Cold Email Compliance Guide

Yes, cold email is legal in most countries — including the United States, United Kingdom, Canada, and the EU — as long as you follow the applicable anti-spam regulations. It is not the act of sending an unsolicited email that is illegal; it is the failure to follow specific requirements that creates legal risk.

CAN-SPAM is the primary US anti-spam law. It applies to all commercial email messages, including cold email. Violations can result in fines of up to $46,517 per email.

CAN-SPAM Requirements

• Do not use deceptive subject lines — they must accurately represent the email content
• Identify the message as an advertisement (if applicable)
• Include your valid physical postal address
• Tell recipients how to opt out of future emails
• Honor opt-out requests within 10 business days
• Do not send email after someone has opted out
• Monitor what third parties are doing on your behalf (your email vendor)

GDPR is stricter than CAN-SPAM and applies to any email sent to individuals in the EU, regardless of where you are located. Cold email under GDPR requires a lawful basis.

Lawful Bases for Cold Email

GDPR Requirements for Cold Email

• You must have a legitimate interest basis for contacting the individual
• The email must be relevant to their professional role
• You must identify yourself clearly (who you are and why you are contacting them)
• You must provide a clear way to opt out
• You must honor opt-out requests immediately
• You must be able to demonstrate your legitimate interest if challenged

GDPR also gives individuals the right to access, rectify, and erase their personal data. If someone asks what data you hold about them, you must respond.

CASL (Canada's Anti-Spam Legislation) is one of the strictest anti-spam laws in the world. It requires express consent for commercial email, with limited exceptions for B2B outreach.

• Express consent is generally required for commercial email to individuals
• Implied consent exists for existing business relationships (within 2 years of last transaction)
• Implied consent exists for conspicuous publication of email (with conditions)
• All emails must include sender identification, contact info, and an unsubscribe mechanism
• Penalties can reach $10 million per violation for organizations

CCPA (California Consumer Privacy Act) applies to businesses that collect personal information from California residents. While it primarily focuses on data collection and privacy rights, it affects cold email in how you obtain and manage prospect data.

• You must disclose what personal data you collect and how you use it
• California residents can request deletion of their personal data
• You must honor opt-out requests (Do Not Sell My Personal Information)
• Privacy policy must be accessible and transparent

Regardless of which regulations apply to you, here is the practical checklist that covers the core requirements everywhere:

• Include your company name and physical mailing address in every email
• Use accurate From, To, and Reply-To header information
• Provide a clear opt-out mechanism (reply with 'unsubscribe' or an unsubscribe link)
• Honor opt-out requests within 10 business days
• Never email someone who has opted out
• Maintain a suppression list of opted-out addresses
• Do not use deceptive subject lines
• Keep records of your legitimate interest basis (for GDPR)
• Review your compliance quarterly