the law "makes no exception for business-to-business email."
- United Kingdom: The Information Commissioner's Office (ICO), the UK regulator, says PECR, the UK's marketing-email rules, needs neither prior consent nor the soft opt-in for marketing email to limited companies and other corporate subscribers. You still must not hide your identity or omit a valid opt-out address. UK GDPR can still apply, and the UK section explains the terms.
- European Union: GDPR asks for a legal ground to use a person's data. If a person's details came from a list or a public page, the first message can also require certain information and a clear right to object.
- Canada: The anti-spam law, CASL, generally asks for consent first, and it can reach a message sent from outside Canada. The Canada section shows how.
What does CAN-SPAM cover, and does it apply to B2B email?
CAN-SPAM covers commercial email. The FTC guide defines it as a message whose primary purpose is "the commercial advertisement or promotion of a commercial product or service." A first cold email that promotes your service fits, so a purchasing manager gets the same protection as a shopper. A message that fits one of five "transactional or relationship" categories, such as confirming a deal the reader already made, is treated differently, and the guide says the law views these categories narrowly.
The eight rules are about how you send and how people stop you, not about asking first. The FTC page says each separate email in violation can bring penalties of up to $53,088. The FTC adjusts that figure, so check the page before you quote it. The guide also lists harvesting addresses and generating them by dictionary attack, meaning guessing them by trial and error, among the practices that can bring criminal penalties. State laws are not covered here, so ask your lawyer about them.
What must every B2B cold email follow?
The eight items follow the FTC guide in its own order, with its headings in short form. Each has a test, a pass line and a fix, and the tests are our own starting points. Send yourself a test email first, because items 1 to 5 use it.
- Do not use false or misleading header information. The "From," "To," "Reply-To" and routing details must be accurate and identify who started the message. Test: send the email to yourself and press reply. Pass: the From name shows a real person or business, and the reply reaches a person. Fix: correct the sender settings.
- Do not use deceptive subject lines. The subject must accurately reflect the content. Test: show only the subject to a colleague. Pass: they can say what the email is about. Fix: rewrite it.
- Identify the message as an ad. The guide says you must disclose "clearly and conspicuously" that the message is an advertisement, and it does not mention one-to-one messages, so add the line. Test: open your own test email. Pass: the footer says "advertisement" or "marketing email" in plain words. Fix: add a line such as "This is a marketing email," and have your lawyer approve the wording.
- Tell recipients where you are located. The message must include a valid physical postal address. The guide names a street address, registered PO box or registered private mailbox. Test: open your test email. Pass: the footer shows a street address, registered PO box or registered private mailbox. Fix: if you work from home, get a registered PO box or private mailbox.
- Tell recipients how to opt out. The message needs a clear explanation plus a return email address or another easy internet-based way to answer. Any menu of choices must include stopping all marketing email, and your spam filter must not block the requests. Test: reply "no thanks" to your own message from a second mailbox. Pass: the reply arrives in the inbox, not in spam. Fix: add a line such as "reply 'no thanks' and I will stop," and let that address through your filter.
- Remember that subscribers and members can opt out too. This covers newsletters and customer emails, not only cold email: people on those lists keep the right to opt out of marketing email. Test: list every type of marketing message you send. Pass: each type carries the opt-out line, except a message that fits one of the five "transactional or relationship" categories, such as one confirming a deal the reader already made. Fix: add the line to any that lack it.
- Honor opt-out requests promptly. Your opt-out method must keep working for at least 30 days after you send, and you must honor a request within 10 business days. You cannot charge a fee or ask for more than an email address. You also cannot sell or transfer the address, except to a company hired to help you comply. Test: reply "no thanks" to a test message. Pass: the address is on your do-not-email list the same day. That is our target; the law allows 10 business days. Fix: keep one do-not-email list that every tool and every person uses.
- Monitor what others are doing on your behalf. If you send everything yourself, skip this item. It covers your agency or email tool. The guide says you cannot contract away your legal responsibility by hiring another company, and both the company whose product is promoted and the company that sends may be held responsible. Test: ask your agency or tool vendor for a sample message and its opt-out process in writing. Pass: their sample has your address and ad line, and a test opt-out lands on your do-not-email list the same day. Fix: send back any gaps.
Copy and adapt this US sample footer, which covers items 3, 4 and 5, and have your lawyer approve the wording. The names are invented.
Northfield Dataworks, 100 Sample Street, Springfield, ST 00000
This is a marketing email from Northfield Dataworks.
If you would rather not get emails from us, reply "no thanks" and we will stop.
This footer follows the FTC rules only. The UK adds the duty not to hide your identity and to give a valid opt-out address. Canada adds the name of anyone you send for, a phone number, email or web address next to your mailing address, and contact details valid for at least 60 days. Our post on the first cold email template shows where a footer sits.
What changes if your list includes readers outside the US?
Use the table before you load a list into your tool. It sorts each row into one of three states, our own starting points. Send means the checklist covers the FTC rules, though state laws, which this post does not cover, still need a check. Wait means a lawyer confirms one named item first, then you may send. Hold means send nothing until a lawyer has answered. If you do not know where a reader is, treat the row as hold. With no lawyer yet, send only the Send rows.
| Where the reader is | What the pages say | Before you send | Check with a lawyer |
|---|---|---|---|
| United States | CAN-SPAM covers B2B email. Eight rules, including a postal address and a working opt-out. | Send, after the checklist and a state-law check. Note where each address came from. | Is our ad line and address choice enough? |
| UK limited company or LLP | The PECR consent rule does not apply to corporate subscribers, such as limited companies. Identity and a valid opt-out address still do. UK GDPR can apply. | Wait. Add identity details and the do-not-email check, then send once your lawyer confirms your written legitimate-interests assessment (explained in the UK section below). | Is our written assessment sound for this list? |
| UK sole trader, some partnerships, or unclear | The ICO treats these, and unclear cases, as individual subscribers. | Hold. | Is there a basis to email them without prior consent? |
| EU country | GDPR needs a legal ground. Article 14 (first-message information) and Article 21 (right to object) can apply. | Hold until your lawyer confirms the legal ground and the country's email-consent rule. After that, the first message carries or points to the Article 14 information and has a separate objection line. | What do this country's rules say about company mailboxes? |
| Canada, or a reader who may open the email there | Generally consent first. Each message needs identity, contact details and unsubscribe. Section 12 ties these rules to a computer system in Canada used to send or access the message. | Hold. Treat any Canadian reader as hold until your lawyer confirms the consent type. | Which consent type fits each contact, and does Section 12 reach us? |
| Anywhere else, or not sure | Not covered in this post. | Hold. | What are the email and privacy rules there? |
A hold is not a verdict that sending is unlawful. It means the pages read here are not enough to decide.
The UK: PECR and UK GDPR
PECR covers marketing by email, and UK GDPR covers the use of personal data. This section follows the ICO's business-to-business marketing guidance and its electronic mail marketing guidance.
The reader's type decides the consent rule. The ICO says you can send unsolicited marketing email to corporate subscribers, such as companies and limited liability partnerships, without prior consent or the soft opt-in. Sole traders and some partnerships count as individual subscribers. They need consent or the soft opt-in, a narrow exception for people who already bought from you or negotiated a sale with you. The ICO also says an email address alone does not show which type a person is, and advises treating unclear cases as individuals.
Two PECR duties still apply to corporate subscribers. You must not hide who you are, and you must give a valid address for opt-out requests. PECR does not expressly require you to honor a corporate subscriber's opt-out, but the ICO says you should, and recommends a do-not-email list of companies that object.
UK GDPR can still apply. The ICO says UK GDPR applies when you use personal data for direct marketing, even in a business context, so a list of named contacts falls under it. For emails to business contacts the ICO lists legitimate interests, or consent, as a likely legal ground, with no absolute rule. Using it means passing a three-part test. The ICO advises keeping a record, and we require a written assessment before sending. Purpose asks why you need to email. Necessity asks whether email is needed for that purpose. Balancing asks whether the person's rights outweigh your interest. Write the three answers down; that is the written assessment in the table. A named person can also object, and the ICO says you must then stop using their data for direct marketing.
The EU: GDPR
GDPR protects personal data, so a list of named contacts may fall under it. Whether it reaches a US sender depends on the facts. Article 3(2) covers a sender outside the EU that offers goods or services to people in the EU or monitors their behavior there.
The European Commission's business guidance lists six legal grounds. Two matter for cold email: consent, and legitimate interests, which may be used "only after having checked" that the person's rights and freedoms are not seriously impacted.
The first message has two extra duties. Both come from the GDPR text.
- Article 14 information. If you got a person's details from somewhere other than the person, you must give that person certain information. If you use the data to contact them, it must arrive at the latest at your first message. It includes, among other things, who you are, why you use the data and on which legal ground, where the data came from, and the person's rights, including the right to complain to a data protection authority. Article 14 has exceptions, such as when the person already has the information.
- Article 21 right to object. People can object to direct marketing at any time. The right must be explicitly brought to their attention at the latest at the first message, clearly and separately from other information. Once a person objects, Article 21(3) says the data may no longer be used for that marketing.
So a bare footer line may not be enough for a first message to an EU reader. Once your lawyer clears a reader, copy and adapt these invented lines. They are a starting point, not approved wording.
I found your work email on your company's public team page on [date]. I use it only to send you information about [service], because it may be relevant to your role as [function].
You can object to my using your details for marketing at any time, and I will stop at once. Reply "object".
The full list of how I use your data, your other rights and how to complain is at [your notice page].
Many senders put the full list in a website notice and point to it. Ask your lawyer whether that meets Article 14.
Bought or shared lists need proof. The Commission page says a company that receives a contact list from another organisation must be able to demonstrate that the data was obtained in compliance with GDPR. If the list relied on consent, that consent should have covered passing the data on for others' direct marketing.
Email rules sit on top. The EU's Your Europe page says that for direct marketing emails promoting particular brands or products, "your prior consent is required," with an exception for existing customers. It is written mostly for people as readers and does not say what applies to a company mailbox.
Canada: CASL
The consent details come from the Canadian government's page on getting consent to send email, last modified April 2019, so check current guidance.
Consent comes first. Express consent means someone agreed, verbally or in writing, to get such a message. Implied consent exists only in certain cases, such as an existing business relationship, and is generally time-limited: up to two years, or six months for inquiries or applications. A conspicuously published address can support implied consent only if it carried no do-not-contact notice and your message is relevant to the person's role or duties.
Every message needs four things. Your business name and the name of anyone you send for. A current mailing address plus a phone number, email or website address. Contact information valid for at least 60 days after you send. An unsubscribe method that is free and handled within 10 business days.
A US sender can still be covered. Section 12(1) of the Act says a person contravenes Section 6 "only if a computer system located in Canada is used to send or access the electronic message." Section 6 is the consent, identification and unsubscribe rule. The test is where a computer system is used, not where the sender lives. In our reading, a message sent from the US and opened on a computer system in Canada may meet it. The government pages we read do not say, so treat any Canadian reader as hold.
What should you do before the first send?
These five steps are our starting routine.
- Sort the list by country and reader type. Use the table, and put every unclear row on hold.
- Write one source note per list. Record where each address came from, the date, and why you chose that person. The Commission page asks buyers of lists to prove how data was obtained, and the source is one of the Article 14 items. The note also answers "who gave you my email?"
- Build one do-not-email list. Every stop request, negative reply and complaint goes on it the same day, and every sending tool and person must read it. Our guide to a cold email deliverability system shows how to share one do-not-email list across tools.
- Screen each new list against it before loading. Remove matches.
- Send one test and read it. Send the email to your own second mailbox, check the From line, subject and footer, then use the opt-out and see if it registers.
If you do not know whether a step passed, treat it as failed.
What do you reply to "stop", "who gave you my email?" and "is this legal?"
Act before you write, as our post on cold email reply handling also advises. For a stop request, add the address to the do-not-email list, then confirm in one line. Do not ask why or move the person to another campaign.
Thanks, I have removed you from my list and you will not hear from me again.
For "who gave you my email?", answer from your source note only. Do not guess.
I found your work email on your company's public team page on [date]. I wrote because you lead [function]. I have also removed you from my list.
If the source is a bought list, say so, then ask your lawyer what else you owe that person. For "is this legal?", do not argue.
Fair question. I wrote because [reason]. I have removed you from my list, and I can tell you where I found your address.
Never write "fully compliant" or "100% legal". You cannot know that for each reader.
Imagine: a 300-name list sorted by the table
Imagine a six-person US software company, Northfield Dataworks. This example is invented, including every name and number, and is not a benchmark. Its sales lead has 300 names: 200 US readers, 50 UK readers, 30 Canadian readers and 20 readers in Germany.
Of the 50 UK readers, 38 are clearly limited companies. Twelve are small firms where the lead cannot tell whether the owner is a sole trader, so under the ICO's advice they are treated as individuals.
The lead sorts the 300 names. Send: the 200 US readers, after the checklist and a state-law check. Wait: the 38 UK limited companies, unsent until the lawyer confirms a written legitimate-interests assessment. Hold: 12 unclear UK readers, 30 Canadian readers and 20 German readers, which is 62 names. So 200 of 300, or 66.7%, can go out once they clear the checklist and the state-law check, the 38 stay unsent until the lawyer answers, and the 62 stay on hold.
The lead sends the 200 emails with the sample footer. Three readers reply "stop", and all three go on the do-not-email list the same day.
Next week a colleague hands over 120 more US names from a different tool, and the lead screens them against the do-not-email list. Two names match, so 118 remain, and a single shared list is what caught them.
Frequently asked questions
Is cold email legal in the US?
CAN-SPAM does not ban it if each message follows the rules, and state laws may add more. The FTC guide sets eight rules for commercial email, and B2B email gets no exception, so a message to a purchasing manager must meet the same rules as one to a shopper.
Do I need an unsubscribe link in a cold email?
CAN-SPAM asks for a clear explanation of how to opt out, with a return email address or another easy internet-based option that keeps working for at least 30 days. A link is not the only route, so a plain reply line can serve. Canada asks for an unsubscribe method in every message, with contact details valid for 60 days.
Does PECR ban cold email to UK companies?
Not for corporate subscribers, says the ICO. The PECR consent rule for marketing email does not apply to them, such as limited companies, but you must not hide your identity and must give a valid address for opt-outs. Sole traders and unclear cases are treated as individuals, and UK GDPR can still apply.
Is cold email legal under GDPR?
GDPR does not name cold email as banned or allowed. It asks for a legal ground, and the European Commission lists six, including consent and legitimate interests. If the details came from somewhere other than the person, Article 14 asks for certain information by the first message. Article 21 asks that the right to object be shown clearly and separately by then.
Do I need consent to send a cold email in Canada?
Canada's government guidance asks for express consent, meaning someone agreed verbally or in writing, or for implied consent in certain cases. Section 12 of the Act ties the rule to a computer system in Canada used to send or access the message, so a US sender should ask a lawyer.
Can my email tool or agency handle the law for me?
No. The FTC guide says you cannot contract away your legal responsibility, and both the advertised company and the sender may be held responsible. Use the tool for the mechanics, and keep your own checklist and do-not-email list.
Next step
If you would like a second pair of eyes on your footer, stop routine and list sorting, book a 30-minute working session with the Accord team. Bring your footer and a sample of your list's countries. We are not lawyers, so take your hold group to one. Accord sells outbound, email, lead-generation, SEO and AEO, web and social services, so we have an interest in this subject.