Is Cold Email Legal? Rules for the US, UK, EU and South Africa

This is general information, not legal advice. Rules change and depend on your situation, so check with a lawyer before you send.

Is cold email legal? Usually yes, for business-to-business outreach, but the answer changes with the country you send from and the country your recipient sits in. The United States asks you to be honest and to let people opt out. The United Kingdom splits recipients into companies and individuals. South Africa leans toward consent. This guide walks through each, then covers what every compliant message contains.

The short answer by country

Two ideas run through all of these. A named business email address can identify a person, which brings data protection law into play. And hiring someone else to send for you does not move the responsibility off you.

United States: what CAN-SPAM requires

The FTC's CAN-SPAM compliance guide says the law makes no exception for business-to-business email. It does not require opt-in consent. It sets rules for how you send:

• Header information must be accurate and identify who started the message.
• Subject lines must not be deceptive.
• The message must be identified as an advertisement.
• It must include a valid physical postal address.
• It must give a clear way to opt out of future marketing email.
• You must honor opt-out requests within 10 business days.
• Hiring another company to send your email does not remove your legal responsibility.

The FTC page states that each separate email in violation can be subject to penalties of up to $53,088. We checked that figure on the FTC page on 13 October 2026. It is adjusted over time, so confirm it before you quote it. CAN-SPAM covers email only; state laws and other rules may add requirements, and a lawyer can tell you which apply.

United Kingdom: corporate subscribers vs sole traders (PECR)

The ICO's B2B marketing guidance explains that the PECR rule on email marketing consent does not apply to corporate subscribers, such as companies and LLPs. You can email them without prior consent. You still must not disguise or conceal your identity, and you must give a valid address for the recipient to opt out.

Sole traders and some partnerships are treated as individuals. For them you need either consent, or the soft opt-in, which needs all of these:

• You obtained the contact details during a sale or negotiation of a sale.
• You are marketing your own similar products or services.
• You gave a clear chance to refuse when you collected the details.
• You offer an opt-out in every message.

Cold outreach to a stranger will rarely meet the soft opt-in, because there was no earlier sale. If you cannot tell whether an address belongs to a corporate or individual subscriber, the ICO advises treating it as an individual.

PECR is only half the picture. When an address identifies a named person, such as a name-based work address, the UK GDPR also applies. You need a lawful basis, you must tell people how you use their data, and the ICO describes the right to object to marketing as absolute, so anyone who objects must be suppressed.

European Union: GDPR, legitimate interest and national differences

We have not reviewed primary EU sources for this guide, so we will not give country-by-country rules. What we can say is limited. The GDPR applies to personal data, and a named work email address is personal data. Whether legitimate interest supports a particular B2B campaign is a legal judgment, and member states differ in how they apply the separate rules for electronic marketing. If you are sending into Germany, France or any other member state, take advice from a lawyer who works in that country.

South Africa: what POPIA section 69 says

The text of POPIA section 69 prohibits processing personal information for direct marketing by electronic communication, including email, unless one of two exceptions applies:

• Consent: the data subject has given consent. If you need consent from someone who has not previously refused, you may approach them only once to ask.
• Existing customer: the person is your customer, you got their details while selling them something, you are marketing your own similar products, and they had a free, easy chance to object then and with each message.

Every direct marketing message must identify the sender and give an address where the recipient can ask for the messages to stop.

The Information Regulator has also issued a Guidance Note on Direct Marketing. A DLA Piper summary says the guidance is advisory, that POPIA and the Regulations prevail where they conflict, and that you must keep a database of people who have withheld consent.

The B2B question is unresolved in these sources. Section 69 does not mention businesses or juristic persons by name, and the DLA Piper summary does not address business-to-business marketing. That leaves a real gap about cold email to company addresses. A cautious reading treats a named person's work address as personal information, but we cannot tell you how a regulator or court would see it. Get a South African lawyer's view before you send.

What every compliant cold email contains

Across these regimes, the same habits keep you on safe ground:

• An accurate From name and address, and a subject line that matches the content.
• A clear statement of who you are and why you are writing.
• A physical postal address in the message.
• A working opt-out in every email, honored well inside the 10 business days the US allows.
• One suppression list shared across all mailboxes and campaigns, so no one gets a second email after opting out.
• A record of where each contact came from and why you chose to contact them.
• No deception in how mail is delivered (see the next section).

Data quality is part of compliance. A list full of wrong or stale contacts means you email the wrong people and miss opt-outs, which is why bad data is a legal risk as well as a deliverability one. Sending only to people with a real reason to hear from you, as in our guide to signals over guessing, makes complaints less likely. Our acceptable use policy covers what we expect from campaigns run on our infrastructure.

Why legal is not the same as welcome

A message can be legal and still be unwelcome to mailbox providers. The M3AAWG position on cold email (November 2025) defines cold email as unsolicited email from identifiable senders to people with no prior relationship. It calls deceptive and misleading delivery methods used to send it an abusive practice, and names lookalike domains and multiple sending accounts used to avoid spam filters. It also lists reputation signals that point to cold email: spam traps, blocklisting, high unknown-user hard bounces and high complaint rates, and it calls attempts to artificially simulate subscriber engagement unacceptable.

The takeaway is practical. Compliance with the law does not protect your sender reputation. Keep lists clean, keep complaint rates low, and do not build your setup around evading filters. Our guide to the Gmail and Yahoo bulk sender requirements covers the numbers mailbox providers watch.

How Realtrix handles this

Realtrix defines the ideal customer profile before any email is written and validates every contact record before it enters a sequence, as described on the B2B lead generation service page. Legal responsibility for a campaign still sits with the sender, so this guide is a starting point and a lawyer should review your specific setup.

Frequently asked questions

Is cold email legal in the UK?

Often yes for company addresses. PECR does not apply its consent rule to corporate subscribers, so you can email them without prior consent if you identify yourself and give a valid opt-out. Sole traders and some partnerships count as individuals, who need consent or the soft opt-in. If you cannot tell which applies, the ICO says to treat the recipient as an individual.

Is cold email legal in the US?

Yes, if you follow CAN-SPAM. The law does not require prior consent. It requires accurate header information, honest subject lines, ad disclosure, a valid postal address and a clear opt-out that you honor within 10 business days. The FTC says there is no exception for business-to-business email, and hiring another company to send does not transfer your responsibility.

Is cold email legal in Europe?

It depends on the country. The GDPR applies when you process personal data, and member states apply the separate email-marketing rules differently. We have not reviewed primary EU sources for this guide, so treat it as a pointer only. Take advice from a lawyer in each member state where your recipients are based.

Is cold email legal in South Africa?

POPIA section 69 prohibits electronic direct marketing without consent, with an exception for existing customers. The sources we read do not say how that applies to emails sent to businesses, so the B2B position is unresolved. Get advice from a South African lawyer before you send to recipients there.

Does GDPR allow B2B cold email?

GDPR does not ban it outright, but a named work email address identifies a person, so data protection law applies. You need a lawful basis, must tell people how you use their data, and must respect objections. Whether legitimate interest holds up for a given campaign is a legal question, so check with a lawyer in the relevant country.

Related guides

• Bad data: the silent killer of cold email
• Signals over guessing: who to email and when
• Gmail and Yahoo bulk sender requirements for cold email