You want to email businesses you have never spoken to, but a voice in your head keeps asking whether you could get fined for it. That worry is reasonable. The good news: in many places, cold email to businesses is allowed when you follow some basic rules. The details depend on where you are and where your recipients are.
This is practical guidance, not legal advice. Laws change and differ by country, so check the rules that apply to you, and talk to a lawyer if your situation is unusual.
The short answer by region
The rules depend mostly on where the recipient is, not just where you are. Here are well-established points for common regions:
| Region | Main law | Key points for B2B cold email |
|---|---|---|
| United States | CAN-SPAM Act | Allowed without prior consent. Honest headers and subject lines, a physical postal address, a working opt-out, and opt-outs honored promptly. |
| European Union | GDPR plus national ePrivacy rules | You need a lawful basis (often "legitimate interest" for B2B). Some countries are stricter about emailing individuals, even at companies. |
| United Kingdom | UK GDPR and PECR | Emailing corporate addresses is generally allowed with an opt-out. Sole traders and some partnerships are treated more like individuals. |
| Canada | CASL | Stricter. Implied consent can apply when an address is conspicuously published and your message is relevant to the person's role. |
| Australia | Spam Act | Needs consent, though inferred consent can apply to published business addresses relevant to the offer. |
If you mostly email local businesses in your own country, start by reading that one law closely. You do not need to master all of them.
Step 1: Decide who you are emailing and why
Most laws treat business contacts differently from consumers. Before you build a list, write down:
- Who: businesses, not private individuals at personal addresses.
- Why them: a clear reason your offer fits their work. A web designer emailing restaurants without websites has a clear reason. A random blast does not.
- Where they are: which country's rules apply.
This reasoning is also the backbone of a "legitimate interest" argument under GDPR. Keep a short note of it. If anyone ever asks why you contacted them, you have an answer.
Step 2: Build your list from public business sources
Use contact details businesses publish themselves: their website, their Google Maps listing, their directory profile. Avoid bought lists where you cannot tell where the data came from, and never scrape personal email accounts.
GetClient's Google Maps scraper pulls public details like business name, website, phone and emails found on the business's own site, so you know where each contact came from. Whatever tool you use, keep a lead list with a source column so you can trace any address.
Then clean it. Remove duplicates, generic personal addresses and anything that looks off. The lead list cleaning checklist walks through it. Verifying emails before sending also cuts bounces, which protects your sender reputation.
Step 3: Make every email honest and identifiable
These points come up across most laws and are just good practice:
- Send from your real name and business. No fake "Re:" or "Fwd:" subjects.
- Write a subject line that matches the content. If you are pitching a service, do not pretend it is a reply to a thread.
- Include your business identity. Under CAN-SPAM, a valid postal address is required. Put it in your signature.
- Keep it relevant. Mention why you are writing to this specific business. Personal touches like their business name or city help here, and a strong opener matters; see how to write a first line that gets read.
Step 4: Add a working opt-out and honor it
This is the rule nearly every regime agrees on. Every email, including follow-ups, should give people an easy way to stop hearing from you.
- Add an unsubscribe link or a clear line like "Reply 'no thanks' and I won't email again."
- Remove opt-outs quickly. CAN-SPAM sets a deadline; many people simply remove them the same day.
- Keep a suppression list so a removed address never sneaks back in from a new import.
In GetClient campaigns, you can add a one-click unsubscribe link with a signed URL for each recipient, and unsubscribed addresses are skipped automatically in future sends. That handles the "honor it" part without manual tracking.
Step 5: Keep volume and follow-ups reasonable
Legal is not the only bar. Email providers judge you too, and spam complaints can hurt delivery even if you broke no law.
- Start with small daily volumes per sending account and raise them slowly.
- Limit follow-ups. A rule of thumb many senders use is two or three follow-ups, then stop.
- Stop following up with anyone who replies or opts out.
- Send from a properly set up account; if you connect a custom domain, learn the basics of SMTP and authentication.
Step 6: Keep simple records
If a complaint ever comes in, records help. Keep:
- Where each lead came from and when.
- Your written reason for contacting that type of business.
- Your opt-out list with dates.
- A copy of the emails you sent.
This takes minutes to set up and gives you a clear story if you ever need it.
A quick checklist before you hit send
- Recipients are businesses, at published business addresses.
- You know which country's rules apply and have read the basics.
- Sender name and subject line are honest.
- Your postal address is in the signature.
- Every email has a working opt-out.
- Opt-outs are suppressed permanently.
- The list is cleaned and verified.
- Follow-ups are limited and stop on reply.
If you are doing outreach on behalf of others, the same rules apply, and clients will rely on you to get them right. See running outreach for clients for how to set that up.