Cold Email Compliance: CAN-SPAM, GDPR and CASL Basics for B2B

Cold email to businesses is legal in many countries, but every major market has rules about how you do it. Breaking them can mean fines, blocked sending domains and damage to your reputation. This is a general overview, not legal advice. Check the rules for every country you send to.

United States: CAN-SPAM

The CAN-SPAM Act does not require prior consent for commercial email, including B2B cold email. It does require that you:

• Use accurate "From," "To" and routing information
• Write subject lines that are not misleading
• Identify the message as an advertisement where appropriate
• Include a valid physical postal address
• Give a clear way to opt out, and honor opt-outs within 10 business days
• Take responsibility for anyone sending on your behalf

Penalties are assessed per email and can reach tens of thousands of dollars each, so a sloppy campaign can become expensive quickly.

European Union: GDPR and ePrivacy

In the EU, a named work email address is personal data. To email someone at work without consent, you generally need a "legitimate interest," which means your offer must be clearly relevant to their role and business. You must also tell them where you got their data, offer an easy way to object and stop contacting them immediately if they do. Some EU countries have stricter national rules for unsolicited email, so check the rules in each target country.

United Kingdom: UK GDPR and PECR

The UK's PECR rules generally allow unsolicited marketing email to "corporate subscribers," such as limited companies, without prior consent, provided you identify yourself and offer an opt-out. Sole traders and some partnerships are treated like individuals and usually need consent. Named addresses are still personal data under UK GDPR.

Canada: CASL

Canada's Anti-Spam Legislation is stricter. It generally requires consent, but allows "implied consent" when a business has conspicuously published an email address, has not said it does not want unsolicited messages, and your message is relevant to the recipient's business role. Every message must identify you and include an unsubscribe mechanism.

A practical checklist

Wherever you send, these habits keep you on the right side of most rules:

1. Email only businesses where your offer is genuinely relevant
2. Use your real name, company and a physical address
3. Write honest subject lines
4. Include a one-click or one-reply way to opt out, and honor it fast
5. Keep a record of where each contact came from
6. Keep a suppression list so unsubscribed contacts never get another email

Good compliance and good results go together. Relevant, honest emails get more replies and fewer spam complaints. For tips on writing them, see how to cold email local businesses, and for the data side, read is scraping Google Maps legal.