Cold email is legal in most jurisdictions - but the rules differ significantly between the US, EU, and Canada. Getting this wrong means FTC complaints, GDPR fines (up to 4% of global revenue), or CASL penalties (up to $10M CAD per violation). This guide breaks down all three frameworks, what they require, and how to stay compliant across all of them.
No prior consent required for B2B email. Must include physical address, opt-out mechanism, accurate sender ID. Honour opt-out within 10 business days. Fine: up to $51,744 per email in violation.
No prior consent required if “legitimate interest” applies to B2B outreach. Must be relevant to professional role. Must include opt-out. Process opt-out immediately. Fine: up to €20M or 4% of global annual revenue.
Prior express OR implied consent required for all commercial electronic messages (including B2B email). Consent must be documented. Opt-out must be honoured within 10 business days. Fine: up to $10M CAD per violation.
The sender must be clearly identifiable. Using a fake name or company is a violation.
Subject line must reflect the content of the email. “Quick question” is fine. “Your invoice is ready” when there is no invoice is not.
Street address, PO box, or private mailbox registered with a commercial mail-receiving agency.
A reply-to opt-out (“reply STOP to unsubscribe”) is acceptable. Must work and be monitored.
Once a recipient opts out, they must not receive another commercial email from you within 10 business days.
CAN-SPAM does NOT require consent for B2B email. You may contact business email addresses without prior permission.
Not required for most B2B transactional-style cold emails. Required for mass commercial promotional emails.
CAN-SPAM is an opt-out law, not an opt-in law. Opt-in is best practice but not legally required.
GDPR permits B2B cold email under the Legitimate Interest legal basis (Article 6(1)(f)). This means you can send cold email to business professionals without prior consent - but you need to be able to justify why the contact is relevant and proportionate.
You are emailing the VP of Sales about a sales tool. The email is relevant. Emailing the same person about a consumer product is not.
Keep a brief record of why you are contacting each person and how you got their data.
Provide a clear way to opt out in every email. Process requests immediately - not within 10 days as CAN-SPAM allows.
Same as CAN-SPAM - the From name must be real and the company must be identifiable.
Personal emails (gmail, yahoo) have higher GDPR protection. B2B legitimate interest is for business email addresses tied to a professional role.
If you cannot document where the contact data came from and why each contact was selected, GDPR legitimate interest is hard to justify.
CASL requires consent BEFORE sending - unlike CAN-SPAM and GDPR’s legitimate interest, which permit sending without prior consent. Implied consent exists in limited cases (existing business relationship, published email address in a professional context), but must be documented. If you are sending to Canadian business email addresses and cannot document consent or implied consent, you are at risk.
Recipient actively opted in to receive commercial email from you. Strongest form. No expiry if properly documented.
You have an existing business relationship - e.g. the person is a current or recent customer, or has made an inquiry in the last 2 years.
The person published their email address (e.g. on a website or LinkedIn) AND the email is relevant to their business role or function. This is the most relevant for cold B2B outreach.
Sending to a Canadian business email address with no prior relationship and no published email = CASL violation. Fines up to $10M CAD per violation.
If you are unsure whether a contact is in Canada, treat them as Canadian when the email address or company registration suggests a Canadian context. When in doubt, exclude or obtain explicit consent first.
A verified list removes invalid addresses that inflate your bounce rate - and helps you maintain the data hygiene that regulators expect. 100 free credits, no card required.
Ayoub built BounceZero's 5-stage validation pipeline, its dedicated BGP-announced IP infrastructure, and the Patroni HA PostgreSQL cluster behind every verification. Previously built high-volume email delivery infrastructure. Trained at 1337 Benguerir (École 42 network, 2019). Open-source: bgp_analyzer.
Strategy, writing, sequences, and lead generation
8 templates by persona (VP Sales, CTO, CMO, RevOps, Finance) + benchmarks + anatomy guide
50 examples by pattern: curiosity, personalised, pain-led, referral, compliment-open - with open rate benchmarks
5-layer stack, spam word list, 20-point checklist - inbox every time
25-point cold email deliverability checklist for 2026: DNS authentication, domain warmup, list
Retainer vs performance pricing, tool stack costs, and red flags to watch
Service model, pricing, tools, and first 5 clients
Continue through related topics