Cold email laws in the US, UK, EU, Canada and Australia

Picture one campaign, one sequence, five countries. Your rep hits send on a list that includes prospects in New York, Berlin, London, Toronto, and Sydney. Same template, same subject line, same opt-out footer. The problem: the law that applies to each email is set by where the recipient sits, not where you hit send.

That single fact trips up more outbound teams than bad copy ever does. I’ve watched teams build one “compliant” template and assume it travels everywhere, only to find out that a line legal in the US creates real exposure in Germany or with a UK sole trader. Cold email laws differ enough across regions that a one-size-fits-all approach is a liability, not a shortcut.

In this guide, I’ll walk you through cold email laws in the US, UK, EU, Canada, and Australia as of November 2026, country by country, with the consent model and required content for each. You’ll leave knowing exactly what has to be in every email you send, no matter where your prospect lives.

This is not legal advice.

Is cold email legal

Yes. B2B cold emailing is legal in many countries when you follow local rules on consent, sender identification, and opt-out. The specifics change depending on where your recipient sits, so a single campaign hitting five countries can mean five different sets of requirements. This guide covers the rules as of November 2026. It is not legal advice.

Some countries run an opt-out model. The US is the clearest example: you can email a prospect without prior permission as long as every message includes a way to stop receiving them, and you honor that request. Under opt-out regimes, the burden is on the sender to stay compliant after the first send.

Other countries run an opt-in model, where you need some form of consent before the first email goes out. Canada and Australia both require consent (express or implied), and several EU member states require it for B2B email too. The distinction matters because sending a single email without the right consent basis can be a violation in opt-in jurisdictions.

Cold email laws by country at a glance

One pattern across every jurisdiction: rules for consumers and sole traders are stricter than for company email addresses. If you are emailing a named person at a corporate domain, you usually have more room than if you are emailing a freelancer or sole proprietor. When in doubt, treat the stricter standard as your default.

United States and CAN-SPAM

CAN-SPAM applies to every commercial email sent to a US recipient, including B2B. No prior consent is needed. That makes it one of the most permissive frameworks for cold outreach, but the requirements it does impose are non-negotiable.

Every email must have accurate header and “From” information, a subject line that is not deceptive, a valid physical postal address, and a clear opt-out mechanism. Once someone opts out, you have 10 business days to stop emailing them. Your opt-out mechanism must remain functional for at least 30 days after the message is sent.

The civil penalty is assessed per individual email, not per campaign, so even a modest campaign where every message violates the rules creates serious financial exposure. For a deeper walkthrough, see the full guide to CAN-SPAM rules for cold email.

European Union and GDPR

When you email a named person at their work address, you are processing personal data. That means GDPR applies. The most common lawful basis for B2B cold email is legitimate interest, but you need a documented balancing test showing that your outreach does not override the recipient’s rights. You also need to tell the person where you got their data.

If someone objects to your emails, you must stop direct marketing to them immediately. There is no 10-day grace period like CAN-SPAM. The right to object is absolute for direct marketing under GDPR.

On top of GDPR, each EU member state has its own ePrivacy law that decides whether B2B email needs prior consent. Some countries, like Germany, are strict and effectively require opt-in even for B2B. Others allow legitimate interest. You need to check the national rule for each country you are targeting. The most serious GDPR infringements carry fines of up to €20 million or 4% of global annual turnover. For the full picture, see the guide on GDPR and cold email.

United Kingdom and PECR

Under PECR, emails to corporate subscribers (people at company email addresses) do not need prior consent. You must identify yourself as the sender and include an opt-out in every message. That makes B2B cold email to UK companies broadly similar to the US model.

The catch: sole traders and some partnerships count as individual subscribers under PECR. They need consent before you email them. If your list mixes limited companies with freelancers and sole traders, you cannot treat them the same way. UK GDPR still applies to any named individual, so you still need a lawful basis for processing their personal data.

The Data (Use and Access) Act 2025 has raised PECR penalties toward UK GDPR levels. Before this reform, PECR monetary penalties were capped well below what the ICO could impose under the Data Protection Act. The new enforcement regime means that PECR violations now carry fines comparable to those under UK GDPR, making compliance with electronic marketing rules significantly more important for outbound teams targeting UK prospects.

Canada and CASL

CASL requires consent before you send a commercial electronic message. That consent can be express (the person actively agreed to receive emails) or implied. Implied consent can come from an existing business relationship, such as a recent purchase or contract. It can also come from a business email address that is conspicuously published without a statement refusing unsolicited messages, as long as your email is relevant to the person’s role.

Every message must identify the sender, include contact details, and provide a working unsubscribe mechanism. You must honor unsubscribe requests within 10 business days.

CASL penalties are among the strictest in the world, with separate caps for individuals and for businesses. Directors and officers can be held personally liable if they directed, authorized, or participated in violations. That personal liability clause is what sets CASL apart from most other anti-spam frameworks.

Australia and the Spam Act

Australia’s Spam Act 2003 requires consent before sending commercial electronic messages. Consent can be express or inferred. Inferred consent works similarly to CASL’s implied consent: if a business email address is conspicuously published and there is no statement against receiving messages, you can email that person as long as the content is relevant to their role.

Every email must clearly identify the sender and include a functional unsubscribe mechanism. Unsubscribe requests must be honored within 5 business days, the shortest deadline of the five regions covered here.

What every compliant cold email should include

Regardless of which country your prospect is in, every cold email should meet this baseline:

• •

  Real sender name and company name in the “From” field

• •

  An honest subject line that reflects the content of the email

• •

  Content relevant to the recipient’s role or business

• •

  A physical postal address in your email signature

• •

  A clear, working opt-out link

• •

  An internal record of where you sourced the recipient’s data

That last point is easy to skip and hard to fix later. If a recipient in the EU asks where you got their email, you need an answer. Build the habit of logging your data source at the point of import.

Here are the mistakes that create both legal and deliverability risk:

• •

  Buying unverified lists with no data provenance

• •

  Ignoring or delaying opt-out requests

• •

  Writing misleading subject lines to inflate open rates

• •

  Hiding or spoofing the sender identity

• •

  Emailing UK sole traders as if they were corporate subscribers

• •

  Sending the same template to every country without adjusting for local requirements

Several of these also hurt your sender reputation. Bounces from bad lists, spam complaints from ignored opt-outs, and deceptive subjects all damage inbox placement. For more on protecting your sending infrastructure, see the email deliverability guide.

Compliance beyond email in a multichannel sequence

Most outbound teams today run sequences that combine email with LinkedIn, calls, SMS, and WhatsApp. Each channel adds its own layer of regulation. Phone calls and SMS are governed by separate telecom and privacy laws that vary by country, and those rules are often stricter than email rules.

The principle that matters most: an opt-out received on one channel should stop outreach across every channel. If a prospect replies “stop contacting me” on LinkedIn, continuing to email them is a compliance failure and a fast way to get reported. Phone and SMS rules (like TCPA in the US or PECR for calls in the UK) deserve their own review. Check them separately before adding those steps to your sequences. For a broader framework, see the guide on cold email best practices.

How to keep campaigns compliant in lemlist

lemlist gives you the tools to stay compliant without building a separate compliance workflow.

To add an unsubscribe link to any email step, click + Add, then select Add unsubscribe link. You can choose per campaign whether an unsubscribe removes only the email step or removes the contact from all channels in the sequence.

At the team level, you maintain a single unsubscribe list that covers emails, domains, phone numbers, and LinkedIn URLs. When a lead bounces, lemlist automatically unsubscribes them from email so you are not sending to dead addresses.

For agencies managing multiple clients, lemlist supports multiple teams. Each team has its own leads, its own duplicate detection, and its own unsubscribe list. That separation keeps one client’s opt-outs from leaking into another client’s campaigns.

Add your physical postal address in your email signature inside lemlist. That covers the postal address requirement for CAN-SPAM and gives you a consistent footer across every campaign.

Final takeaway

Cold email is legal in every region covered here, but each country sets its own rules on consent, identification, and opt-out deadlines. The safest approach is to segment your campaigns by recipient country and build compliance into your workflow from the start. Treat opt-outs as immediate and universal across every channel.

Build your first signal-based sequence in lemlist.