Is Cold Emailing Illegal? The 2026 Rules, Explained Simply
Cold email is legal in most of the world — but CAN-SPAM, GDPR, CASL and the Australian Spam Act each draw the line in a different place. Here's exactly where it sits in 2026, and what actually gets companies fined.
Is cold emailing illegal? No — not in the US, the UK, the EU or Australia. Canada is the one real exception. Every one of these markets still sets hard limits, and the limits are what get people fined.
TL;DR
- Is cold emailing illegal in the US? No. CAN-SPAM lets you email a stranger once. Name yourself, add a real postal address, tell the truth, and act on opt-outs within 10 business days.
- In the EU and the UK? Usually fine for B2B. A role address at a limited company can rest on legitimate interest. A sole trader's own address needs consent.
- In Canada? This is the hard one. CASL wants consent before the first email. Fines reach CAD $10 million per breach.
- In Australia? Legal when the address is published and fits the person's job.
- What gets punished: fake headers, ignored opt-outs, scraped personal data and bought lists. Not the cold email itself.
This is field advice from people who send outbound every day. It is not legal advice. Run your own programme past a lawyer in each market you sell into.
Is cold emailing illegal?#
No. You may send an unsolicited business email in the US, the EU, the UK and Australia. Canada allows it too, but only in narrow cases.
What the law bans is a short list of tricks. Hiding who you are. Faking the "From" line. Writing a subject line that lies. Harvesting addresses at scale. Refusing to stop when someone asks.
Most founders who ask is cold emailing illegal mean something else. They mean: can a regulator come after me? Yes, they can. But the trigger is almost never the send itself. It is the mechanics around it.
Keep one more thing straight. Legal and wanted are two different games. A clean CAN-SPAM email can still land in spam. A CASL breach can still land in the inbox. Being legal keeps you out of court. Being wanted keeps you in the inbox. You need both.
What laws govern cold email in 2026?#
Four sets of rules cover most B2B outbound. So is cold emailing illegal under any of them? Only when you break the duties below.
| Requirement | US (CAN-SPAM) | EU/UK (GDPR + ePrivacy) | Canada (CASL) | Australia (Spam Act 2003) |
|---|---|---|---|---|
| Consent model | Opt-out | Legitimate interest for B2B; consent for individuals | Express or implied consent required first | Express or inferred consent required |
| Can you email a stranger cold? | Yes | Yes, to corporate role addresses, with a balancing test | Only under narrow implied-consent rules | Only if the address is published and relevant to their role |
| Unsubscribe link | Mandatory, honoured in 10 business days | Mandatory, honoured without delay | Mandatory, honoured in 10 business days | Mandatory, honoured in 5 business days |
| Physical postal address | Mandatory | Effectively required via identification duty | Mandatory | Sender identification mandatory |
| Right to see/delete their data | Not covered | Yes — access, rectification, erasure, objection | Limited (PIPEDA covers this separately) | Limited |
| Max penalty | ~$53,000+ per email (inflation-adjusted annually) | €20M or 4% of global turnover | CAD $10M per violation (organisations) | AUD penalties scaling into the millions |
| Practical risk for small senders | Low if compliant | Medium — complaints trigger DPA letters | High — CASL is actively enforced | Medium |
Two takeaways. There is no single cold email law. If you sell across borders, your floor is the strictest market you touch.
And all four agree on three points. Say who you are. Make stopping easy. Do not lie. Build around that overlap and you are safe almost everywhere.
What does CAN-SPAM require in the US?#
CAN-SPAM is not a free pass. It is a short list of duties. The FTC's compliance guide is worth reading in full. In plain terms:
- Do not fake header data. "From", "Reply-To" and routing must point to the real sender. Spoofing a domain turns a marketing problem into a legal one.
- No tricky subject lines. "Re: our call yesterday" when there was no call is a breach, not a clever hook.
- Make clear it is an ad. You have leeway in how. The reader must still be able to tell.
- Add a real postal address. An office or a rented mailbox works. "Remote — San Francisco" does not.
- Give a clear way out. One click, one obvious link. No login. No survey.
- Act on opt-outs in 10 business days. You may not charge or ask for more data first.
- You own what your vendors do. An agency does not take the risk off you. Both parties can be held to account.
The scary number is the per-email fine. The FTC raises it each year for inflation. It now sits north of $50,000 per bad message.
In practice the FTC goes after big senders with broken systems. A founder sending 40 emails a day is not the target. But "per email" is not a typo. Do the math on a 10,000-address blast with a dead unsubscribe link.
Is cold email legal under GDPR in the EU and UK?#
Yes, with strings. People ask is cold emailing illegal under GDPR more than under any other rule. The answer turns on who you email, not where you sit.
GDPR says you need a lawful basis to use someone's personal data. A work address that names a person counts as personal data. For B2B the basis is legitimate interest (Article 6(1)(f)).
That basis comes with a three-part test. The interest must be real — direct marketing counts, per Recital 47. The email must be needed to serve it. And the reader's rights must not outweigh it.
Here is where teams slip:
- Company vs person. A limited company or LLP is a corporate subscriber, so a cold email to a role there is usually fine. A sole trader or a personal address needs consent.
- Relevance is part of the test. A CFO pitched on accounting software passes it easily. A warehouse lead pitched the same tool does not.
- Say where you got the data. Article 14 makes you tell people when you collected their data elsewhere. One footer line covers it: "We found your business contact details in a public B2B directory."
- Objection is final. Under Article 21(2), once someone objects to marketing, the test is over. You stop everywhere, at once, for good.
- Write the test down first. A one-page legitimate interest assessment is the cheapest insurance in outbound. Regulators ask for it.
Germany is the hard case. Courts there treat cold B2B email far more strictly than the UK or Ireland, and often demand consent first. If Germany is a core market, get local advice.
Illegal email vs merely unwanted email#
Most teams get hurt in the second bucket. The question is cold emailing illegal hides a second one: will this wreck my sending? Google and Microsoft do not run a legal team. They run spam filters. They punish things no law bans.
| Behaviour | Illegal? | Kills deliverability? |
|---|---|---|
| Emailing a stranger once, identified and relevant | No | No |
| Forged "From" header or spoofed domain | Yes | Yes |
| No unsubscribe link | Yes | Yes |
| Ignoring an unsubscribe request | Yes | Yes |
| Sending to a purchased list full of dead addresses | Usually no | Severely |
| 8-step sequence to someone who never replied | No | Yes, over time |
| Bounce rate above 5% | No | Yes |
| Emailing Canadian contacts without consent | Yes (CASL) | Indirectly |
A 12% bounce rate is not a crime. It will still burn your sender reputation in a week.
Once mailbox providers flag your domain, no amount of legal care buys you back in fast. That is why list hygiene sits in the same conversation as the law. Same discipline, both ends.
What actually gets companies fined?#
Look at real cases, not headlines. If you want one answer to is cold emailing illegal, watch these four patterns.
Bought lists with no paper trail. A regulator asks where an address came from. "A vendor, and we don't know" is not an answer. There is no lawful basis under GDPR and no proof of consent under CASL. Bought lists are stale too, so delivery suffers as well.
Broken or fake opt-out flows. Asking for a login. Asking why they are leaving before you act. Pulling them from one sequence only. All three are breaches, and all three are easy to prove with a screenshot.
Scraping personal data at scale. Working out a work address from a company's public pattern is one thing. Harvesting private profile fields is another. CAN-SPAM names harvesting and dictionary attacks as aggravating factors.
Ignoring Canada. Teams mail a global list and forget CASL. CASL wants consent before the first send. Cases have ended in seven-figure fines, and the CRTC publishes them. The CASL overview is worth ten minutes before a North American launch.
How do you build a cold email list that stays legal?#
The answer to is cold emailing illegal usually lives in your list, not your copy. Fix the source and most of the risk goes away.
Derive, do not harvest. Start with the company, not the person. A domain search returns role and pattern-based addresses for a firm. That is a very different data trail than scraping a social profile.
Verify before each send. B2B data rots at 2-3% a month as people change jobs. Run an email verifier right before a campaign. It keeps bounces under the 2% line mailbox providers watch.
Sort by country before persona. Tag each contact with a country at import. Route Canadian and German contacts to another motion — LinkedIn, events, or an opt-in list.
Keep one suppression list for every tool. Opt-outs, bounces and objections must flow to your sender, your CRM and any agency. A contact who opts out of sequence A and gets sequence B is the most common own goal in outbound.
Record where the data came from. Store the source, the date and the basis you rely on. Knowing where your data comes from turns a regulator's question into an email attachment.
Cap your follow-ups. Three or four touches, then stop. No law bans a tenth email. It just turns a prospect into a complainant, and complaint rate ends programmes.
Does a disclaimer make cold email legal?#
Partly. A "where we found you" line meets the Article 14 duty and shows good faith. But a footer line does not settle is cold emailing illegal on its own. It cannot create consent that never existed.
"By not replying you consent to future emails" means nothing anywhere. In Canada it hurts you, because consent there must be active. The same goes for "we'll assume you're interested unless you say otherwise". Under CAN-SPAM it is filler. Under CASL it reads as an admission.
Your pre-send compliance checklist#
Run this before each campaign, not each quarter. Tick every box and is cold emailing illegal stops being your problem.
- Real sender name, company name, and a reply-to inbox someone reads
- Postal address in the footer
- One-click unsubscribe, tested in a clean browser
- Subject line that matches the body
- Suppression list synced across tool, CRM and agency
- Country tags set, with Canada and Germany out of cold sequences
- List verified in the last 7 days, bounce forecast under 2%
- Data source logged, with a legitimate interest assessment for EU and UK contacts
- Follow-up cap set, with a hard stop at the last touch
- SPF, DKIM and DMARC passing — not law, but a gate at Google and Microsoft
Miss none of these and you stand on solid ground in every big market but Canada. There you need consent, not a checklist.
Where does this leave you?#
So, is cold emailing illegal? No. Careless cold email is.
And carelessness starts at the data layer, with a list nobody can account for. The teams that hear from regulators are the same teams that bought a CSV, never checked it, and cannot say where a single address came from.
Fix the source and most of the risk goes with it. Build lists from company domains and checked business contacts with the Tomba Email Finder. Run every address through verification before you send. Keep the record of where it came from.
The free tier gives you 25 searches a month to try the workflow. Starter runs $49/mo when you are ready to scale a clean list instead of a risky one.
Related guides#
// get started
Find, verify and enrich your first contacts today
Start on the free plan with 25 searches a month, then scale when your team is ready.
Free plan · No credit card required · GDPR & CCPA
Get the Tomba newsletter
Product and data updates
// about the author