Is cold email legal? CAN-SPAM, GDPR, CASL and Gmail's rules in plain words.

The short version

Four habits cover most of it. Say who you are. Write only to people for whom the message is relevant. Give a clear way to opt out. Honor it fast. These are also the habits that keep you out of the spam folder, which is why compliance and deliverability turn out to be the same job.

United States: CAN-SPAM

The FTC lists the main requirements. Your sender details must be accurate, your subject line must match the message, you identify the message as an ad, you include a valid physical postal address, and you give a clear way to opt out. You must honor an opt out within 10 business days, and the opt out has to keep working for at least 30 days after you send. If an agency or a tool sends for you, you are still responsible for what goes out.

Two things people get wrong. First, CAN-SPAM does not ask for consent before you send. It asks you to stop when told. Second, business email is not exempt. The FTC says the law makes no exception for business to business messages. The penalty is up to $53,088 for each violating email.

United Kingdom: PECR

The UK regulator draws a line by recipient type. Corporate subscribers, meaning limited companies, LLPs and government bodies, can be sent marketing email without specific consent. Sole traders and some partnerships count as individuals, so you need their consent or a prior customer relationship. In every case you must be clear about who you are, include a valid contact address, and offer a simple way to opt out. Data protection law also applies to the personal details on your list, and most B2B senders rely on legitimate interests as their lawful basis, which you should be able to explain.

European Union

EU countries set their own email marketing rules, and several are stricter than the UK or the US. Don't guess. Check the country of every recipient before you send.

Canada: CASL

Canada's law starts from consent, with a business friendly exception. You may treat consent as implied when the person published their email address publicly, the page does not say they refuse unsolicited messages, and your message is relevant to their role. An address found only through queries to a private database does not count, and neither does an address a third party sells you. Every message must identify you and include an unsubscribe method that stays valid for at least 60 days, and you must act on opt outs no later than 10 business days after you receive them.

The rules that bite first: Gmail and Yahoo

In practice, inbox providers punish you long before a regulator does. Google says every sender to personal Gmail accounts must authenticate their mail and make unsubscribing easy. Bulk senders, meaning about 5,000 or more messages a day to Gmail, face more. They need SPF, DKIM and a DMARC record, a one click unsubscribe on marketing mail, and a spam rate below 0.1% that never reaches 0.3%. Bulk status is counted per primary domain and, once earned, it does not go away. Yahoo introduced matching rules.

Our advice is to treat these as your floor even at low volume. You can't see which side of the line you are on until you've crossed it. The deliverability guide shows how to set it up.

A checklist before you send

• A working opt out and a suppression list that applies across every campaign and every mailbox.
• Your real name, company and a valid address in each email.
• A subject line that matches what is inside.
• Recipients chosen because the message is relevant to their role.
• The country of every recipient known before the send.
• SPF, DKIM and DMARC set up on every sending domain.
• A clear owner for the list and for replies, even when an agency sends.

General information, not legal advice. Rules change and depend on your situation, so check with a lawyer for anything high stakes.

Questions people ask