TL;DR: Cold email is legal in many countries, but only if you follow the rules of the country you write to, tell people who you are, and make it easy to stop. Mailbox providers add their own rules on top. This post covers both, with a checklist you can run before every campaign.
The problem: good intentions, spam results
Most founders who send cold email don't think of themselves as spammers. You found a company that fits. You wrote a short, honest email. You plan three follow-ups.
But the law doesn't care about intentions. It looks at what you sent, to whom, and how. Mailbox providers look at something else again: did the people who got your email want it.
Here is what can go wrong:
- A fine. In May 2026 the Italian data protection authority fined a sole trader €1,500. He had bought about 2,500 contacts from a sales-data provider and emailed them, up to three emails each, without consent. The regulator also reprimanded him for not checking where the data came from and for not telling people how he got their address. (Garante decision)
- A burned domain. Gmail wants your spam rate below 0.1% and never at 0.3%. Above that line, your mail goes to spam or is refused. (Google sender guidelines)
- Fines per email. In the US, CAN-SPAM allows penalties of up to $53,088 for each email that breaks the rules. A four-step sequence counts four times. (FTC)
The fine in Italy went to the sender. Not to the data provider, not to the sending tool. If you send, the risk is yours.
Rule 1: the recipient's country decides
The law that applies is the one where your prospect is, not where you are. Countries fall into three rough groups.
Opt-out countries. You may email a business contact without asking first. You must say who you are and let them stop. The US and the UK work this way for companies.
Countries with conditions. You may email only if certain things are true. In Canada, the address must have been published by the business, with no "no unsolicited email" note, and your offer must fit the person's job. Keep a record of where and when you found the address.
Opt-in countries. You need prior consent, even for business addresses. Germany, Austria, Italy, Spain and Poland are in this group. A cold email to a German company without consent breaks the law.
Two traps catch people often:
- Sole traders and freelancers. Many countries treat them as private people. Even in the UK, you need consent to email a sole trader.
- Named addresses in Europe. jane@company.com is personal data under GDPR. You need a reason to process it (usually legitimate interest), you must tell Jane how you got her address, and she can object at any time.
If you don't know which country a contact is in, you don't know which rules apply. Treat that contact as off limits until you find out.
Rule 2: be honest about who you are
Every email should make the sender obvious. This is the part almost every law agrees on.
- Use your real name and your real company in the From line.
- Put your company's legal name and postal address in the footer.
- Write a subject line that matches the email. No fake "Re:" or "Fwd:" on a first email.
- Don't paste fake thread history to make it look like you talked before.
- Don't claim someone referred you unless they did.
- Don't pretend to be another brand, a bank or a support team.
Industry groups such as M3AAWG and Spamhaus now class fake one-to-one tricks as spam, even when the volume is low.
Rule 3: make it easy to stop, and mean it
An opt-out that doesn't work is worse than none.
- Put an unsubscribe link in every email, plus a line like "reply stop and I won't write again".
- Add the one-click unsubscribe headers (List-Unsubscribe and List-Unsubscribe-Post). Gmail and Yahoo require them for bulk senders, and they help everyone else too.
- Act on an opt-out at once. Yahoo asks for two days. The US allows ten business days. There is no reason to wait.
- Stop every campaign for that person, not just the one they replied to.
- Keep a permanent do-not-contact list. If you delete the lead and import it again next month, they must stay blocked.
- Read replies in every language. "Baja", "abmelden" and "désinscrire" all mean the same thing.
Rule 4: send less, to people who fit
No law limits how many emails you send. But volume multiplies everything else.
- Each email in a sequence is a separate risk in places that fine per message.
- In Spain, mass sending moves a violation into a higher penalty band.
- Gmail and Outlook draw the bulk sender line at about 5,000 emails a day from one domain. Once you cross it at Gmail, the stricter rules apply to you for good.
Keep each mailbox to 20 or 30 cold emails a day. Keep sequences to four or five touches. Pick a small list of people who really fit your offer. A small, precise list also gives you a clearer answer about whether your offer works at all.
Rule 5: watch the signals and pause early
Providers judge you by how people react. Watch the numbers every day.
- Spam complaints: stay under 0.1%. At 0.3% you are in trouble.
- Hard bounces: stay under 2%. Above 3%, stop and clean the list.
- Unsubscribes: a sudden jump means the list or the message is wrong.
- Blocklists: check your domains on Spamhaus. A listing means stop now.
Set up SPF, DKIM and DMARC on every sending domain before the first email. Since May 2025, Microsoft refuses mail from domains that send 5,000 or more emails a day to Outlook addresses without them. (Microsoft Support)
Pre-send checklist
Run this before every campaign.
Your list
- ☐ Every contact has a known country.
- ☐ No one is in a consent-only country unless you have their consent (or they are your customer).
- ☐ Sole traders are removed where the country needs consent.
- ☐ No personal mailboxes (Gmail, Outlook.com) unless the person uses them for business.
- ☐ You know where each address came from, and it isn't a bought list.
- ☐ Everyone who opted out before is excluded.
Your emails
- ☐ The From name is a real person at your company.
- ☐ The subject matches the content. No fake "Re:" on the first email.
- ☐ Nothing in the copy invents a referral, a past meeting or a deadline.
- ☐ The footer has your legal name, postal address and an unsubscribe link.
- ☐ One-click unsubscribe headers are on.
- ☐ The sequence has five emails at most.
Your setup
- ☐ SPF, DKIM and DMARC pass on every sending domain.
- ☐ Each mailbox sends 30 cold emails a day or fewer.
- ☐ You check complaints, bounces and unsubscribes daily.
- ☐ Opt-out replies are handled the same day.
How Sellvance helps
We built Sellvance so that most of this checklist runs on its own. It checks every contact against the rules of their country, records where every address came from, and by default adds your company details and a one-click unsubscribe to every email. Opt-outs stop every campaign for that person and stay permanent. Before a campaign starts, you see who can be emailed and which contacts need attention, and why. If bounces or complaints spike, the mailbox pauses before your domain gets hurt. You can read the full rules on our Sending Standards page.
It is not legal advice, and it doesn't replace your own judgment. It does take the busywork out of staying on the right side of the line.
Country rules at a glance
A summary of the rules we checked for cold B2B email, as of October 2026. Countries marked * have sources that conflict or that we could not fully confirm. This is a starting point, not legal advice. In almost every country you may write to your existing customers about similar products, as long as they can opt out.
| Country | Cold B2B email | What you need |
|---|---|---|
| Allowed with sender details and an opt-out | ||
| United States | Yes | Honest headers and subject, mark it as an ad, postal address, opt-out that works for 30 days and is honoured within 10 business days |
| United Kingdom | Yes, to companies | Sole traders and some partnerships need consent. Named addresses: legitimate interest assessment and privacy notice |
| Ireland | Yes, to companies | Individuals need consent. A named address only if it is mainly used for that business. Each email counts as a separate offence |
| Sweden* | Yes, to companies | Sole traders need consent. A valid opt-out address |
| Portugal | Yes, to companies | Check the register of companies that refused mail. Individuals need consent |
| Estonia* | Yes, to company addresses | Private individuals need consent. A working unsubscribe link |
| Norway* | Yes, to companies | Consumers need consent. Free, simple opt-out |
| Mexico* | Probably | Identify yourself, respect refusals and the REPEP register |
| Chile* | Probably | Check the No Molestar register. An address to send stop requests to |
| Colombia* | Yes, with limits | Send only Mon–Fri 07:00–19:00 and Sat 08:00–15:00, never on Sundays or holidays |
| Allowed only for published addresses | ||
| Canada | Yes, with proof | The address was published by the business, with no "no unsolicited email" note, and the offer fits the role. Keep a record of where and when you found it. Bought and scraped lists don't count |
| Australia | Yes, with proof | Published address and role fit, consent you can prove. No harvested lists. Unsubscribe within 5 business days |
| New Zealand | Yes, with proof | Address published in a business capacity, offer fits the role. You must prove it. Unsubscribe within 5 business days |
| Japan | Yes, with proof | Business address published online with no refusal of ads. Sender name, address and an opt-out notice |
| Slovakia | Yes, with proof | Only addresses the company published, for example on its website. Not guessed or scraped |
| Netherlands | Yes, with proof | Only addresses the business published for commercial messages |
| Allowed under conditions | ||
| France | Yes, if relevant | The offer must relate to the person's job. Tell them about it and let them object |
| Finland | Yes, to organisations | firstname.lastname counts as a person: the offer must clearly relate to their job. Sole traders count as individuals |
| Belgium | Only to generic addresses | info@ and contact@ are fine. Named addresses need consent |
| Bulgaria | Yes, to companies | Check the register of companies that opted out first |
| Turkey | Yes, to merchants | Your MERSIS number and trade name, registration in IYS, opt-out handled within 3 business days |
| Consent required | ||
| Germany | No | Prior consent, also for companies |
| Austria | No | Prior consent, also for companies |
| Italy | No | Prior consent, even for info@ addresses |
| Spain | No | Prior consent. Mass sending moves the fine to €30,001–150,000 |
| Poland | No | Prior consent from every recipient |
| Denmark | No | Prior consent, also for info@ addresses |
| Greece | No | Prior consent, also for companies |
| Lithuania | No | Prior consent. Up to €3,000 per email |
| Malta | No | Prior explicit written consent |
| Czech Republic* | No | Prior consent |
| Romania | No | Prior consent, no business exemption |
| Switzerland | No | Prior consent for mass ads, also for companies |
| South Korea | No | Prior consent. The subject must start with the local "advertisement" label |
| Israel | No | Prior written consent. One email to a business asking for consent is allowed |
| Unclear: treat as consent required | ||
| Cyprus*, Latvia*, Slovenia*, Luxembourg*, Hungary*, Croatia*, Iceland*, Liechtenstein* | Not until confirmed | Sources disagree on whether companies need consent. Ask for consent, or check with a local lawyer first |
FAQ
Is cold email legal? In many countries, yes, for business contacts, as long as you identify yourself and offer an easy opt-out. In others, such as Germany, Austria, Italy, Spain and Poland, you need prior consent even for companies. Check the recipient's country, not yours.
Does sending only a few emails make it legal? No. No law sets a minimum. One email to the wrong person in the wrong country breaks the rule just like a thousand. Volume only raises the penalty and the deliverability risk.
Can I email existing customers without consent? Often, yes. EU law allows emailing your own customers about similar products, as long as they could refuse when you got their address and can opt out in every email. Check the details for each country.
Is a bought list okay if the vendor says it is GDPR compliant? Not by itself. In the Italian case, the regulator said a vendor's general GDPR statement was not enough. You have to check where the data came from.
Do I need an unsubscribe link in a plain, personal-looking email? Yes. Almost every anti-spam law requires a way to opt out, and Gmail and Yahoo require one-click unsubscribe from bulk senders. A "reply stop" line alone is weaker than a working link.
What spam complaint rate is safe? Keep it under 0.1%, and never let it reach 0.3%. A bulk sender above 0.3% gets no help from Gmail until they stay under that line for seven days in a row.
Can I email someone at a Gmail address if they are a business owner? Only if they really use that address for their business, for example as the contact on their own website, or if they are your customer. Otherwise treat it as a private address.