← All posts

CAN-SPAM & GDPR for Cold Email in 2026: What's Legal, What's Not

October 12, 2026 · 6 min read · by ColdCrow

"Is cold email even legal?" It's the first question every founder asks — and the answer is yes, in the US and most of Europe, if you follow the rules. This is not legal advice, but here is the plain-English checklist that keeps most B2B outreach on the right side of the law.

CAN-SPAM: the US baseline (and it's generous)

CAN-SPAM applies to almost all commercial email sent to US addresses. The important thing: it does not require prior consent. You can cold-email a business contact — you just have to be honest. The requirements:

  • Accurate From line — your real name or business, nothing misleading.
  • Honest subject line — no bait-and-switch.
  • A clear opt-out — a working unsubscribe link (or reply with "unsubscribe") that you honor within 10 business days.
  • A physical address — a real street address in the footer.
  • Identify it as an ad — optional in the US, but good practice.

Penalties are per-email and can reach tens of thousands of dollars each, so the mechanics matter even though the bar is low.

GDPR and PECR: Europe is stricter

If you email EU or UK contacts, GDPR adds a layer. Cold email to a business address is generally treated differently from email to a consumer:

  • Legitimate interest is the usual legal basis for B2B cold outreach — but you must do a balancing test (is this relevant to their business, is it proportionate, are they a real prospect?).
  • Consumers need opt-in under PECR-style rules in most EU countries and the UK — don't cold-email personal addresses.
  • Honor objections instantly — if someone says stop, stop. No "one more email".
  • Be transparent — tell them who you are and, on request, where you got their address.

The 2026 compliance checklist

  1. Real sender name and business in the From line.
  2. Subject line that matches the content.
  3. Working unsubscribe link, honored within 10 business days (US) — ideally instantly.
  4. Physical business address in the footer.
  5. Target only business addresses with a genuine relevance to your product.
  6. No purchased lists, no scraped personal emails — verify addresses and relevance.
  7. Immediate stop on any opt-out or objection.

The practical takeaway

Legal cold email is short, honest, relevant and easy to opt out of. That happens to be exactly what gets replies — spammy volume and tricked subject lines are both illegal-risk and conversion-killers. Comply, keep it relevant, and the law is on your side.

ColdCrow helps you write the honest, relevant part — personalized cold emails with a deliverability score before you send.

Try it free →