Is B2B cold email legal? GDPR, CAN-SPAM and CASL explained

The short answer by region

• UK and EU (GDPR): you need a lawful basis to process personal data. Many B2B senders rely on legitimate interests. Separate rules on electronic marketing also apply and differ by country.
• United States (CAN-SPAM): applies to commercial email, with no exception for business-to-business email. It does not require prior consent, but it sets rules for how you send.
• Canada (CASL): asks businesses to obtain consent before sending commercial electronic messages. Check the exceptions with a lawyer before you rely on them.
• Other countries: rules vary widely. Check before you send.

GDPR and legitimate interests

Legitimate interests is one of the lawful bases in Article 6(1)(f) of the GDPR, and Recital 47 says direct marketing may be regarded as carried out for a legitimate interest. It is not automatic. The UK regulator describes a three-part test: a purpose test (is there a legitimate interest), a necessity test (is the processing needed for it) and a balancing test (do the person's interests override yours).

In practice, senders keep messages relevant to the recipient's job, use work addresses, tell people who they are and how they got the contact, make opting out easy and honour it immediately, and keep a written assessment of their reasoning. People also have a right to object to direct marketing.

What CAN-SPAM requires

The US law, as summarised by the Federal Trade Commission, has eight requirements. Messages must have truthful header information, not use misleading subject lines, identify themselves as advertisements, include a valid physical postal address, give a clear way to opt out, honour opt-outs within 10 business days, and you remain responsible for email sent on your behalf.

A campaign checklist

• Is the message relevant to the person's role?
• Is it going to a work address, not a personal one?
• Do you say who you are and include a postal address where the law requires it?
• Is there a clear opt-out that you honour quickly, and a suppression list so nobody is emailed again?
• Have you written down why you believe the contact is justified?
• Have you checked the rules in each country you target?

What helps and what hurts

Relevant, honest, low-volume messages with an easy opt-out are the safest. Buying huge lists, using misleading subject lines, hiding your identity, ignoring opt-outs and emailing personal addresses are the common ways senders get into trouble.

Frequently asked questions

Do I need consent to send cold email to a business?

It depends on the country. In the US, CAN-SPAM does not require prior consent but sets sending rules. In the UK and EU, many senders rely on legitimate interests for relevant messages to work addresses. In Canada, CASL expects consent. Check the rules for each market.

Does GDPR ban cold email?

No. GDPR requires a lawful basis and respect for people's rights. Legitimate interests is commonly used for relevant B2B outreach, subject to the balancing test and an easy opt-out.

Does CAN-SPAM apply to B2B email?

Yes. The Federal Trade Commission states that the law makes no exception for business-to-business email.

Can I email someone because their address is public?

A public address does not by itself give you permission. You still need a lawful basis, relevance and an opt-out.