What are the legal foundations for cold outreach?

The line between cold email and spam isn't just about opt-in status. It's about intent, targeting, and execution. Understanding the legal frameworks helps you stay on the right side, but it also helps you understand why they're structured the way they are.

In the US, CAN-SPAM (2003) governs commercial email broadly. The key requirements for cold email: don't use deceptive subject lines or sender information, include a physical mailing address, provide a clear way to opt out, and honor opt-out requests within 10 business days. CAN-SPAM notably does not require prior consent for commercial email to adults, which is why targeted B2B cold outreach is legal in the US if you follow the rules.

In the EU, GDPR and the ePrivacy Directive are stricter. Marketing email generally requires explicit consent under ePrivacy. However, GDPR's legitimate interest doctrine provides a legal basis for B2B prospecting when you can demonstrate a genuine business relevance to the recipient's role and company, your interest isn't overridden by their privacy rights, and you honor opt-out requests promptly. This is the basis most B2B cold email senders cite for EU outreach. It's a defensible position, but it requires genuine targeting, not bulk.

In Canada, CASL (2014) is more restrictive. It requires express or implied consent before sending commercial electronic messages. Implied consent exists in certain circumstances (existing business relationships, public posting of contact information in a business context) but it's narrower than US law. If you're emailing Canadians, know the rules specifically.

Regardless of jurisdiction, complaint rates are a practical enforcement mechanism even when legal frameworks don't require opt-in. High complaint rates damage your sending reputation regardless of your legal compliance.