# Is Cold Email Legal? How to Send It Within the Rules

> Cold email to businesses is allowed in many countries, as long as you follow a few clear rules. Here is how to check where you stand and set up your outreach properly today.

You want to email businesses you have never spoken to, but a voice in your head keeps asking whether you could get fined for it. That worry is reasonable. The good news: in many places, cold email to businesses is allowed when you follow some basic rules. The details depend on where you are and where your recipients are.

This is practical guidance, not legal advice. Laws change and differ by country, so check the rules that apply to you, and talk to a lawyer if your situation is unusual.

## The short answer by region

The rules depend mostly on where the **recipient** is, not just where you are. Here are well-established points for common regions:

| Region | Main law | Key points for B2B cold email |
|---|---|---|
| United States | CAN-SPAM Act | Allowed without prior consent. Honest headers and subject lines, a physical postal address, a working opt-out, and opt-outs honored promptly. |
| European Union | GDPR plus national ePrivacy rules | You need a lawful basis (often "legitimate interest" for B2B). Some countries are stricter about emailing individuals, even at companies. |
| United Kingdom | UK GDPR and PECR | Emailing corporate addresses is generally allowed with an opt-out. Sole traders and some partnerships are treated more like individuals. |
| Canada | CASL | Stricter. Implied consent can apply when an address is conspicuously published and your message is relevant to the person's role. |
| Australia | Spam Act | Needs consent, though inferred consent can apply to published business addresses relevant to the offer. |

If you mostly email local businesses in your own country, start by reading that one law closely. You do not need to master all of them.

## Step 1: Decide who you are emailing and why

Most laws treat business contacts differently from consumers. Before you build a list, write down:

- **Who:** businesses, not private individuals at personal addresses.
- **Why them:** a clear reason your offer fits their work. A web designer emailing restaurants without websites has a clear reason. A random blast does not.
- **Where they are:** which country's rules apply.

This reasoning is also the backbone of a "legitimate interest" argument under GDPR. Keep a short note of it. If anyone ever asks why you contacted them, you have an answer.

## Step 2: Build your list from public business sources

Use contact details businesses publish themselves: their website, their Google Maps listing, their directory profile. Avoid bought lists where you cannot tell where the data came from, and never scrape personal email accounts.

GetClient's Google Maps scraper pulls public details like business name, website, phone and emails found on the business's own site, so you know where each contact came from. Whatever tool you use, keep a [lead list](https://getclient.pro/learn/lead-list) with a source column so you can trace any address.

Then clean it. Remove duplicates, generic personal addresses and anything that looks off. The [lead list cleaning checklist](https://getclient.pro/resources/lead-list-cleaning-checklist) walks through it. Verifying emails before sending also cuts bounces, which protects your [sender reputation](https://getclient.pro/learn/sender-reputation).

## Step 3: Make every email honest and identifiable

These points come up across most laws and are just good practice:

1. **Send from your real name and business.** No fake "Re:" or "Fwd:" subjects.
2. **Write a subject line that matches the content.** If you are pitching a service, do not pretend it is a reply to a thread.
3. **Include your business identity.** Under CAN-SPAM, a valid postal address is required. Put it in your signature.
4. **Keep it relevant.** Mention why you are writing to this specific business. Personal touches like their business name or city help here, and a strong opener matters; see [how to write a first line that gets read](https://getclient.pro/blog/write-a-first-line-that-gets-read).

## Step 4: Add a working opt-out and honor it

This is the rule nearly every regime agrees on. Every email, including follow-ups, should give people an easy way to stop hearing from you.

- Add an unsubscribe link or a clear line like "Reply 'no thanks' and I won't email again."
- Remove opt-outs quickly. CAN-SPAM sets a deadline; many people simply remove them the same day.
- Keep a suppression list so a removed address never sneaks back in from a new import.

That handles the "honor it" part without manual tracking.

## Step 5: Keep volume and follow-ups reasonable

Legal is not the only bar. Email providers judge you too, and spam complaints can hurt delivery even if you broke no law.

- Start with small daily volumes per sending account and raise them slowly.
- Limit follow-ups. A rule of thumb many senders use is two or three follow-ups, then stop.
- Stop following up with anyone who replies or opts out.
- Send from a properly set up account; if you connect a custom domain, learn the basics of [SMTP](https://getclient.pro/learn/smtp) and authentication.

## Step 6: Keep simple records

If a complaint ever comes in, records help. Keep:

- Where each lead came from and when.
- Your written reason for contacting that type of business.
- Your opt-out list with dates.
- A copy of the emails you sent.

This takes minutes to set up and gives you a clear story if you ever need it.

## A quick checklist before you hit send

- Recipients are businesses, at published business addresses.
- You know which country's rules apply and have read the basics.
- Sender name and subject line are honest.
- Your postal address is in the signature.
- Every email has a working opt-out.
- Opt-outs are suppressed permanently.
- The list is cleaned and verified.
- Follow-ups are limited and stop on reply.

If you are doing outreach on behalf of others, the same rules apply, and clients will rely on you to get them right. See [running outreach for clients](https://getclient.pro/blog/run-outreach-for-clients) for how to set that up.

## Frequently asked questions

### Do I need permission before sending a cold email?

It depends on the recipient's country. In the US, CAN-SPAM does not require prior consent for commercial email, but you must allow opt-outs. Canada and Australia generally require some form of consent, which can be implied for published business addresses in certain cases. Check the specific law for your recipients.

### Can I cold email someone's personal Gmail address?

It is safer to avoid it. Many laws protect individuals more strongly than businesses, and a personal address is harder to justify as a business contact. Stick to addresses a business publishes for business purposes.

### Is it legal to buy an email list?

Buying a list is not banned everywhere, but you take on the risk of how that data was collected. If you cannot confirm the source and the basis for contacting those people, you may struggle to justify your outreach under laws like GDPR.

### What happens if I break cold email rules?

Penalties vary by country and can include fines. Separately, email providers may block or filter your messages if people mark you as spam. Following the basics protects both your legal position and your delivery.

Source: https://getclient.pro/blog/is-cold-email-legal