Is cold email legal? B2B rules by country (2026)

Short answer It depends on where the recipient is, not where you are. B2B cold email is allowed in the US (with CAN-SPAM rules) and to corporate addresses in the UK. Most of the EU allows it with care under GDPR’s legitimate interest, but Germany and Austria generally require consent, as do Canada and Australia (with narrow exceptions). India’s DPDP Act has no legitimate-interest basis from 13 May 2027, and Singapore requires an <ADV> label on bulk unsolicited email. This is general information, not legal advice.

What are the rules in each country?

Where	B2B cold email	What it means for you
United States	Allowed	CAN-SPAM: truthful sender and subject, identify the message as an ad, include a valid physical postal address and a working opt-out, and honour opt-outs within 10 business days.¹
United Kingdom	Allowed to companies	PECR’s consent rule doesn’t apply to corporate subscribers, but you must not hide your identity and must give a valid address to opt out. Sole traders and some partnerships count as individuals: consent or a previous customer relationship needed.²
EU, most countries	Varies	GDPR legitimate interest plus each country’s ePrivacy law. Document your reasoning, tell people where you got their data,³ and honour objections at once. Check each member state.
Germany	Consent	Prior consent generally needed even for B2B email advertising (§7 UWG). Don’t cold-email here without legal advice.⁴
Austria	Consent	Direct-marketing email without prior consent isn’t permitted for businesses or consumers, apart from narrow existing-customer exceptions (TKG 2021).⁵
Canada	Consent	CASL generally needs consent. Consent can be implied if the address was conspicuously published, without a “no unsolicited messages” statement, and your email is relevant to their role.⁶
Australia	Consent	The Spam Act needs consent, B2B included. It can be inferred from a conspicuously published work address if your email is about their role and they haven’t said no.⁷
India	Changing	DPDP Rules phase in, with most obligations from 13 May 2027.⁸ The Act has no legitimate-interest basis, so outreach will generally need consent unless an exemption applies.⁹
Singapore	Allowed, with labels	Unsolicited commercial email sent in bulk must carry `<ADV>` at the start of the subject line, an unsubscribe facility and accurate sender details.¹⁰

Which country’s law applies to my email?

The recipient’s. A founder in Bengaluru emailing a prospect in Berlin is subject to German rules for that email, and a US agency emailing Toronto is subject to CASL. If you know where the person sits, use that; if you only know the company’s country, use that and stay conservative.

What should every cold email include, everywhere?

A real sender who exists and can reply, under your real company name.
An honest subject line. No fake “Re:” or “Fwd:”, and nothing that pretends to be internal mail. Misleading subjects are banned under CAN-SPAM.¹
Your company name and postal address in the signature.
An easy way out: a plain line such as “Not relevant? Reply ‘no’ and I won’t follow up”, plus a List-Unsubscribe header if your tool supports it.
Business addresses about business problems only, never personal inboxes.
An honest answer when someone asks where you got their details. In the UK and EU you must be able to tell them.³
Immediate, permanent removal for anyone who asks.

What does “identify it as an ad” mean in practice?

The FTC gives senders “a lot of leeway” in how, but the disclosure must be clear and conspicuous.¹ Many B2B senders rely on the email being plainly a sales pitch from a named company. That’s a judgement call; if you send at volume to US recipients, ask a lawyer what wording suits your messages.

Do I need consent if the address is public?

Not in the US or to UK companies. In Canada and Australia, a conspicuously published work address can imply or infer consent, but only for messages relevant to the person’s role and only if they haven’t said they don’t want them.⁶⁷ Being findable in a database isn’t the same as being conspicuously published.

General information, not legal advice. Laws change; confirm with a qualified professional for the countries you email.

Common questions

Is cold email legal in the US?

Yes. CAN-SPAM allows B2B cold email if the header and subject are truthful, the message is identified as an ad, it includes a valid postal address and a working opt-out, and opt-outs are honoured within 10 business days.

Is cold email legal in the UK under GDPR?

To corporate addresses, yes. PECR’s consent rule doesn’t apply to corporate subscribers, but you must identify yourself and give an address to opt out, and UK GDPR still applies to personal data at work addresses. Sole traders and some partnerships count as individuals and generally need consent.

Is cold email legal in Germany?

Generally not without prior consent, even business to business. Germany’s unfair competition law (§7 UWG) treats unsolicited email advertising as unreasonable harassment. Get legal advice before emailing German prospects.

Is cold email legal in India?

India’s DPDP Act has no legitimate-interest basis. Its Rules phase in, with most obligations applying from 13 May 2027; after that, outreach to identifiable people will generally need consent unless an exemption applies.

Keep reading

Sources

US FTC: CAN-SPAM Act compliance guide for business. ftc.gov
UK ICO: Business-to-business marketing. ico.org.uk
GDPR Article 14: information to provide when data wasn’t collected from the person. gdpr-info.eu
Germany, §7 UWG and B2B email advertising (Publicare). publicare.de
Austria, Federal Ministry: Unsolicited messages under the TKG 2021. bmwkms.gv.at
Canada CRTC: Frequently asked questions about CASL. crtc.gc.ca
Australia, Spam Act 2003: consent and conspicuous publication (Pointon Partners). pointonpartners.com.au
India, DPDP Rules 2025 timeline (Consent.in). consent.in
India, DPDP Act and the absence of legitimate interest (Bar & Bench). barandbench.com
Singapore IMDA: Unsolicited communications, best practices for organisations. imda.gov.sg