Cold Email Rules in the UK, EU and US (B2B)

Cold email can win new business clients, but the rules for sending it change completely when you cross a border. The UK, the EU and the US each take a different approach to B2B outreach, and the differences decide who you can contact, what you must say and how you must handle opt-outs. This guide compares the three so you can prospect without breaking the law.

Close-up of a backlit computer keyboard glowing in a dark room — The same cold email can be lawful in one country and a breach in another.

Key takeaways

UK: you can email companies and LLPs without consent if you identify yourself and offer an opt-out, but sole traders and some partnerships need consent.
EU: GDPR plus each country's ePrivacy rules apply. Some countries, such as Germany, are strict on B2B cold email; others allow it with legitimate interest.
US: CAN-SPAM allows cold email without consent but requires honest headers, a postal address and an opt-out honored within 10 business days.
Named business addresses are personal data in the UK and EU, so data protection rules apply even when email rules do not require consent.

"Is cold email legal?" has no single answer. A sales email to the finance director of a UK limited company, a sole trader in London, a manager at a German firm and a buyer in Texas may each be treated differently. Most small businesses prospecting across borders either avoid cold email completely out of fear, or send to everyone the same way and hope for the best. Neither is a good strategy.

This guide gives you a working map. It is general information, not legal advice. Rules vary, especially across EU countries, and some UK changes under the Data (Use and Access) Act 2025 are being commenced in stages. Check the ICO, your national regulator, the FTC or a qualified adviser before launching a large campaign.

Two questions behind every cold email

In the UK and EU, cold email has to pass two separate tests:

The electronic marketing test: does the law that governs marketing emails (PECR in the UK, national ePrivacy rules in the EU) allow you to send this message to this recipient without consent?
The data protection test: are you handling the person's data lawfully under UK GDPR or EU GDPR, with a lawful basis, transparency and respect for their rights?

In the US, the main federal test is CAN-SPAM, which focuses on how the message is sent and what it contains, rather than on prior consent. Data protection laws in some states can also apply, so keep an eye on where your recipients are.

UK rules for B2B cold email

The UK's Privacy and Electronic Communications Regulations (PECR) split recipients into two groups.

Corporate subscribers: cold email allowed, with conditions

Companies, limited liability partnerships (LLPs) and government bodies are corporate subscribers. You can send them marketing emails without prior consent, provided you:

clearly identify who you are, and
give a valid way to opt out of further messages, and honor it.

Individual subscribers: consent needed

Sole traders and some partnerships are treated like private individuals. To send them marketing emails, you need their prior consent, unless the soft opt-in applies because you collected their details during a sale or negotiations for a sale. That rules out most cold outreach to freelancers and one-person businesses in the UK.

UK GDPR still applies to named contacts

An address like [email protected] identifies a person, so it is personal data. Even though PECR allows the email, UK GDPR requires you to:

have a lawful basis, typically legitimate interests, supported by a short assessment that weighs your interest against the person's rights,
tell the person how you got their details and how you use them, usually in your first email or via a privacy notice link,
stop immediately if they object to direct marketing.

Common mistake

Treating every address on a business directory as a corporate subscriber. Many small UK businesses are sole traders. Before emailing, check whether the business is a limited company or LLP. If you cannot tell, treat it as an individual and do not send cold marketing.

EU rules: one framework, many national versions

Every EU country applies GDPR in the same way for data protection, but the rules on electronic marketing come from each country's own ePrivacy law. That creates real differences for B2B cold email.

Strict countries: some, such as Germany, generally require prior consent for B2B marketing emails, with only narrow exceptions.
More permissive countries: others allow B2B cold email based on legitimate interest, as long as the message is relevant to the recipient's job and includes an opt-out.
Everywhere: GDPR applies to named business contacts, so you need a lawful basis, transparency and a prompt response to objections.

The practical lesson: check the local rules for each country you target, and do not assume that because something is allowed in one EU country, it is allowed everywhere. Your national data protection authority or a local adviser can confirm the position.

Black and white photo of hands typing on the keyboard of a laptop computer — A short, relevant and personal B2B email is both more effective and easier to justify under data protection law.

US rules: CAN-SPAM for B2B outreach

The CAN-SPAM Act applies to all commercial email in the US, including B2B. It does not require consent before you send, but every commercial message must:

use accurate header information and a subject line that reflects the content,
identify the message as an ad, unless the recipient has consented,
include a valid physical postal address,
offer a clear opt-out, honor it within 10 business days, and keep it working for at least 30 days after sending,
not charge a fee or require more than an email address to opt out.

You remain responsible even if an agency or contractor sends the emails for you. According to the FTC, penalties can be more than $50,000 per violating email. Separately, if you also plan to follow up with texts, the TCPA has much stricter consent rules for SMS than CAN-SPAM has for email.

10 business days The time US senders have to honor an email opt-out request under CAN-SPAM FTC, CAN-SPAM Act guidance

The three regions side by side

Question	UK	EU	US
Cold email to a company contact without consent?	Yes, to corporate subscribers, with identification and opt-out	Depends on the country	Yes, following CAN-SPAM
Cold email to a sole trader?	No, consent needed (unless soft opt-in)	Often treated strictly; check local rules	Yes, following CAN-SPAM
Data protection lawful basis needed?	Yes, under UK GDPR	Yes, under GDPR	No general federal equivalent; some state laws apply
Opt-out in every email?	Yes	Yes	Yes, honored within 10 business days
Postal address required?	Valid contact details required	Sender identification required	Yes, a valid physical postal address

How to run compliant B2B cold outreach

These steps work across all three regions and keep you on the cautious side.

Tag every prospect by country and business type. Note whether each is a company, LLP, sole trader or partnership, and where they are based.
Apply the strictest rule you are unsure about. If you cannot confirm a UK prospect is a company, or you do not know a country's rules, do not send cold marketing until you check.
Document legitimate interests. For UK and EU contacts, write a brief assessment: why you are contacting them, why it is relevant to their role, and how you protect their rights.
Target relevance. Email people whose job matches your offer. A payroll service pitched to a finance manager is easier to justify than a generic blast to everyone at the company.
Be transparent in the first email. Say who you are, why you are writing, where you found their details and how to opt out.
Include your identity and postal address. Use a real sender name, your business details and, for US contacts, a physical postal address.
Keep one suppression list. Anyone who opts out or objects, in any region, is never emailed again, and the list is checked before every send.

Example

Imagine a small software company, Tallyhouse, sells stock-control tools. Its prospect list has a UK limited company, a UK sole trader, a German manufacturer and a US distributor. Tallyhouse emails the UK company's operations manager with a relevant, short pitch, a privacy notice link and an opt-out. It skips the UK sole trader, who has never bought from it. For the German firm, it checks local rules and decides to approach through a LinkedIn connection and a phone call instead. For the US distributor, it sends a CAN-SPAM compliant email with its postal address and an unsubscribe link.

Pro tip

Send cold outreach from a separate subdomain or sending setup, keep volumes modest and personalize each message. High complaint rates hurt your main domain's reputation, and the same habits that keep you compliant also keep your emails out of spam folders.

Cold email compliance checklist

Each prospect tagged by country and business type
UK sole traders and some partnerships excluded unless they consented
EU country rules checked before targeting each market
Legitimate interests assessment written for UK and EU contacts
First email explains who you are and where you got their details
Accurate sender name and honest subject lines
Postal address included for US contacts
Clear opt-out in every message, honored promptly
One suppression list shared across tools and agencies

Frequently asked questions

Can I buy a B2B email list?

You can, but you remain responsible for how you use it. Check how the data was collected, whether contacts were told their details would be shared, and whether each contact is a corporate subscriber or an individual. In the UK and EU, you must also tell people where you got their data.

Is a generic address like info@ treated differently?

Generic addresses that do not identify a person carry less data protection risk in the UK and EU. Electronic marketing rules still apply, so identify yourself and offer an opt-out.

Does the UK soft opt-in help with cold email?

Not usually. The soft opt-in only covers people whose details you collected during a sale or negotiations for a sale. Truly cold prospects have not dealt with you yet.

How many follow-up emails can I send?

The law does not set a number, but each follow-up is another marketing message that needs an opt-out, and persistent emailing makes a legitimate interests argument harder to defend. A short, polite sequence is safer and more effective.

The bottom line

B2B cold email is legal in many cases, but the rules depend on where your prospect is and what kind of business they run. In the UK, email companies and LLPs with clear identification and an opt-out, and leave sole traders alone without consent. In the EU, check each country. In the US, follow CAN-SPAM to the letter.

Across all three, be relevant, be transparent and honor every opt-out. When the rules are unclear, check the ICO, your national regulator, the FTC or a qualified adviser before you hit send.