Is cold email legal? CAN-SPAM, GDPR and what you must include

Cold email is legal in the United States, the UK and the EU, with conditions that differ by jurisdiction and are stricter for consumers than for businesses. What is not legal is hiding who you are, lying about why you are writing, or ignoring someone who asks you to stop.

This is a practical summary, not legal advice. For a specific situation, especially consumer outreach in the EU, take advice.

United States — CAN-SPAM

CAN-SPAM does not require prior consent for B2B email. It does require:

• Accurate headers. The From, Reply-To and routing information must identify you truthfully.
• A non-deceptive subject line. It must reflect what the message is about.
• Identification as a commercial message, which a clear business context satisfies.
• A valid physical postal address. This one is skipped most often and it is explicit in the statute.
• A working opt-out mechanism, honoured within 10 business days, with no fee or hoops.

Penalties are assessed per email, which is why a large non-compliant campaign is a serious matter rather than a warning.

EU and UK — GDPR and PECR

Stricter, and the structure is different. GDPR governs the personal data you hold; PECR (UK) and the ePrivacy rules govern the sending.

For B2B outreach you generally rely on legitimate interest as your lawful basis, which requires that:

• The message is genuinely relevant to the person's professional role.
• You can show how you obtained their data and why contacting them is reasonable.
• You give them a clear way to object and act on it immediately.
• You tell them where their data came from if they ask.

For consumers in the EU and UK, you generally need prior consent. Cold email to private individuals is the area with real exposure.

GDPR also gives people rights you must be able to service: access, correction, erasure, and objection. If you cannot delete someone's data on request, that is a compliance gap regardless of how your emails are written.

What should be in every email

1. Your real name and your company's real name.
2. A reply-to address that reaches a monitored mailbox.
3. A physical postal address — a List-Unsubscribe header satisfies the opt-out mechanism, but not this.
4. A clear way to opt out, honoured without conditions.
5. An honest subject line.

The practices that create real risk

• Continuing after someone asks you to stop. The clearest violation there is, and the easiest to avoid.
• "Re:" on a first email to imply an existing conversation. That is a deceptive header.
• No postal address. Explicitly required by CAN-SPAM.
• An opt-out that does not work or that requires logging in.
• No record of where data came from, when GDPR applies.
• Consumer addresses in the EU or UK without consent.

How RichLead handles this

Every outbound email carries a List-Unsubscribe header, so recipients can opt out through their mail client in one click. Opt-outs and bounces go to a workspace-wide suppression list that every campaign checks before sending, and that list cannot be partitioned per team member — so one person's opt-out protects everyone's sending. Suppressed and blacklisted contacts are blocked at the point of send, not filtered in the interface.

Reply detection also classifies unsubscribe requests written as ordinary replies ("take me off your list") and suppresses them, because people ask to be removed in prose far more often than they click a header link.

What RichLead does not do for you: your postal address and your sender identity are yours to configure correctly, and whether legitimate interest applies to a given list is your assessment to make.