What are ethical rules around cold outreach?

You've found a contact who seems like a perfect fit. Their job title matches, their company is the right size, and you're convinced your product could genuinely help them. So you send a cold email. Is that okay?

Honestly, it depends. The ethics of cold outreach sit somewhere between "completely fine" and "please don't" depending on how you do it and where your recipient lives.

What the law actually says

Cold outreach is legal in the US under CAN-SPAM, provided you identify yourself honestly, include a physical address, and honor opt-out requests promptly. It doesn't require prior consent, which is why B2B prospecting is so common there.

Under GDPR (EU and UK), the rules are stricter. You need a lawful basis to process someone's personal data, and for most cold email that means "legitimate interests." That's not a free pass. You have to balance your interest against the recipient's rights, which means targeting people where the outreach is genuinely relevant to their professional role. Sending bulk cold email to scraped lists almost never passes that test.

CASL (Canada) goes furthest. It requires express or implied consent before sending commercial email, and implied consent has very specific conditions (a pre-existing business relationship, a published business address, etc.). If you're unsure whether a Canadian contact qualifies, the honest answer is to find a way to get explicit consent first.

What ethical cold outreach looks like in practice

Regulations set the floor. Ethics sets the ceiling. Here's what genuinely good cold outreach looks like, beyond just staying legal:

• Real relevance, not pretend relevance. There's a difference between "I think your company could use this" and "I read your LinkedIn post about X and this is directly related." One is prospecting. The other is spam with a research coat on.
• Honest sender identity. Your name, your company, your actual reply address. No alias tricks, no fake warm-up names.
• One unsubscribe, honored immediately. If someone says stop, you stop. That goes for your whole sequence, not just the email they replied to.
• Limited follow-up. Two or three touches is prospecting. Eight automated follow-ups is harassment. Most good SDRs stop at three if there's no signal of interest.
• The "reasonable person" test. Ask yourself honestly: would a reasonable person in this role actually appreciate this email? If the answer is "maybe not but I'll send it anyway," that's your signal to reconsider.

The B2B vs B2C distinction matters here too. Cold emailing a procurement manager about a software tool they might actually use is very different from cold emailing a consumer about something they never asked about. Most regulators draw that line clearly, and so should you.

And if you're sending cold outreach at scale and want to make sure your list quality isn't making the situation worse, our RME Clean service can flag risky and undeliverable addresses before you send. It won't make an unethical list ethical, but it stops you from making a bad situation worse. Or if you've got a more nuanced situation and want a real conversation, the SOS hotline is free.