It depends on where the recipient is. In the United States, cold email to businesses is legal if you follow the CAN-SPAM rules. In the United Kingdom it is possible for corporate recipients, with data protection duties. In Germany, unsolicited advertising email generally needs prior consent, also between businesses. This is general information, not legal advice, and rules change.
The short answer in one table
The law that counts is mainly the law of the country where the recipient is, not where you sit. A sender in Texas who writes to a company in Munich has to think about German rules.
| Recipient in | Main rule | Consent needed first? | Risk level for cold email |
|---|---|---|---|
| United States | CAN-SPAM Act | No, but strict content and opt-out rules | Lower, if you follow the rules |
| United Kingdom | PECR and UK GDPR | Yes for individual subscribers. Not under PECR for corporate subscribers. | Medium. Depends on who the recipient is. |
| Germany | UWG § 7, plus GDPR | Yes, generally, also for businesses | High |
| Canada | CASL | Yes, generally (express or implied consent) | High |
Other countries have their own rules. Always check the country you want to write to.
United States: allowed, with clear conditions
The CAN-SPAM Act does not require consent before you send a commercial email. It applies to business-to-business email as well. It sets conditions that every message must meet:
- No false headers. The From name, the reply address and the domain must show who really sends the email.
- An honest subject line. It must not mislead about the content.
- Identify the message as an ad. It must be clear that this is a commercial message.
- A valid physical postal address of the sender in every email.
- A clear and working way to opt out. It must be easy to find and easy to use.
- Honour opt-outs within 10 business days. In practice, remove people at once.
You stay responsible even when an agency or a tool sends for you. Fines can be set per email, so a careless campaign can become expensive. Some US states have their own additional rules.
United Kingdom: it depends on who you write to
Two sets of rules apply together.
PECR (the Privacy and Electronic Communications Regulations) says that marketing email to individual subscribers needs consent, with a narrow exception for your own existing customers. Individual subscribers are consumers, but also sole traders and some partnerships.
Corporate subscribers, such as limited companies, LLPs and public bodies, are not covered by that consent rule. You may email them without prior consent. You must still say who you are and give a valid contact address so they can ask you to stop.
UK GDPR still applies as soon as you use a named person's data, for example jane.smith@company.co.uk. That means:
- You need a lawful basis. For B2B outreach this is usually legitimate interests, and you should write down a short legitimate interests assessment.
- Tell people who you are and where you got their details.
- Offer an opt-out in every email and keep a suppression list, so that nobody who said no is contacted again.
- Only write to people whose job makes your offer relevant.
Germany: generally not without prior consent
Germany is strict. Under § 7 of the Act against Unfair Competition (UWG), advertising by email without the recipient's prior express consent is generally treated as an unacceptable nuisance. This applies to business recipients too. A general address such as info@ does not change that, and neither does a polite tone or an opt-out link.
German courts read the word advertising widely. A first email that only asks whether someone would be interested in a call usually counts as advertising as well.
There is only a narrow exception for existing customers. All conditions must be met: you received the address in connection with a sale, you advertise your own similar products or services, the customer has not objected, and you clearly told them at collection and in every email that they can object at any time.
The practical risk is a formal warning letter (Abmahnung) from the recipient, a competitor or an association, with lawyer's fees and a demand to sign a cease-and-desist declaration. Data protection complaints are possible as well. Cold email to German recipients is therefore high risk. Austria and Switzerland also generally require consent.
A checklist for every campaign
- Sort your list by country of the recipient. Remove countries where you would need consent that you do not have.
- For the UK, check the legal form. Keep limited companies and LLPs. Remove sole traders and partnerships unless you have consent.
- Write only to people for whom the offer is relevant to their job.
- Use a real sender name and a domain that leads to a real website.
- Put your postal address and a plain opt-out line in every email.
- Remove opt-outs straight away and keep a suppression list for all future campaigns.
A footer you can copy:
[Your name], [Company], [Street, city, postcode, country]
You are receiving this because [company name] works in [industry] and I thought this could be relevant to your role. If it is not, reply with 'no thanks' and I will not email you again.
What to do where cold email is not an option
If your customers are in Germany, Austria or Switzerland, or are private people, choose channels that do not need prior consent in the same way:
- A letter by post to a business.
- Ads and a good landing page, so that people contact you first.
- An opt-in form on your website for a newsletter, with a confirmation email.
For this reason Astranode's cold email setup only sends to US and UK business addresses. Whatever you decide, technical setup matters too. See SPF, DKIM and DMARC in plain words. Rules differ by country and change. This is general information, not legal advice. Ask a lawyer before a larger campaign.
The recipient's country decides. US: allowed if you follow CAN-SPAM. UK: possible for corporate recipients with an opt-out and a documented basis. Germany: generally only with prior consent.