Is Cold Email Legal? Country-by-Country Guide (US, UK, EU, Germany, UAE, Canada, India)

Short answer: B2B cold email is legal in many countries, but the conditions depend on where the recipient is. The US allows it with an opt-out and a postal address (CAN-SPAM). The UK allows it to company employees, not sole traders, without consent. The EU varies by country, Germany generally requires prior consent, Canada requires consent or a narrow implied consent, and the UAE and India lean toward consent.

Not legal advice. I run an outbound agency, not a law firm. This guide explains the rules in plain English, links to the official sources, and reflects what I found when I checked them on 9 October 2026. Laws and guidance change, and how they apply depends on your facts. Before a large campaign into a new market, read the regulator's page yourself and talk to a lawyer in that country.

Most "is cold email legal?" answers start with the sender's country. That is the wrong place to start. The rules that apply are mostly the rules where your recipient is. A company in Bengaluru emailing a buyer in Toronto deals with Canadian law. A US startup emailing a CFO in Munich deals with German law. So the honest answer to "is cold email legal?" is: legal where, and to whom?

The four-question test I run before every campaign

Before we send a single email for a client, we answer four questions for each country on the list. If you cannot answer one, stop and find out.

1. Where is the recipient? Segment the list by country. Each country gets its own rules, and sometimes its own copy.
2. Is the address a company's or a person's? Several laws treat a limited company differently from a sole trader or a consumer, and a generic address (info@) differently from a named one (jane.smith@).
3. Is the message relevant to their job? Relevance to the recipient's role is a condition in several regimes, including Canada's implied consent and France's B2B rule. It is also simply good outbound.
4. Can you prove where the address came from and honor an opt-out? You need a source record for each contact and a suppression list that every sending tool and inbox respects.

Comparison table: cold email rules by country

"Yes" in the third column never means "anything goes". It means you do not need permission before the first email, provided you meet every other condition in that row and the country section below.

United States: allowed, with rules on every email

The CAN-SPAM Act does not require consent before you email someone. But the FTC's compliance guide is direct that the law makes no exception for business-to-business email. Every commercial message must:

• use accurate "From", "To", "Reply-To" and routing information;
• have a subject line that is not deceptive;
• identify the message as an ad (a clear commercial email usually does this by its nature, but do not disguise it);
• include a valid physical postal address;
• offer a clear way to opt out, honor opt-outs within 10 business days, and keep the opt-out working for at least 30 days after sending.

The FTC also says you cannot contract away responsibility: if an agency sends on your behalf, both of you can be held responsible. Each email that breaks the law can cost up to $53,088 according to the FTC's guide. If you are evaluating partners, our guide to a cold email agency in the USA covers what to ask, and our US lead generation page explains how we run US campaigns.

United Kingdom: companies yes, sole traders no

The UK splits recipients into two groups under the Privacy and Electronic Communications Regulations (PECR):

• Corporate subscribers (limited companies, LLPs, Scottish partnerships, some government bodies). The ICO says PECR's email marketing rule does not apply to them, so you can email employees without prior consent. You must still say who you are and give a valid address to opt out. The ICO recommends honoring their opt-outs and keeping a "do not email" list.
• Individual subscribers (sole traders, and partnerships in England, Wales and Northern Ireland that are not LLPs). These are treated like consumers: you need consent, or the "soft opt-in" for existing customers.

If you cannot tell which group someone is in, the ICO's guidance is to treat them as an individual. UK GDPR also applies to named business addresses, so you need a lawful basis (usually legitimate interests) and must stop immediately if someone objects. Fines got bigger this year: the Data (Use and Access) Act 2025 raised the maximum for PECR direct marketing breaches to the UK GDPR level of £17.5 million or 4% of worldwide turnover. The ICO notes its guidance is under review because of that Act, so check the current page before you rely on details. For buyers, see our page on choosing a B2B lead generation agency in the UK.

European Union: two laws, 27 answers

Two layers apply to emailing someone in the EU:

1. The ePrivacy Directive (Article 13), implemented by each country's own law. It requires prior consent for email marketing to natural persons (with a soft opt-in for existing customers) and leaves each country to decide how to protect legal persons. That is why B2B rules differ by country.
2. GDPR, which applies whenever you process a named person's data, including a work email. Recital 47 says processing for direct marketing may be a legitimate interest, which is the basis most B2B senders use, backed by a written legitimate interests assessment. Article 14 requires you to tell people where you got their data, at the latest at the first communication. Article 21 gives an absolute right to object to direct marketing.

National examples show the spread. In France, the CNIL allows B2B email prospecting without prior consent if the message relates to the recipient's professional role and they can opt out easily. In Germany, as below, the answer is generally no. Check each country before you add it to a campaign. Our UK and Europe page explains how we handle multi-country lists.

Germany: assume you need consent

Section 7 of Germany's Act against Unfair Competition (UWG) treats advertising by email without the recipient's prior express consent as an unreasonable nuisance, and this applies to business recipients too. Competitors and consumer associations can bring claims, on top of GDPR enforcement. There is a narrow existing-customer exception. In short: plain cold email to German prospects is high risk. We cover the details, and what B2B senders do instead, in is cold email legal in Germany?

Canada: consent first, with a narrow B2B route

Canada's Anti-Spam Legislation (CASL) applies to commercial electronic messages sent to or accessed from computers in Canada. You need consent before sending. Consent can be express or implied, and two implied routes matter for B2B:

• Existing business relationship, for example a purchase or inquiry within set time limits.
• Conspicuous publication: the person published their own address (for example on their company website), did not add a statement that they do not want unsolicited messages, and your message is relevant to their business role. Canadian regulators and courts have treated this narrowly. Addresses scraped from third-party directories or bought on a list do not qualify on their own, and you carry the burden of proving consent.

Every message must identify the sender, include contact details, and contain an unsubscribe mechanism that is processed within 10 business days. Administrative penalties can reach $10 million CAD per violation for an organization and $1 million for an individual.

UAE: consent-led and still settling

The UAE has three layers that touch email marketing:

• The federal Personal Data Protection Law (Federal Decree-Law No. 45 of 2021), which covers personal data of people in the UAE, is built mainly on consent, and gives people a right to object to direct marketing. The status and detail of its executive regulations have been the subject of debate among practitioners, so check the current position.
• The TDRA's rules on unsolicited electronic communications, which apply to messages with a "UAE link" (sent from, received in or accessed in the UAE). Most enforcement news concerns SMS and calls, but email is within scope.
• Free zones with their own data laws, mainly DIFC and ADGM, which are excluded from the federal PDPL and have their own rules.

B2B cold email is common in the UAE, but the legal footing is less clear than in the US or UK, and the direction of travel is consent. My practical view: keep UAE campaigns tightly targeted to role-relevant decision-makers, use company addresses where possible, honor every opt-out immediately, and get local legal advice before scaling. We cover the market itself in lead generation companies in Dubai and the UAE and on our UAE and Middle East page.

India: no anti-spam law for email, DPDP coming in

India has no dedicated law on unsolicited commercial email. The TRAI telemarketing rules focus on calls and SMS. The bigger change is the Digital Personal Data Protection Act 2023. Its rules were notified in November 2025 with a staggered start: some parts at once, others after 12 and 18 months, so most duties on notice, consent and data principal rights arrive between late 2026 and 2027. Check the exact dates in the official notification.

The Act is consent-led and has no general "legitimate interests" basis like GDPR. It does exclude personal data that the person made, or caused to be made, publicly available themselves, which may cover some business contact details, but not addresses bought from list vendors. Penalties go up to ₹250 crore. For Indian teams selling abroad, remember the first point of this guide: your buyers' countries' rules apply too. More on our India page.

One email that travels: the strictest-common-denominator setup

If a campaign covers several countries (excluding Germany and Canada, which need consent workflows of their own), build every email to the strictest rules on the list. Then you are not relying on someone remembering which variant goes where.

[Your full name]
[Job title], [Company legal name]
[Street address, City, Postcode, Country]

You're receiving this because you're listed as [role] at [Company] and this relates to your work. We found your details at [source, e.g. "your company website"].
Don't want to hear from us? Reply "unsubscribe" or click here: [unsubscribe link]. We'll remove you right away.
Privacy notice: [link to your privacy notice]

For each country on the list:
[ ] Recipient country identified for every contact
[ ] Rule for that country checked on the regulator's site (date: ____)
[ ] Company vs individual / sole trader checked (UK)
[ ] Consent route documented (Canada, Germany, and others that require it)
[ ] Legitimate interests assessment written (UK / EU)
[ ] Source of each contact recorded
[ ] Message relevant to the recipient's role
[ ] Footer: name, company, postal address, opt-out, privacy link
[ ] Subject line honest
[ ] Suppression list loaded into every sending tool and inbox
[ ] Opt-outs processed within 10 business days or faster (aim: same day)
[ ] Agency contract states who is responsible for compliance

Compliance and deliverability overlap more than people think. Mailbox providers watch complaints and opt-outs too, so the same habits protect your sender reputation. Set up authentication first (see what DMARC, SPF and DKIM are) and check your domain with the free email DNS checker. Then write copy that is relevant by design: our 21 B2B cold email templates all include an opt-out line.

Records to keep, wherever you send

A CRM that captures every reply and opt-out in one place makes this much easier; our Tailr CRM pulls replies from the main sending tools into one record per lead. If you hire an agency, ask how it handles these records; it is question 11 in our guide on how to choose a lead generation agency. For more on the craft side, browse the cold email hub.

Bottom line

Cold email is legal in more places than people fear and fewer places than people assume. In the US and UK you can email company employees without consent if you identify yourself and make opting out easy. In the EU it depends on the country, with Germany at the strict end. Canada needs consent, the UAE and India are moving toward consent. Run the four-question test, use the strictest footer, keep records, and get local advice before scaling. To see how we run compliant outbound for clients, see our lead generation service and pricing.

This article is general information, not legal advice. Checked against the sources below on 9 October 2026.

Sources

• United States: FTC, CAN-SPAM Act: A Compliance Guide for Business (no B2B exception, requirements, penalty up to $53,088 per email; checked 2026-10-09)
• United Kingdom: ICO, Business-to-business marketing (checked 2026-10-09); PECR fine increase under the Data (Use and Access) Act 2025: Addleshaw Goddard, Data (Use and Access) Act 2025: top 7 changes (law firm summary)
• European Union: ePrivacy Directive 2002/58/EC, Article 13; GDPR (Regulation 2016/679), Recital 47 and Articles 14, 21 and 83
• France: CNIL, rules for electronic communications to prospects and customers (in French)
• Germany: UWG section 7, Unzumutbare Belästigungen (in German)
• Canada: Government of Canada, Canada's anti-spam legislation; CASL, full text; conspicuous publication in enforcement: Bennett Jones, CRTC on conspicuous publication (law firm summary)
• UAE: Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data; Telecommunications and Digital Government Regulatory Authority (TDRA); background on spam and marketing rules: Mondaq, communications with customers in the UAE (law firm summary)
• India: MeitY, Digital Personal Data Protection Act 2023 (PDF); DPDP Rules 2025 and staggered commencement: Mondaq, DPDP Rules 2025 notified (law firm summary)

About the author

Subhendu J Shawn is the founder of B2BXclusive, a B2B outbound sales and lead generation agency, and the creator of Tailr CRM. His experience spans American Express and Amazon, and he has helped 50+ B2B companies build pipeline across the US, Europe, the Middle East and India. All articles by Shawn · Follow on LinkedIn