Blog · Cold Outbound · October 20, 2026 · By Ahmad Zabir

Is Cold Email Legal? The Rules by Country, in One Table

Cold email is legal in the US and to UK company inboxes, while Germany, Canada and the data laws of Malaysia, Kenya and the UAE start from consent. Find your country in one plain table, then see what every email must carry.

Your buyer's country sets the rule, and the table below covers 14 of them.

This is not legal advice. We build outbound systems, we are not a law firm, and anything that matters should go past a lawyer where you send.

Four of the 14 countries we checked let you email a business without asking first

In an opt out country you may send the first email and must stop when someone says no. In a consent first country you need a yes before the first email.

Three questions decide each row: is the inbox a company's or a named person's, where did the address come from, and what do you do after a no.

Most of these laws follow the recipient: Canada's applies when a computer in Canada sends or opens the email. And under GDPR style laws (privacy laws modelled on the EU's General Data Protection Regulation), a named work address like jane@firm.com is personal data, even where spam law leaves companies alone.

Selling only into the US? The next four sections and the checklist cover you.

In the US, you can email a business first if every email carries six things

The US federal email law, the CAN-SPAM Act of 2003, never asks for permission. It covers any email whose main purpose is to sell, so a single email counts, and the FTC (the Federal Trade Commission, which enforces it) says it "makes no exception" for email to businesses. Every cold email to a US inbox needs:

1. Truthful header information: the From name, the sender address and the routing details (the record of which servers passed the email along).
2. A subject line that does not mislead.
3. A clear notice that the email is an ad, in words of your choosing.
4. Your valid physical postal address: a street address, a registered PO box or a registered private mailbox, per the FTC, and not necessarily a US one.
5. A free way to opt out by reply or on one web page, working for at least 30 days after you send.
6. Opt outs honoured within 10 business days, and the address never sold or passed on.

The law draws no line between a named partner's address and an info@ inbox. A breach counts as worse when the address was harvested (scraped from a website that says it does not give addresses out) or guessed by software such as an email permutator (a tool that tries jane.doe@ and jdoe@). By our reading, a public team page with no such notice is not harvesting; still, verify the address rather than guess it.

If someone sends for you, your name is still on it

The FTC says you "can't contract away your legal responsibility": the company promoted and the company sending may both be held responsible. Before an agency sends in your name, or you resell a build under yours, get four answers in writing:

1. Who approves every email before the first send.
2. Who owns the suppression list (the people who must never be emailed again), and how fast a stop reaches every inbox.
3. Who keeps the source record for each address, and where you can see it.
4. Who pays if a breach costs money, knowing a regulator can still pursue both of you.

Sources: 15 U.S.C. 7702, 15 U.S.C. 7704, FTC guide.

A US law firm or healthcare group is still a business inbox

Sellers into legal and healthcare often expect stricter email rules. The federal law has none.

The stricter rules bind the recipient. HIPAA (the US health privacy law) binds providers, health plans and their business associates (companies that handle patient information for a provider, such as a billing firm). Lawyer advertising rules, such as ABA Model Rule 7.3 (the model rule on lawyers seeking clients), bind lawyers. We found nothing applying either to a vendor emailing a firm's published work address, but that rests on secondary sources, so have counsel confirm it.

Before you email a US firm or clinic, check three things:

1. Patient information. If any patient detail is in your list or copy, stop and get a privacy lawyer. If you handle patient data for a healthcare client, you may be a business associate yourself, so keep that data out of every outbound list.
2. State rules. California and Washington allow lawsuits over misleading headers and subjects.
3. The six federal requirements, in every email.

The federal fine is a ceiling, and private lawsuits come from state law

The federal maximum

Each email that breaks CAN-SPAM can cost up to $53,088. The FTC normally raises that each January for inflation, but on 15 September 2026 it confirmed in a Federal Register notice that the amounts "will remain unchanged during 2026".

Real cases sit far below it. In August 2024 the FTC announced a $2.95 million penalty against Verkada. The company had sent more than 30 million marketing emails to small businesses over three years, with no opt out or postal address, and kept emailing people who had opted out.

• $2.95M Verkada's penalty in 2024, the largest the FTC has obtained under CAN-SPAM
• 30 million+ marketing emails to small businesses behind it, over three years
• About 10 cents what that penalty works out to per email, our arithmetic on the FTC's figures

Source: FTC press release on Verkada, 30 Aug 2024

State attorneys general can also sue under the federal act, for up to $250 an email capped at $2 million (15 U.S.C. 7706). Individual recipients cannot sue under it, but some state laws let them.

The state laws that survive

The federal law overrides state email laws, except where they ban "falsity or deception" (lies or misleading content, 15 U.S.C. 7707).

California's Business and Professions Code 17529.5 bars commercial email with a misrepresented header, someone else's domain used without permission, or a misleading subject. Recipients, the state attorney general and email providers can claim $1,000 an email, up to $1 million per incident.

In Balsam v. Trancos (2012), a California appeals court looked at emails from nonsense domains registered through a privacy service (one that hides the owner's name), naming no real sender. It called that a misrepresented header, awarded $1,000 for each of 7 emails plus $81,900 in fees, and rejected the argument that federal law wiped out the claim. We have that from Eric Goldman's summary, not the opinion itself.

That matters because cold email runs on secondary sending domains (extra domains used only for outbound email, so the main domain's reputation stays safe); a typical client build of ours uses 20 to 25. We found no ruling on a traceable secondary domain, so our working rule is Balsam reversed: the same named company in the From line and signature, its postal address in the footer, and a domain a stranger can trace back to it. Whether that is enough is a California lawyer's call.

If you resell outbound in a client's name, the named company is your client. On our reading, that passes only with the client's postal address in the footer and a sending domain that leads to the client, not your agency. Ask your lawyer: when we send in a client's name from domains we registered, whose name and address must each email carry? Then get the four written answers above.

Washington's Supreme Court held in Brown v. Old Navy (4 Wash.3d 580, April 2025, decided 5 to 4) that the state's email law covers any false or misleading subject line, at $500 an email. We read K&L Gates' summary, not the opinion. A fake "Re:" on a first email is the kind of subject line it reaches.

Both cases were brought by individual recipients, and we found no published state case against a small B2B cold emailer, so the risk is real but untested. We did not check Texas, New York, Florida or any other state, so ask a lawyer in yours whether it has a falsity rule that survives the federal one.

Legal is not the same as delivered, so check the spam folder first

A law can allow your email while the inbox hides it. Google's sender guidelines ask every sender to authenticate their domain with SPF or DKIM (records on your domain that prove the mail came from you) and to keep spam reports under 3 per 1,000 delivered emails (0.3%), aiming for 1 (0.10%). Above about 5,000 emails a day to personal Gmail, Google also wants DMARC (a third record that tells inboxes what to do with mail failing the first two), one click unsubscribe (a link Gmail shows at the top of the email) and stops honoured within 48 hours. Yahoo sets the same spam line and a 2 day window.

That spam limit does not cover Google Workspace, Google's paid business email: the sender FAQ says the requirements and enforcement "apply only to personal Gmail accounts". Workspace inboxes still sit behind Gmail's spam filters, so the same habits protect you. Microsoft added authentication rules for big Outlook.com senders in May 2025, per secondary summaries, but publishes no complaint limit we could find.

The out of office count pointed to the spam folder. Gmail does not appear to send vacation replies for mail it has filed as spam. Google does not document that, so it is our inference, though Gmail did bounce some of our mail for "very low reputation of the sending domain".

Our control: 5 Gmail inboxes, in a different campaign, sent to 839 Google hosted prospects and got 9 out of office replies (1.07%). At that rate about 24 were due from the 2,250, and we got zero. Nine is a thin base. By our arithmetic the true rate could be half that or double, and even at half we expected about 11. The campaigns differ too, so read it as a strong warning, not proof. We have not yet run the direct test: auto replies on in Gmail inboxes we control, fed mail we know lands in spam.

Our mistake was timing. Our client builds warm up for a full month (a slow ramp of friendly mail that builds a new inbox's reputation) before the first cold email; use that month on any new domain. Our own cold sending began on 6 May, two days after warmup started, through a shared IP provider (one server address used by many senders, so their reputations mix) whose warmup mail landed 34% to 44% in spam.

Two checks before a send, one after

Before a send, mail a few inboxes you control on Gmail and Outlook and see which folder each lands in. Then watch Google Postmaster Tools (Google's dashboard of the spam rate on your domain) and pause any domain that passes 0.10%, Google's own target.

After a send, split replies by the prospect's mail provider. If Google hosted prospects send no out of office replies while Microsoft hosted ones do, your mail is in spam, whatever your settings say. This check only shows damage already done; it is how we found ours, on 9 October 2026.

We have no rebuilt result yet, so read our August numbers as what a legal setup in the spam folder produces. Our 3 complaints were written replies, not spam button clicks, so they say nothing about a Gmail spam rate (what counts as a reply).

Ten checks belong in every setup before the first email goes out

Most of these cost time, not money. The money is a lawyer's review before you send to a consent first country; we have no sourced price, so ask two local firms for a fixed fee quote. Our line by line cold email budget prices the rest.

1. A real sender: your company name in the From line and signature, on sending domains a stranger can trace to you.
2. A postal address in every footer.
3. An opt out in every email, honoured within 48 hours and feeding one suppression list at the account level, shared by every domain, inbox and campaign. If you send from two tools, sync the list between them daily.
4. A subject that matches the body, with no fake "Re:" on a first email.
5. A recorded source and a one line reason for every address, kept on the row: your proof under CASL and your answer to any complaint.
6. The source told to the person, in the first email, as GDPR Article 14 asks: "We found your name on your firm's team page."
7. Country gates before volume: the consent first rows in the table get a lawyer's view before the first real send.
8. Verified addresses only. In our builds only "ok" verified emails are sendable; catch all addresses (domains that accept any address, so nobody can confirm the person exists) are not. If you bought the list, ask the seller how each address was collected.
9. Plain text, tracking off, low volume per inbox, a month of warmup on new domains, results split by mail provider, and spam reports under 1 per 1,000.
10. Timestamped records of every opt out and consent.

Without one shared list, one domain takes the stop and another emails the same person a week later.

From here on, the post goes country by country.

The UK lets you email companies but not sole traders, and its fine ceiling rose 35 times in February

The UK splits inboxes in two. Companies, LLPs (limited liability partnerships), Scottish partnerships and government bodies are "corporate subscribers", and you may email them without prior consent. Consumers, sole traders (people trading in their own name, with no company) and some partnerships are "individual subscribers", and they need consent first.

The rules are PECR, the Privacy and Electronic Communications Regulations 2003, and the ICO (the UK's data regulator) says its consent rule "does not apply to corporate subscribers". The one route to a sole trader without consent is the soft opt in: they bought or negotiated with you, you offer your own similar products, and they could refuse then and in every message since. If you cannot tell which kind of business it is, treat it as an individual.

Every inbox gets regulation 23: no hidden sender, and a valid address to ask you to stop. A named work address is also personal data under UK GDPR, where the ICO says legitimate interests (a lawful reason to use data without consent) works "in many cases" and the right to object is absolute.

From 5 February 2026, section 115 of the Data (Use and Access) Act 2025 raised the ceiling from £500,000 to £17.5 million or 4% of global turnover, whichever is higher. In January 2026 the ICO fined ZMLUK Limited £105,000, under the old cap, for 67,772,285 consumer emails sent without valid consent. The same notice fined Allay Claims £120,000 over texts, hence the £225,000 in its web address. We did not find a fine for emailing corporate subscribers, though our search was not exhaustive.

Sources: regulation 22, regulation 23, ICO B2B guidance, section 115.

The EU has no single answer: France asks for relevance, Germany asks for consent

GDPR, the EU's privacy law, governs the data, and each member state's version of the ePrivacy Directive (the EU rule on electronic marketing messages) governs the message. GDPR does not ban cold email. Its Recital 47 (one of the explanatory notes at its start) accepts direct marketing as a possible legitimate interest, as long as you tell people where you got their data by your first email (Article 14) and stop when they object (Article 21). Fines reach €20 million or 4% of worldwide turnover. The Directive's email article, Article 13, requires consent for email to people and leaves companies to each country.

France: relevance to the job

France's regulator, the CNIL, says B2B prospecting can rest on legitimate interest when the message fits the person's job, such as software offered to a company's IT director. The person must be told and able to refuse in every message.

Germany: consent, even between businesses

Germany's unfair competition law, the UWG, treats email advertising without "prior express consent" as an unacceptable nuisance, with no exception for businesses (section 7(2) no. 2). The Bonn chamber of commerce adds that a business card address is not consent, that a single ad email can already be unlawful (Federal Court of Justice, 2009), and that an opt out line does not create consent after the fact.

Enforcement arrives as an Abmahnung, a cease and desist letter from a competitor, trade body or chamber. Signing it commits you to a contractual penalty (a sum you agree to pay if you email again) that, per the chamber's guidance, regularly runs to several thousand euros. We treat German B2B cold email as a lawyer's call.

Per the handbook of DLA Piper, a global law firm, Spain, Italy and Austria also want consent first, companies included.

Sources: Recital 47, Article 14, Article 21, ePrivacy Directive, CNIL, UWG, DLA Piper.

Canada lets you skip asking only on three narrow routes, and the proof is yours

Canada's anti spam law, CASL, is the strictest here: it starts from consent, and section 13 makes whoever claims consent prove it. Consent can be express (a clear yes) or implied (one the law infers from the situation), and there is no general business exemption.

In the Compu-Finder appeal (2020 FCA 103), the Federal Court of Appeal said the relationship must be with the organisation, not a few employees, that a job title rarely proves relevance, and that addresses from third party directories failed (Torys, a Canadian law firm). Compu-Finder sold training to businesses, and Canada's telecoms regulator, the CRTC, had cut its $1.1 million penalty for 317 messages to $200,000, which the court upheld.

Inside each email, CASL wants the sender identified, contact details, and a free unsubscribe that works within 10 business days. The maximum is $10 million per violation for a company (CASL text).

The UAE, Malaysia and Kenya regulate the list, not the message

On one sending account we run for several clients, Malaysia, Kenya and the UAE are the three largest destinations: 116,030, 51,974 and 42,838 of 578,756 sends over 90 campaigns.

None of the three has an email spam law in force. Each has a data protection law that wants consent for commercial use of personal data. We found no public test of the B2B case in any of them.

The UAE

On our reading, you cannot email a named work address at a UAE mainland company without consent. Two legal guides find no legitimate interest ground in the data law, and the official text would not load for us on 20 October 2026, so get a UAE lawyer's written view first.

Three questions to send a UAE lawyer before the first send:

1. Does Decree-Law 45 of 2021 let us email a named work address at a UAE company without prior consent, and under which article?
2. Is this company in a free zone with its own data law, such as the DIFC or ADGM (the Dubai and Abu Dhabi financial free zones, whose laws include legitimate interest)? We checked only those two, so name any other, such as DMCC.
3. What must our first email say about where we got the address and how to object?

If you also use WhatsApp, do not send a first message to a UAE business number without a lawyer's written yes. Cabinet Decisions 56 and 57 of 2024 cover marketing by calls, SMS and messaging apps, though not email, per a Morgan Lewis summary of July 2024 we have not checked against the decisions.

Sources: UAE government data law page, UAE Public Prosecution on penalties.

Malaysia

Malaysia's Personal Data Protection Act 2010 (PDPA) bars processing personal data "unless the data subject has given his consent". The exceptions are a closed list, with no legitimate interest ground and no business contact carve out that we could find. Whether it reaches a sender with no presence in Malaysia is a question for a Malaysian lawyer. Section 43 lets anyone demand in writing that you stop direct marketing.

Since 1 April 2025 a breach of the Act's core principles can cost RM1,000,000 (Malaysian ringgit), up to three years in prison, or both. A new anti spam section, 233A of the Communications and Multimedia Act, was added in 2025 to require consent for commercial messages, email included, but was not in force as of late 2025.

Kenya

Kenya's Data Protection Act 2019 bars commercial use of personal data without "express consent" (section 37). Its 2021 regulations require an undisguised sender, a valid address to ask you to stop, and opt out instructions in every message.

The regulator's penalty tops out at KES 5 million (Kenyan shillings) or 1% of turnover, "whichever is lower" in the Act's own text. In 2024 it ordered Goodtimes Africa to pay KES 700,000 to a consumer who got marketing with no opt out.

Singapore, Australia and Pakistan each have one rule that catches senders

Singapore: the bulk threshold

Singapore's Spam Control Act 2007 applies only to bulk mail: more than 100 messages on a similar subject in 24 hours, 1,000 in 30 days or 10,000 in a year. It has no business exclusion, a published address is not consent, and unsubscribes must be honoured within 10 business days. Remedies are civil, up to S$25 (Singapore dollars) a message, capped at S$1 million.

Australia: the relevance test

Australia's Spam Act 2003 accepts inferred consent: an openly published address with no "no spam" statement, and a message that fits the person's work role. Unsubscribes must be honoured within 5 working days, and address harvesting software is banned. In October 2024 the Commonwealth Bank paid the regulator, the ACMA, A$7,502,610 over more than 170 million messages with no unsubscribe.

Pakistan: the law that binds us

We send from Lahore, so the Prevention of Electronic Crimes Act 2016 (PECA) binds our own team. Section 1(3) applies it "to every citizen of Pakistan wherever he may be" and to anyone in Pakistan, whoever they email, with the recipient's country's rules on top.

Section 2 defines "unsolicited information" as marketing sent "against explicit rejection of the recipient". By our reading, which a Pakistani lawyer has not yet confirmed and no case law tests, a first cold email is not unsolicited and a second one after a no is. Section 25(2) also requires direct marketers to offer an unsubscribe option. Under section 25(4) a first offence costs up to PKR 50,000 (Pakistani rupees), and each later one starts at PKR 50,000 and can reach PKR 1,000,000.

Most cases we found involved tens of millions of messages, a repeat offender or consumers. Compu-Finder, 317 messages to businesses, is the one a small B2B sender should remember.

Questions people ask

Can you cold email a law firm or a healthcare company in the US?

Yes. The federal email law has no exception for business email or by profession. Before you send, check that no patient information is in your list or copy, that you meet state rules such as California's and Washington's, and that every email carries the six federal requirements.

What are the CAN-SPAM requirements for a cold email?

An honest header and subject, a clear notice that the email is an ad, your physical postal address, and an opt out that works for 30 days and is honoured within 10 business days. Each violating email can cost up to $53,088, unchanged for 2026.

Is cold email legal in the UK?

Yes to companies and LLPs, if you do not hide who you are and you give a valid address to opt out. Sole traders need consent or the soft opt in, and the maximum fine has been £17.5 million or 4% of global turnover since 5 February 2026.

Is cold email legal in Canada?

Only with consent, express or implied, and section 13 of CASL makes you prove it. Implied consent covers an existing relationship with their organisation, an openly published address with an offer that fits their role, or an address they gave you.

Is cold email legal in the UAE?

On our reading, not without consent at a mainland company. Two legal guides find no legitimate interest ground in Decree-Law 45 of 2021, one email vendor disagrees, and the official text would not load for us on 20 October 2026, so get a UAE lawyer's written view. The data law sets no fine, but a 2021 cybercrime law sets AED 50,000 to 500,000 for unlawful processing of residents' data.

Is cold email legal under GDPR?

GDPR does not ban it. It accepts direct marketing as a possible legitimate interest if you say where you got the data and stop when the person objects, but national email laws sit on top, and Germany's requires consent even for business inboxes.

Sort your list by the country of each inbox before you write a single subject line. Every row that says consent first is a question for a lawyer, not for a copywriter.

Want those ten checks built in before your first send? Talk to us.

Book a call with Contwre · More from the blog