Is cold emailing legal?
Still have a question, spotted an error, or have a better explanation or a source we should cite?
Short answer: it depends on where your recipients are, not just where you're based.
In the United States, CAN-SPAM permits cold email without prior consent. You need an honest sender identity, a physical mailing address, and a working opt-out honored within 10 business days. No permission required before you hit send.
In Canada, CASL flips that entirely. You need consent before sending. Express consent is safest. Implied consent applies in narrow situations (like an existing business relationship) and it expires, usually after 2 years.
In the EU and UK, GDPR combined with local ePrivacy rules requires a lawful basis for processing personal data. For consumer cold email, that's effectively consent. B2B outreach under "legitimate interest" is possible but needs a documented balancing test, and recipients can still opt out at any time.
Which law applies to you? The one where your recipient is located. If you're sending to a mixed list, you may be under all three frameworks at once. See how to send compliantly for the practical steps, or ask us if your situation is cross-jurisdictional.
Contributors
Who worked on this answer
Every name links to their profile. Every company links to their site. Real people, real accountability.
