Is cold email legal?
It depends on where the recipient is and who they are. The US CAN-SPAM Act works on opt-out: the Federal Trade Commission's list of its main requirements has no prior-consent step, and recipients can make you stop. The UK and the EU require consent before marketing emails to individuals, with an exception for contacts whose details you collected during a sale (in the UK, also during negotiations for one), and they treat emails to companies differently. All three set rules for what the email itself must show.
GDPR is only part of the answer. In the EU, the rule on marketing email sits in Article 13 of the ePrivacy Directive (2002/58/EC), and GDPR applies to the personal data you use, such as a named work address. The UK has the same split. The ICO's email marketing guidance says PECR sets the rules for sending electronic mail marketing, and that where you use personal information you must also comply with the UK GDPR and the Data Protection Act 2018.
How do GDPR, UK PECR and CAN-SPAM compare?
The three regimes differ most on consent and on what the email must contain. Each cell links to the law or regulator page it comes from.
| EU: ePrivacy Directive and GDPR | UK: PECR and UK GDPR | US: CAN-SPAM Act | |
|---|---|---|---|
| Who the rule covers | The consent rule covers subscribers who are natural persons; each member state protects the interests of other subscribers, such as companies (Art. 13(1), 13(5)). GDPR reaches senders outside the EU who offer goods or services to people in the EU (Art. 3(2)) | The consent rule covers individual subscribers, which include sole traders and some partnerships (reg. 22; ICO). The identity and opt-out rule covers every marketing email (reg. 23) | Commercial email, meaning messages whose primary purpose is advertising or promoting a commercial product or service, with no exception for business-to-business email (FTC) |
| Consent or opt-out | Prior consent for natural persons, except existing customers for your own similar products if they can object easily and free of charge (Art. 13(1)-(2)). Under GDPR, direct marketing may be a legitimate interest, and people can object at any time (Recital 47, Art. 21) | Consent or the soft opt-in for individual subscribers; no consent or soft opt-in needed under PECR for corporate subscribers (ICO) | Opt-out: honour requests within 10 business days. Prior consent is not on the FTC's list of main requirements (FTC) |
| What each email must contain | Undisguised sender identity, a valid address for stop requests, and no breach of Article 6 of the e-Commerce Directive, which requires a commercial communication to be clearly identifiable as such (Art. 13(4)). For personal data, the right to object, shown clearly and separately at the latest at the first communication (Art. 21(4)) | Undisguised identity, a valid address for opt-out requests, and no breach of regulation 7 of the Electronic Commerce Regulations 2002, which requires a commercial communication to be clearly identifiable as one (reg. 23) | Accurate header information, an honest subject line, a clear ad disclosure, a valid physical postal address and a clear way to opt out (FTC) |
| Maximum penalty | GDPR: up to €20m or 4% of total worldwide annual turnover, whichever is higher (Art. 83(5)). ePrivacy: penalties set by each member state (Art. 15a) | Up to £17.5m or 4% of global turnover, the ICO said on 5 February 2026 (ICO) | Up to $53,088 for each separate email in violation (FTC) |
What do the EU's ePrivacy Directive and GDPR require?
The EU requires consent for marketing email to individuals, leaves the rule for companies to each member state and adds GDPR duties for named contacts. Article 13 of the ePrivacy Directive allows email for direct marketing only to subscribers or users who have given prior consent. The exception: a business that got a customer's email address in the context of a sale may market its own similar products, if the customer can object free of charge and easily when the details are collected and in every message. Article 13(5) applies the consent rule to subscribers who are natural persons and asks each member state to make sure the legitimate interests of other subscribers, such as companies, are sufficiently protected. Article 13(4) prohibits marketing emails that disguise the sender, lack a valid address for opt-out requests, or breach Article 6 of the e-Commerce Directive, which requires a commercial communication to be clearly identifiable as such.
GDPR applies whenever the email uses personal data. Recital 47 says processing personal data for direct marketing may be regarded as carried out for a legitimate interest, the basis in Article 6(1)(f), which does not apply where the person's interests or rights override yours. Article 21 gives people the right to object at any time to direct marketing; once they do, their data can no longer be used for it. That right must be brought to their attention, clearly and separately from other information, at the latest at the first communication.
Article 14 matters for cold outreach because you did not get the address from the person. It lists what you must tell the person, including who you are, your purposes and legal basis, where the data came from and their rights, and says that if you use the data to contact them, you must do so at the latest at the first communication. Article 3(2) applies all this to controllers outside the EU when the processing relates to offering goods or services to people in the EU. The ceiling under Article 83(5) is €20 million or 4% of total worldwide annual turnover, whichever is higher.
What does UK PECR require?
PECR splits recipients into corporate and individual subscribers, and only individual subscribers need consent. The consent rule in regulation 22 applies to individual subscribers, a group the ICO says includes sole traders and some partnerships. For corporate subscribers, the ICO's guidance says you can send unsolicited electronic mail marketing without consent or a soft opt-in. Every marketing email must identify the sender, give a valid address for opt-out requests and be clearly identifiable as marketing under regulation 23, and UK GDPR applies to named contacts.
The penalty changed this year. In its statement of 5 February 2026, the ICO said the Data (Use and Access) Act 2025 lets it issue fines of up to £17.5 million or 4% of global turnover under PECR. The ICO's older Guide to PECR, which it marks as under review, still gives the previous figure of up to £500,000. The government's commencement page says the regulator's functions passed to a new Information Commission on 30 September 2026; the ICO's guidance is still published at ico.org.uk.
What does the US CAN-SPAM Act require?
Honest headers, an ad disclosure, a postal address and a working opt-out in every commercial email, business-to-business included. The FTC's compliance guide for business, dated August 2023 and edited in January 2024 to reflect inflation-adjusted penalties, says the law covers all commercial messages and makes no exception for business-to-business email. Its main requirements are:
- Accurate From, To, Reply-To and routing information that identifies who initiated the message.
- A subject line that accurately reflects the content.
- A clear and conspicuous disclosure that the message is an advertisement.
- Your valid physical postal address.
- A clear explanation of how to opt out, with a return email address or other easy internet-based way to do it.
- Opt-out requests processed for at least 30 days after you send, and honoured within 10 business days.
Two details catch small teams. Responsibility cannot be contracted away: both the company whose product is promoted and the company that sends the message may be held legally responsible. And each separate email in violation can bring penalties of up to $53,088. The FTC also lists harvesting email addresses, or generating them through a dictionary attack, among practices for which the law provides criminal penalties.
What should every cold email footer include?
One footer can carry most of what the three regimes ask for. This is our template, not wording any regulator has approved, so check it with your lawyer:
| Footer line | Where the requirement comes from |
|---|---|
| Company name and a real sender | Undisguised identity: ePrivacy Art. 13(4), PECR reg. 23; accurate header information: CAN-SPAM |
| Postal address | Valid physical postal address: CAN-SPAM |
| This is a marketing email | Clear ad disclosure: CAN-SPAM; commercial communication clearly identifiable as such: ePrivacy Art. 13(4) with e-Commerce Directive Art. 6, PECR reg. 23 with E-Commerce Regulations 2002 reg. 7 |
| Reply STOP or unsubscribe link | Valid address for stop requests: ePrivacy Art. 13(4), PECR reg. 23; clear opt-out: CAN-SPAM |
| Right to object | Shown clearly and separately at the latest at first contact: GDPR Art. 21(4) |
| Why them, where you found the address, privacy notice | Information including the data's source, at the latest at first contact: GDPR Art. 14 |
Put the footer in every message of a sequence, including follow-ups. For opening lines and bodies to go above it, see our cold email templates.
A checklist before your next campaign
Sort recipients by country and type, apply the strictest rule that fits each group, and keep one suppression list. These steps are our suggestions:
Tag every contact by country and address type
Record where the recipient is, whether the address names a person, and whether the business is a company or an individual trader.
Check national rules for EU company addresses
Article 13(5) leaves the rule for companies and other legal persons to each member state, so look up the rule in every EU country on your list.
Remove UK individual subscribers without consent
Sole traders and some partnerships need consent or the soft opt-in under PECR.
Add the US essentials
Postal address, ad disclosure and a working opt-out in every commercial email, with opt-outs honoured within 10 business days.
Keep one suppression list for all three
When anyone objects or unsubscribes, stop everywhere and screen every new list against it. If you use Siela's AI SDR, the first email is your own template, sent with each person's name, company and title filled in, and AI follow-ups continue in the same thread, so put the footer in your template and check what each follow-up carries.
Frequently asked questions
Is cold email illegal in the EU?
Not across the board. The ePrivacy Directive requires prior consent for email marketing to subscribers who are natural persons, with an exception for existing customers and similar products. For companies and other legal persons, it leaves the rule to each member state. GDPR then applies to personal data such as a named work address, including the right to object to direct marketing at any time.
Do I need consent to send cold emails in the US?
The FTC's list of CAN-SPAM's main requirements does not include prior consent. It requires accurate header information, honest subject lines, a clear ad disclosure, a valid postal address and a clear way to opt out, with opt-outs honoured within 10 business days. The FTC says the law makes no exception for business-to-business email.
Does GDPR apply to cold emails sent from outside the EU?
It can. Article 3(2) applies GDPR to controllers outside the EU when their processing relates to offering goods or services to people in the EU, or to monitoring their behaviour there. If you email named people in the EU to sell to them, check with a lawyer before assuming GDPR does not reach you.
What are the maximum fines for illegal cold email?
Under CAN-SPAM, the FTC says each separate email in violation can bring penalties of up to $53,088. GDPR Article 83(5) allows fines up to €20 million or 4% of total worldwide annual turnover, whichever is higher. In the UK, the ICO says PECR fines can now reach £17.5 million or 4% of global turnover. These are ceilings set in law.
Is this guide to cold email law legal advice?
No. It compares the EUR-Lex texts of GDPR and the ePrivacy Directive, the ICO's PECR guidance and the FTC's CAN-SPAM guide as checked on 20 October 2026. EU member states add national rules, especially for emails to companies, which this guide does not cover. Ask a lawyer in each market you email before relying on any of it.
Sources
- EUR-Lex: Regulation (EU) 2016/679 (GDPR) (checked 20 Oct 2026)
- EUR-Lex: Directive 2002/58/EC (ePrivacy Directive), consolidated text of 19 Dec 2009 (checked 20 Oct 2026)
- FTC: CAN-SPAM Act, A Compliance Guide for Business (August 2023, edited January 2024)
- ICO: Statement on the commencement of the Data (Use and Access) Act (published 5 Feb 2026)
- legislation.gov.uk: PECR 2003, regulation 22 (checked 20 Oct 2026)
- legislation.gov.uk: PECR 2003, regulation 23 (checked 20 Oct 2026)
- ICO: How do we comply with the PECR electronic mail marketing rules? (checked 20 Oct 2026)
- ICO: Business-to-business marketing (checked 20 Oct 2026)
- ICO: What else do we need to consider? (electronic mail guidance) (checked 20 Oct 2026)
- ICO: Guide to PECR, What are PECR? (checked 20 Oct 2026)
- EUR-Lex: Directive 2000/31/EC (e-Commerce Directive) (checked 20 Oct 2026)
- legislation.gov.uk: Electronic Commerce (EC Directive) Regulations 2002, regulation 7 (checked 20 Oct 2026)
- GOV.UK: Data (Use and Access) Act 2025, plans for commencement (updated 12 Oct 2026)