Key takeaways
- Cold email is legal for B2B in the US and most of the EU, with real rules attached. The country where it is genuinely restricted, with no general B2B exemption, is Canada. This is general information, not legal advice.
- CAN-SPAM's maximum civil penalty is $53,088 per non-compliant email (FTC, current inflation-adjusted figure), and each recipient on a list counts as a separate violation.
- GDPR's "legitimate interest" basis (Article 6(1)(f)) permits B2B cold email across most of the EU without prior consent. Germany is a real exception: its own law generally requires consent even for B2B email, and this gets enforced.
- The UK's ICO permits emailing corporate bodies without consent under PECR, but sole traders and some partnerships count as individuals and need consent, and a named individual's work address can still trigger separate UK GDPR obligations.
- CASL (Canada) has no general B2B prospecting exemption. Implied consent can arise from a purchase, an inquiry or a conspicuously published business address, but it expires (2 years post-purchase, 6 months post-inquiry), and penalties reach CAD $1 million for individuals, CAD $10 million for organizations. The CRTC's first enforcement action, against Compu-Finder, opened at a $1.1 million notice and was reduced to $200,000 on appeal, a useful real example of both the exposure and how it can shrink under challenge.
The short answer
Cold email to a business contact is legal in the US and most of the EU, provided you get the mechanics right: honest headers, a real opt-out, a lawful basis for processing the contact's data. It is effectively restricted in Canada, where consent is required with no general B2B carve-out. The penalties that actually matter scale by jurisdiction, and Canada's are an order of magnitude larger than the US's. Everything below is the real rule in each jurisdiction, with the actual numbers attached.
How far apart the real penalties actually are
Selected maximum per-violation penalties
US: per email. Canada: per violation, corporate maximum.
FTC (CAN-SPAM, current inflation-adjusted figure, USD); CRTC (CASL, published maximums, CAD). Selected penalties only: GDPR and UK regimes carry their own, separate ceilings.
The scale difference is real, not a rounding artifact. A US sender's worst-case exposure per email is five figures. A Canadian sender's worst-case exposure per violation is seven to eight figures, and CASL's actual first enforcement case opened at $1.1 million.
The US: CAN-SPAM
CAN-SPAM, enforced primarily by the FTC, does not ban cold email. It regulates how it has to be done. The core requirements, straight from the FTC's own compliance guide:
Accurate headers. The "From," "To," and routing information must honestly identify who sent the message.
Honest subject lines. The subject has to reflect the actual content.
Clear ad disclosure. The message must identify itself as an advertisement where applicable.
A real physical address. A valid postal address is required in the message.
A working opt-out, honored within 10 business days of the request, not "eventually."
Accountability for third parties. Hiring an agency or a sending tool doesn't transfer the legal responsibility away from the business whose message it is.
The maximum civil penalty is $53,088 per violating email, current as of the FTC's most recent inflation adjustment. Each recipient is a separate violation, which is why the real risk scales with list size even though large CAN-SPAM enforcement actions against small B2B senders are uncommon in practice. The requirements, not the enforcement odds, are what a real sending setup should be built around.
The EU: GDPR and legitimate interest
B2B cold email across most of the EU is permitted under GDPR's "legitimate interest" legal basis (Article 6(1)(f)), not consent. The practical test: a genuine business reason for the contact, relevance to the recipient's actual professional role, minimal data processing, and a real opt-out.
Germany is the clear, specific exception worth knowing by name. Its own law, the UWG, generally requires consent even for B2B commercial email, separate from and stricter than the GDPR baseline, and it gets enforced. A sending list that's fine across most of the EU under legitimate interest is not automatically fine for German contacts specifically.
The UK: PECR's corporate exemption
The UK's ICO states this plainly: you can email a corporate body, a company, a limited liability partnership, a government body, without prior consent under PECR. No soft opt-in requirement applies to B2B prospecting the way it does for consumer marketing. The exception to know: sole traders and some partnerships count as individuals under PECR, so they need consent.
The real caveat, directly from the ICO's own guidance: emailing a named individual's personal corporate address can still raise separate GDPR data protection considerations, beyond PECR's corporate exemption. The company-level exemption and an individual's data protection rights are not the same question, and a compliant setup treats them as two separate checks, not one.
Canada: CASL, the one with no B2B exemption
CASL is the jurisdiction where the common "cold email is fine for B2B everywhere" assumption breaks. CASL requires express or valid implied consent before sending a commercial electronic message to a Canadian recipient, and there is no general exemption for cold prospecting into a company you have no existing relationship with, regardless of the recipient's seniority or the company's size.
Implied consent does exist. It can arise from a recent purchase or inquiry, and from a conspicuously published business email address where the message is relevant to the recipient's role and they have not published a statement that they do not want unsolicited messages. The purchase and inquiry routes expire: two years after a purchase or a contract, six months after an inquiry. Past that window, a contact needs express consent again, not a renewed assumption of implied interest. Because these conditions are narrow, take Canadian advice before relying on the published-address route.
Penalties reach CAD $1 million per violation for individuals and CAD $10 million for organizations, with directors and officers personally exposed. The CRTC's first real enforcement action, against Compu-Finder in March 2015, opened with a $1.1 million notice of violation over unsolicited commercial messages and broken unsubscribe mechanisms sent to Canadian businesses. Worth knowing the full outcome, not just the headline number: Compu-Finder challenged the penalty, and in 2017 it was reduced to $200,000 on appeal. The real lesson isn't just "the number can be large." It's that the number is large enough, and genuinely enforced, to be worth building a compliant process around rather than relying on actual fines staying rare.
A compliance checklist that actually covers all three
Know where your list actually lives, not just where your company is based. A US company emailing contacts in Germany or Canada is subject to those jurisdictions' rules for those contacts, not just CAN-SPAM.
Segment Canadian contacts separately, and only email ones with real, current, trackable consent, or a genuine, time-bounded implied-consent relationship. Don't apply a US or UK cold-outreach list to Canadian contacts by default.
Build the opt-out once, apply it everywhere. A working, honored-within-days unsubscribe mechanism satisfies CAN-SPAM, strengthens a GDPR legitimate-interest argument, and is simply good practice under PECR even where it isn't strictly required.
Keep a real record of why each list exists. A documented legitimate-interest basis for EU contacts, a documented consent timestamp for Canadian contacts, turns "we think this is fine" into something that actually holds up if it's ever questioned.
DeliMail supports opt-out tracking and suppression, so compliance is built into how the sequence runs rather than layered on top of sending. You still decide which contacts and jurisdictions you may email.
This guide is general information, not legal advice. Rules change and depend on your facts, so confirm your position with counsel before you scale.
Book a consultation and we will look at where your current list sits across these rules before recommending anything.
Book a ConsultationSources
- Federal Trade Commission, CAN-SPAM Act: A Compliance Guide for Business
- UK Information Commissioner's Office, Electronic mail marketing guidance
- Government of Canada / CRTC, Notice of Violation issued to Compu-Finder, March 2015
- McMillan LLP, CRTC Imposes $1.1 Million Penalty for Alleged CASL Violation, with 2017 appeal outcome
FAQ
Is cold email actually illegal?
No, not in the US, UK, or most of the EU, for B2B outreach specifically. It is tightly restricted in Canada, where CASL requires express or valid implied consent and has no general exemption for B2B prospecting. This is general information, not legal advice. The US (CAN-SPAM) and most of the EU (GDPR legitimate interest) permit cold email to business contacts as long as specific rules, honest headers, an opt-out, a lawful basis, are followed.
What is the maximum fine for a CAN-SPAM violation?
$53,088 per non-compliant email, per the FTC's current inflation-adjusted maximum. Each individual recipient counts as a separate violation, so a single batch sent to a list of any real size carries real exposure, even though actual enforcement at that scale is rare.
Can I cold email someone in the EU without consent?
Generally yes, for B2B, under GDPR's "legitimate interest" basis (Article 6(1)(f)), provided the email is relevant to the recipient's professional role, you process minimal data, and you offer an easy opt-out. Germany is the clear exception: its own law (the UWG) generally requires consent even for B2B email, and this is actively enforced.
Does the UK require consent for B2B cold email?
Usually not for corporate recipients. The UK's ICO says you can email a corporate body (a company, an LLP, a government body) without prior consent. Sole traders and some partnerships count as individuals and need consent, and emailing a named individual's work address can still trigger UK GDPR obligations beyond PECR itself.
Can I cold email someone in Canada?
Only with express or valid implied consent. CASL has no general exemption for B2B prospecting into a company you have no relationship with. Implied consent can arise from a recent purchase or inquiry, and from a conspicuously published business email address where the message is relevant to the recipient's role and they have not said they do not want unsolicited messages, but implied consent from a purchase or contract expires after two years and from an inquiry after six months. Penalties reach CAD $1 million for individuals and CAD $10 million for organizations per violation, enforced by the CRTC.
