Cold Email Is Legal, But the Rules Change at Every Border

Cold email is legal in the United States, the United Kingdom, the European Union, and Canada, but only when you meet each jurisdiction's specific conditions. The catch is that "the conditions" look nothing alike across those markets, and treating them as interchangeable is how senders end up fined.

Three consent models run the global map. The US operates on an opt-out basis under CAN-SPAM, meaning you can email first and let recipients unsubscribe afterward. Canada flips that with CASL, an opt-in regime where consent must exist before the send. The EU and UK sit in between, requiring a documented lawful basis, usually legitimate interest for B2B outreach, before any email leaves your outbox. Compliance research confirms this divergence is the single biggest source of confusion for senders expanding internationally.

Here's where most guides lead you astray: there is no single EU answer. The ePrivacy Directive's Article 13(5) limits the consent rule to natural-person subscribers, which leaves B2B rules to each member state. That one clause is why cold email is workable in Ireland but requires prior consent in Poland and Germany. As one jurisdiction comparison puts it plainly, a cold email that is legal in France is illegal in Germany. If your campaigns target Europe, you either build country-specific workflows or default to the strictest standard for every prospect.

A few specifics worth keeping in your head:

• Germany requires prior opt-in for B2B email under UWG § 7 Abs. 2 Nr. 2, with no corporate exception.
• Poland's PKE (Article 398, effective November 10, 2024) covers "a subscriber or end user", companies included, and demands prior consent.
• The UK carves out a corporate subscriber exception under PECR regulation 22, so unsolicited email to a corporate address is allowed if content is role-relevant and a valid opt-out is provided. Sole traders and partnerships still count as individuals.

Penalties attach per email, not per campaign, which makes scale a multiplier on risk. CAN-SPAM fines reach up to $53,088 per violating email under 16 CFR 1.98, GDPR fines hit €20 million or 4% of global annual turnover, and CASL penalties reach $10 million per violation for organizations. When you run campaigns across borders, a single misstep on consent in the wrong jurisdiction can compound fast.

The practical takeaway for any team running outbound: segment by jurisdiction from day one, document your lawful basis before the first send, and treat the EU as twenty-seven separate markets rather than one. That's the difference between a compliant program and a liability. If you're evaluating a growth partner, ask how they handle country-specific consent, because the answer reveals whether they understand the rules or just the volume.

The EU Has 27 Answers, Not One

Most guides treat "EU cold email law" as one rule. It's actually twenty-seven, because the directive that sets the EU's baseline consent rule deliberately steps out of the way for business recipients.

Here's the mechanism. The ePrivacy Directive's Article 13(1) requires prior consent for unsolicited email. But Article 13(5) limits that consent rule to subscribers who are natural persons. For everything else, including most B2B email, each member state writes its own rules. That one clause is why B2B cold email is workable in Ireland and requires prior consent in Germany and Poland. There is no single EU answer, and any guide that gives you one has skipped 13(5).

The practical consequence is stark: a cold email that is legal in France is illegal in Germany. If you're prospecting across Europe, you either build country-specific workflows or default to the strictest standard for all EU contacts.

So what do the strictest states actually require?

Germany requires prior consent with no B2B exception. The rule lives in its unfair-competition law, UWG Section 7, which refers to "the addressee" without carving out companies. Germany effectively requires prior opt-in for B2B email regardless of what GDPR allows, with fines up to €300,000 per case under UWG Section 20.

Poland takes the same line. Article 398 of its PKE (Prawo komunikacji elektronicznej, effective November 10, 2024) covers "a subscriber or end user," and that includes companies. No B2B exception there either.

Ireland, by contrast, leaves room for workable B2B outreach, which is why so many EU-focused sales teams route campaigns through it.

The UK is no longer in the EU but follows a similar structure with a clearer escape hatch. Under PECR regulation 22, the consent requirement applies only to individual subscribers. Corporate subscribers fall outside it, so unsolicited email to a company address is allowed if you meet a few conditions:

• You send to a corporate email address, not a personal one like [email protected]
• The content is relevant to the recipient's professional role
• You clearly identify yourself as the sender
• You include a valid opt-out

One trap worth flagging: sole traders and partnerships count as individuals under PECR, so the consent rule applies to them. A two-person consultancy can look corporate on paper and still be legally treated like a consumer.

This fragmentation is exactly why jurisdiction-aware targeting matters more than volume. At Worqd, our B2B outreach work is built as personalized, permission-aware contact to relevant accounts, which means knowing where the recipient sits before the first send. A template blast ignores 13(5) entirely; a researched email to the right role at a well-matched company, with a clean opt-out, is what survives both the regulators and the mailbox providers.

One last note: none of this is legal advice. Rules shift, and penalty ceilings have been moving (the UK raised its PECR ceiling to £17.5 million or 4% of turnover in February 2026, per recent analysis). For a live campaign, run your targeting past a qualified attorney in each market you touch.

The Penalties Attach Per Email, Not Per Campaign

Here's the part most senders miss: regulators don't fine campaigns. They fine emails. Each one.

Under CAN-SPAM, the penalty reaches up to $53,088 per violating email, a figure set January 17, 2025 under 16 CFR 1.98. If you send one campaign to 1,000 addresses and every message fails the opt-out rule, that's not one violation. It's 1,000 of them. The math gets ugly fast, which is why a single careless blast can theoretically put a seven-figure liability on the table. You'll see older figures floating around, like $51,744 or "over $43,000" per violation, in some compliance guides. Those are superseded numbers; the $53,088 figure is the current one, and aggravated cases can climb to $2 million.

The EU works differently but hits just as hard. GDPR fines reach up to €20 million or 4% of global annual turnover, whichever is higher. In practice, cold email violations typically land between €10,000 and €500,000, according to multi-jurisdiction research, but the ceiling matters when regulators decide to make an example of someone. Amazon learned that in 2021 with a €746 million fine.

Canada's CASL is arguably the harshest of the three: up to $1 million per violation for individuals and $10 million for organizations under section 20. The CRTC issued a $50,000 penalty against a single individual sender in August 2025, so enforcement isn't theoretical.

A few things worth knowing about how these penalties actually attach:

• Every email in the send counts separately. One bad template multiplied by your list size equals your exposure.
• The violation is often something small: a missing physical address, an opt-out link that doesn't work, or honoring unsubscribes after the 10-business-day window.
• Opted-out addresses can't be sold, leased, exchanged, or transferred, and under GDPR they need to come out of your CRM entirely.
• If you outsource outreach to an agency or contractor, you're still on the hook. The law doesn't care whose keyboard sent it.

Sources disagree on some figures, so treat exact numbers as ranges. Different guides cite different CAN-SPAM amounts (usually because they quote older inflation adjustments), and some describe GDPR's two-tier structure, where lesser violations cap at €10 million or 2% of revenue, while only serious infringements reach the €20 million/4% ceiling.

The practical takeaway: build your compliance around the per-email math, not the per-campaign math. That means a fast, automated opt-out (the single biggest risk reducer, since Carrefour was fined €3.05 million just for failing to process unsubscribe requests), verified data sources, and jurisdiction-aware sending. It's the standard we hold ourselves to at Worqd, where every campaign is permission-aware outreach to relevant accounts, sized and scoped so the penalty math never becomes your problem.

One last note: none of this is legal advice. Penalty figures shift with inflation adjustments and new legislation, so confirm current amounts with an attorney before you hit send on anything large.

Mailbox Providers Enforce Harder Than Regulators Do

Here's the part most guides skip: the regulators aren't your biggest problem. Your inbox provider is. Recent analysis of cold email compliance makes the point bluntly: mailbox providers now police cold email harder than most regulators do, and they enforce through throttling and blocking, not warnings.

Google's threshold is the number to memorize. Your spam complaint rate needs to stay under 0.1%, and you should never approach 0.3%. On a campaign of 10,000 emails, that means fewer than 10 people can mark you as spam before your deliverability starts collapsing. Microsoft added its own rule effective May 5, 2025: any sender pushing more than 5,000 emails per day must have SPF, DKIM, and DMARC configured. If authentication sounds like an IT detail, it's the difference between landing in the inbox and vanishing.

The unsubscribe header is where it gets fiddly. Microsoft only honors the mailto form of one-click unsubscribe, while Google accepts the URL form. The safe answer is to send both headers on every campaign. It costs you nothing and keeps both providers happy.

Then there's the layer almost nobody talks about: your data, not your copy, causes most compliance failures. As one practitioner put it, more compliance problems start with bad data than with bad emails. Buying lists from data brokers without verifying how those addresses were collected can itself be a violation, even if your email content is flawless. This is why we treat data sourcing as a compliance decision at Worqd, not a procurement one. Permission-aware outreach to relevant accounts starts with knowing where every address came from.

A practical checklist before any cold campaign goes live:

• SPF, DKIM, and DMARC records set up and verified, especially above the 5,000 emails/day line
• Complaint rate monitoring against Google's 0.1% ceiling
• Both mailto and URL one-click unsubscribe headers in place
• Documented sourcing for every contact on your list

None of this replaces the legal requirements covered earlier. It sits on top of them. You can be fully CAN-SPAM compliant and still get your whole domain throttled by Gmail because three people hit "report spam." The providers don't care about your intent; they care about what their users do with your email.

If you'd rather not learn these thresholds through a blocked domain, book a growth call and we'll walk through how your outreach infrastructure holds up.

Building a Compliant Cold Email Program That Still Books Calls

Knowing the rules is one thing. Building a cold email program that follows them every day, across every market you send to, is where most teams slip up. The fines go to companies that had a process and let it break.

Start with segmentation. Because ePrivacy Directive Article 13(5) leaves B2B rules to each EU member state, there is no single EU answer. A cold email that is legal in France is illegal in Germany, where prior consent is required with no B2B exception, and Poland's PKE (effective November 2024) takes the same position. You have two options: build country-specific workflows, or default to the strictest standard and apply German-level consent requirements to all EU prospects. The second option costs you some volume. The first can cost you millions.

Next, automate your opt-out. This is the highest-leverage investment you can make. CAN-SPAM requires opt-outs to be honored within 10 business days, and the mechanism must stay active for at least 30 days after the send. Carrefour paid 3.05 million EUR for failing to process unsubscribe requests. The lesson is simple: as one analysis puts it, "the single biggest risk reducer is a fast, reliable opt-out. Automate it so no request is ever missed." When someone opts out, remove them everywhere, including your CRM, and never sell or transfer that address.

Then vet your data. More compliance problems originate from bad data than from bad emails. Buying lists from data brokers without verifying how addresses were collected can itself be a violation, and one source is blunt about it: never buy lists of email addresses. For B2B outreach, stick to professional addresses (never personal ones like [email protected]), keep content relevant to the recipient's role, and document where every contact came from. This is the core of permission-aware outreach, and it's how we approach it at Worqd: personalized messages to relevant accounts, the opposite of a template blast.

Your infrastructure matters as much as your legal posture. Mailbox providers now police cold email harder than most regulators do. Google requires spam complaint rates under 0.1% (never reaching 0.3%), and as of May 5, 2025, Microsoft requires SPF, DKIM, and DMARC for anyone sending over 5,000 emails per day. Send both mailto and URL forms of the one-click unsubscribe header, since Microsoft honors only the mailto form and Google accepts the URL form. Warm up new accounts gradually, starting with 10-20 emails per day.

Finally, put your reasoning on paper. A documented legitimate interest assessment shows why each campaign targets a specific, relevant decision-maker. A pitch to a well-matched contact usually passes the test. A blast to a purchased list almost never does. Given that roughly 35% of GDPR fines (over 2 billion EUR) stem from consent violations, and only about 24% of email marketers fully comply with current standards, documented compliance is a genuine competitive edge.

None of this is legal advice. For campaigns with real volume or regulatory exposure, run your program past an attorney before you hit send.