Cold Email Compliance: GDPR & CAN-SPAM Guide (2026)

Yes, cold B2B email is legal in most jurisdictions when done correctly.

CAN-SPAM (US): Cold email is explicitly permitted. Does not require prior consent. Must include opt-out mechanism, physical address, and accurate sender information.

GDPR (EU/UK): B2B cold email is generally permitted under the "legitimate interest" basis. Must be relevant to the recipient's professional role, include opt-out, and process data minimally.

CASL (Canada): Stricter. Requires implied or express consent. B2B is possible under the "conspicuously published" exception for publicly listed business contacts.

Here is how the major regulations compare:

The key: cold email is legal. Spam is not. The difference is compliance and relevance.

All cold emails to US recipients must:

1. 1Accurate From line. Sender name and email must identify your business
2. 2Honest subject line. Cannot be deceptive or misleading
3. 3Physical address. Include a valid physical postal address
4. 4Unsubscribe mechanism. Clear, one-click opt-out that works within 10 business days
5. 5Honor opt-outs. Process within 10 business days, no re-emailing opted-out contacts
6. 6Identify as ad. If the email is primarily promotional, it must be identifiable as such

Penalty: Up to $50,120 per violation.

Under GDPR, B2B cold email is permissible under legitimate interest if:

1. 1Relevant to recipient's role. You are contacting them about something related to their professional function
2. 2Data minimization. Only collect and use necessary data (name, business email, company)
3. 3Easy opt-out. Clear unsubscribe in every email
4. 4Privacy notice accessible. Link to your privacy policy
5. 5Legitimate interest assessment. Document why your outreach serves a legitimate business purpose
6. 6Right to erasure. Delete contact data upon request

Key distinction: GDPR applies to personal data of EU/UK individuals, even in B2B contexts.

Use this checklist for every cold email campaign. Each item is a legal requirement under at least one regulation:

Automate as much as possible. At scale, manual compliance is error-prone. Your sequencer should handle unsubscribes, and InfraGuard monitors for complaint-based issues automatically.

"Cold email is illegal under GDPR." False. B2B cold email under legitimate interest is permitted. Personal (B2C) cold email requires consent.

"I need consent for every cold email." False under CAN-SPAM. True for CASL. Depends on jurisdiction.

"Unsubscribe links hurt deliverability." False. They are required by law and actually improve deliverability by reducing spam complaints.

"If they do not reply, I can keep emailing." Technically legal under CAN-SPAM (until they opt out), but harmful to reputation. Limit follow-ups to 3-4 per contact.