Short answer: in the United States, yes, cold email to businesses is legal if you follow the rules. In some other countries it is much more restricted. This is a general overview from people who send email for a living. We are not lawyers and this is not legal advice, so check with one if you have a specific question.
The United States: CAN SPAM
The CAN SPAM Act covers commercial email, and despite what people often assume, it does apply to business to business messages. You do not need permission before sending. What you need is to follow these rules:
- Honest headers. The from name, reply address and routing information must be accurate. No pretending to be someone else.
- Honest subject lines. The subject cannot mislead the reader about what is in the message.
- Say it is an advertisement. It has to be clear the message is commercial. There is some flexibility in how you do this, so it's worth getting advice on your wording.
- A physical postal address. Every message needs a valid one. A registered post office box or a commercial mailbox can qualify.
- A working opt out. You must tell people how to stop hearing from you, and honor it within 10 business days. Do it right away, in practice.
- You stay responsible. Hiring a company to send on your behalf does not transfer the obligation. Both of you can be held responsible.
Penalties can run to more than $50,000 per violating email. The FTC adjusts that figure regularly, so look up the current number if it matters. Actual enforcement mostly focuses on deceptive behavior, but that is not a reason to be careless.
Canada: CASL
Canada is stricter. Canada's anti spam law generally requires consent before you send commercial email, though there are some limited exceptions for implied consent, such as a publicly listed business address with no notice against solicitation and a message relevant to the person's role. If Canadian companies are on your list, get proper advice before you send.
The European Union and the UK
GDPR treats a work email with someone's name in it as personal data. To contact these people you generally need a lawful basis, and "legitimate interest" is the one usually cited for B2B outreach. You also need to tell people where you got their data and let them object. Individual countries layer on their own rules, and some are much stricter than others. Germany is a well known example. If Europe is a target market, treat it as its own project with its own legal review.
US state laws
Several US states have their own privacy laws, and a few have rules about commercial messages. Most of the state privacy laws focus on consumers and many exclude business contacts, but that is not universal and California in particular covers a wider range. If you hold lots of contact data, ask a lawyer what applies to you.
Habits that keep you out of trouble
The legal rules are a floor. These habits go further, and they also improve your deliverability:
- Only contact people whose role makes the message relevant.
- Keep one suppression list across all campaigns, and check it before each send.
- Honor opt outs immediately, including casual ones like "please stop."
- Never use a fake "Re:" or "Fwd:" on a subject line.
- Keep a record of where each contact came from.
- Do not send to role addresses or scrape personal email accounts.
Rules for mailbox providers are a separate matter. Google, Yahoo and Microsoft have their own sending requirements, which we cover in our deliverability guide. Those can hurt you long before any regulator takes notice.
