Cold email is legal in every major B2B market covered in this guide — Canada, the United States, the European Union, the United Kingdom, and Australia — but each jurisdiction sets different conditions for what makes a specific message compliant. There's no single "cold email is/isn't legal" answer that applies globally; the real question is always which conditions apply to a given recipient's country.
| Country / Region | Legal? | What it takes |
|---|---|---|
| Canada | Yes, with conditions | Implied consent (conspicuous publication or business relationship) + identification + unsubscribe |
| United States | Yes, with conditions | No consent required; accurate headers + ad disclosure + physical address + opt-out |
| EU (general) | Yes, with conditions | Legitimate interest basis, documented and role-relevant |
| Germany | Yes, but stricter | Prior express consent required — legitimate interest alone isn't enough |
| United Kingdom | Yes, with conditions | Corporate subscriber exemption (PECR) + lawful basis for personal data (UK GDPR) |
| Australia | Yes, with conditions | Express or inferred consent + identification + fast unsubscribe (5 business days) |
Legal under CASL when you have implied consent — most commonly through the conspicuous publication exemption for a publicly listed business email address — or another applicable exemption, combined with sender identification and a working unsubscribe mechanism honored within 10 business days. Full detail: Cold Email Laws in Canada.
Legal under CAN-SPAM without any consent requirement at all — the law regulates message content instead: accurate headers, a clear ad disclosure, a valid physical address, and a working opt-out honored within 10 business days. No B2B exemption exists. Full detail: CAN-SPAM Act Explained.
Legal in most member states under GDPR's legitimate interest basis (Article 6(1)(f)), provided the outreach is role-relevant and the processing rationale is documented rather than assumed. The recipient retains an unconditional right to object at any time. Full detail: GDPR and Cold Email.
The one EU jurisdiction in this guide where legitimate interest alone doesn't clear you to send. Germany's UWG §7 requires prior express consent for commercial email, B2B included, with a double opt-in evidentiary standard set by the Federal Supreme Court. Full detail: Cold Email Compliance in Germany.
Legal without prior consent when the recipient is a corporate subscriber — PECR's consent rule specifically excludes companies and LLPs. UK GDPR still requires a lawful basis (typically legitimate interest) for personal data tied to a named contact. Sole traders and partnerships need consent or a soft opt-in. Full detail: UK PECR and Cold Email.
Legal under the Spam Act 2003 with express or inferred consent, sender identification, and a fast unsubscribe process — ACMA's enforcement treats delays past five business days as a violation. ACMA enforces this actively, with penalties reaching into the millions of dollars in real cases. Full detail: Australia's Spam Act.
Every jurisdiction in this guide converges on the same three elements, even though the specific mechanics differ: some form of permission or documented justification to email the recipient, clear identification of who's sending, and a genuine, working way to opt out. Get those three right for the specific country you're sending into, and you're covering the substance behind nearly every requirement detailed across this cluster's other guides — including how implied and express consent actually differ and what non-compliance actually costs in each jurisdiction.
Yes — cold email is legal in Canada, the United States, the European Union, the United Kingdom, and Australia, each under its own specific conditions. There's no jurisdiction covered in this guide where B2B cold email is banned outright; the compliance requirements are what differ.
Germany, among the jurisdictions covered here. Its UWG §7 requires prior express consent for commercial email even B2B, with a double opt-in evidentiary standard — stricter than the legitimate-interest approach that works in most of the rest of the EU.
The United States, in terms of not requiring consent at all — CAN-SPAM regulates content and opt-out mechanics rather than requiring permission before the first send. That said, the US applies its content rules to every commercial email with no B2B exemption.
Yes, in the specifics — the legal basis, unsubscribe timeline, and required disclosures differ by jurisdiction, even though every law in this guide converges on the same three underlying requirements: permission or justification, identification, and a working opt-out.
Related guides
Written by
Scott Holmes
AI systems consultant based in Barrie, Ontario. Founder of Pinnacle Tech Projects. Has built compliant multi-jurisdiction outbound systems spanning every region covered in this reference.
Answer four quick questions and get a tool recommendation for your setup.