Is cold email legal? 6 questions B2B founders ask

Is cold email legal? For a B2B SaaS that writes to people at companies, it usually is in the US, the EU and the UK, if you send honest emails, say who you are and stop when someone asks. Canada is stricter: you need consent, and a published work address can count as consent only in narrow cases. The answers below quote each rule from its source.

This post is not legal advice. It points you to the text of each law so you can read it yourself, and it tells you where to ask a lawyer before you send.

1. Is cold email legal in the US without consent?

Yes. CAN-SPAM is an opt-out law. It does not ask you to get permission before the first email. It asks you to follow rules in every commercial email, and the FTC says plainly that the law makes no exception for business-to-business email. A cold email to a founder at a startup is covered in the same way as a newsletter.

The rules from the FTC guide (August 2023, penalties edited January 2024) are short:

• Use true sender details and a subject line that does not mislead.
• Put your valid physical postal address in the message. A registered P.O. box is fine.
• Tell people how to opt out, and keep that way working for at least 30 days after you send.
• Honor each opt-out within 10 business days.
• Stay responsible even when another company sends the emails for you.

The FTC states the cost of a mistake: each separate email in violation is subject to penalties of up to $53,088. That number is per email, not per campaign, which is why the next answer matters.

2. What does one missing footer cost in a worked example?

Take a hypothetical founder of a scheduling tool for dentists. They send 200 cold emails to US clinic owners, and the template has no postal address. Each of the 200 emails breaks the address rule, so the maximum exposure is 200 × $53,088 = $10,617,600. Real fines are set case by case and are often far lower, but the arithmetic shows why the footer is not optional.

The fix costs nothing. Add one line with your address and one line that says how to stop the emails, and check the line in the final template, not the draft. Our guide to keeping cold emails out of spam covers the technical side of the same footer.

3. Does GDPR ban cold email to people in the EU?

No. A work email such as anna@company.com is personal data, so GDPR applies, but it gives you a legal basis other than consent. Recital 47 says that the processing of personal data for direct marketing purposes may be regarded as carried out for a legitimate interest. The same recital ties that interest to the reasonable expectations of the person, so the email must make sense for their job.

Two articles then set your duties. Under Article 21, a person can object at any time, and once they object to direct marketing, you must stop processing their data for it. Under Article 14, when you got the address from somewhere other than the person, you must give them the privacy information at the latest at the time of the first communication. In practice that means a short line in the first email that says where you found the address and links to your privacy notice.

Each EU country also has its own e-privacy law on top of GDPR, and some of these laws are stricter for B2B email. Ask a local lawyer before you start a campaign to one country.

4. Is cold email legal in the UK?

Yes, to companies. The UK regulator says it directly: you can email or text any corporate body, which means a company, a limited liability partnership or a government body. Sole traders and some partnerships count as individuals, so you need their consent or an earlier purchase before you write.

The ICO also calls it good practice to keep a do-not-email list of businesses that opt out and to check new lists against it. Note that the ICO marks this guidance as under review after the Data (Use and Access) Act, so read the current page before you rely on it.

5. Why is Canada different?

Canada's anti-spam law starts from the other side. Section 6 says it is prohibited to send a commercial electronic message unless the person has consented to receiving it, whether the consent is express or implied. The message must also identify the sender and give a way to contact them.

Implied consent covers one case that fits cold B2B email. It applies when the person has conspicuously published the address, did not add a statement that they do not want messages there, and the message is relevant to their business role. An email from a team page to a head of operations about an operations tool can fit. A guessed address does not. The same act sets the maximum penalty at $10,000,000 for a company.

6. What makes a cold email legal everywhere at once?

The rules overlap more than they differ. Write to a person whose job your product helps, at an address they made public, and tell them who you are and how to stop the emails. That meets the core of all four regimes above, except where a local law asks for consent first. The right person matters for a legal reason too: relevance to the role is part of the GDPR expectation test and of the Canadian implied consent rule.

LitePal helps with the relevance part. It finds companies that fit your product, the decision-maker to write to with a checked email, and a drafted first line. You review the list and send from your own account, so the footer and the opt-out stay yours to get right.

Before you send, run this checklist:

• The recipient works at a company, and the email is relevant to their role.
• The subject line and sender name are true.
• The footer has your postal address and a clear way to opt out.
• Opt-outs go on a do-not-email list the same day, well inside 10 business days.
• The first email to an EU contact says where you found the address and links to your privacy notice.
• Canadian contacts published the address themselves, with no request to not be emailed.
• Your follow-up plan stops for every contact who opts out.

A sequence makes the opt-out rule easy to break, because a follow-up can go out after someone asked you to stop. Our rules for how many cold email follow-ups to send assume every opt-out ends the sequence at once.

Want a list of people whose job makes your email relevant? Paste your site into LitePal and get companies that fit, the decision-maker at each one with a checked email, and a first line drafted for you to send.