Cold Email Laws by Country for B2B, With Official Sources

Cold email to business contacts is legal in some of the countries covered here and blocked by a consent rule in others. In the US, and for UK companies, you can send the first email and let people opt out. In Germany and the Czech Republic, the statute asks for consent first, even for a company address.

One list, several countries, several rulebooks. Check the country first.

The short version, country by country:

• United States: no consent needed. Every email must offer an opt-out and honor it.
• United Kingdom: companies and LLPs can be emailed without consent. Sole traders and some partnerships need consent or the soft opt-in.
• EU under GDPR: direct marketing "may be regarded" as a legitimate interest, after a balancing test.
• Germany and the Czech Republic: prior consent, and the statute text makes no exception for business recipients.
• Canada: consent before the first message. Implied consent covers only narrow cases.
• Australia: consent, express or inferred, and the sender has to prove it. Inferred consent comes with conditions, so check them before the first send.

Every rule below was checked against the statute or the regulator's own page, most of them on 27 September 2026 and the rest in early October 2026. Two exceptions are labeled in the text: a law firm summary for the Australian penalty example and the onus of proof, and a secondary copy of the ePrivacy Directive. This is not legal advice. Use it to prepare the questions you take to a lawyer.

The rules in one table

Each row links to its source in the country sections below. Where the official text sets no figure, the cell says so instead of borrowing one from a vendor blog.

How to read the penalty column

The figures in that column look comparable. They are not.

Check the denominator first. The US figure is per email. Canada's is per violation. Australia counts per day, scaled by how many messages broke the rules that day. GDPR's percentage is of total worldwide turnover for the preceding financial year. A ceiling per email and a count per day cannot be compared.

Then check the grade of the source. The GDPR, Czech and Canadian penalty figures come from statute text. The US figure comes from the FTC's own guide. The Australian dollar example comes from a 2023 law firm summary, because the regulator's guidance does not print a dollar figure.

A maximum is a ceiling. Canada's Act, for example, tells the regulator to weigh the nature and scope of the violation, past history, any financial benefit and the sender's ability to pay. The ceiling is where that weighing stops, which says little about where it usually lands.

Some guides quote Australia as one flat amount per day. The Act works in penalty units, and the dollar value of a unit changes over time, so any flat figure carries a date whether it prints one or not.

Where the first email can go out without consent

United States: opt-out, with no B2B exception

The FTC's CAN-SPAM compliance guide lists no consent requirement for a commercial email. It does list rules every such email has to follow, and it says plainly that "the law makes no exception for business-to-business email."

Five duties apply to every message: truthful header data, a non-deceptive subject, an ad label, your real postal address and an opt-out that works. Each opt-out has to be processed within 10 business days.

Each separate email in violation can cost up to USD 53,088. A four-step sequence to 1,000 people is 4,000 separate emails. If the template breaks the rules, each one carries its own ceiling.

One more line matters for anyone who outsources. The FTC says you "can't contract away your legal responsibility" by hiring another company to send for you, and it tells you to monitor what others do on your behalf.

United Kingdom: companies yes, sole traders no

The ICO's guide to electronic mail marketing under PECR splits recipients in two.

Corporate bodies, such as companies and LLPs, can be emailed without consent. Individuals, sole traders and some partnerships need specific consent or the soft opt-in first.

The soft opt-in is narrower than it sounds. It covers existing customers who bought or negotiated for something similar and were given a simple way to opt out when their details were collected and in every message since. According to the ICO, prospective customers and bought-in lists fall outside it.

The ICO adds that emailing named employees at a company can still raise data protection questions. The company carve-out settles the email rule and leaves that side open.

No message may disguise the sender, and each one must give a valid address to opt out. Opt-outs have to be acted on promptly.

Two caveats. The PECR page states no fine figure. The ICO's summary of the Data (Use and Access) Act says PECR penalties now line up with UK GDPR, "the same in most cases." And the page warns that, because of the Data (Use and Access) Act, it "is under review and may be subject to change." If your list is British, this is the row to re-check first.

The EU baseline: legitimate interest, with a test attached

GDPR has no cold email article. Most guides lean on the closing sentence of Recital 47: "The processing of personal data for direct marketing purposes may be regarded as carried out for a legitimate interest."

"May be regarded" leaves room for a no. The same recital says a legitimate interest needs careful assessment, including whether the person could reasonably expect this use of their data at the time and in the context the data was collected. If their interests and rights outweigh yours, the basis fails.

The practical way to show that assessment is a written note made before you send. Why this person, why this message, where the address came from, and whether someone in their role would expect to hear from a company like yours.

The ceiling is in Article 83. The upper tier reaches EUR 20 million or, for a company, 4% of total worldwide annual turnover for the preceding financial year, whichever is higher. That tier covers the lawful-basis rules in Article 6 and the right to object in Article 21.

A lower tier, EUR 10 million or 2%, covers other obligations. Fine histories are a separate subject and I am leaving them out here.

GDPR does not settle the question on its own. Member states have their own laws on marketing email, and some are much stricter than the recital suggests. Germany and the Czech Republic are two of them.

Germany and the Czech Republic ask for consent first

Germany: UWG section 7

Section 7(2) of the German Act Against Unfair Competition treats advertising by electronic mail without the recipient's prior express consent as an unreasonable nuisance.

The text does not separate consumers from other market participants for email. A general B2B carve-out, like the UK's company rule, is simply not in the section.

The same subsection covers content. An advertising message that disguises or hides the sender, or gives no valid address where the recipient can ask for such messages to stop, also counts as an unreasonable nuisance.

Section 7(3) gives one narrow exception. A business that got a customer's address in connection with a sale may email that customer about its own similar products. The customer must not have objected, and must be told clearly, when the address is collected and in every message, that they can object at any time.

A cold prospect is, by definition, not that customer. For a German list, the working assumption is consent first.

Czech Republic: Act 480/2004

The Czech rule is even more explicit. Section 7(2) of Act No. 480/2004 Coll. allows electronic contact details to be used for commercial communications only for users who gave prior consent.

Section 2 defines a user as any natural or legal person. So the consent rule covers a company address as much as a private one, and this time nobody has to infer it.

There is an existing-customer exception in section 7(3), for similar products, with a simple and free way to refuse in every message. Section 7(4) adds that a commercial message must be clearly marked, must not hide the sender and must carry a valid address for opting out.

Under section 11(2), a business commits an offense when it sends commercial email in bulk or repeatedly without consent, unmarked, with a hidden sender or with no valid opt-out address. Section 11(5) sets the fine for that at up to CZK 10 million.

Why do the rules differ by country? Article 13(5) of the ePrivacy Directive applies the consent and opt-out rules to subscribers who are natural persons. For companies, member states only have to make sure their interests against unsolicited messages are "sufficiently protected" under national law.

Recital 45 of the same Directive says it does not affect the arrangements member states make to protect legal persons from direct marketing.

So each member state sets its own rules for email to companies. The table covers 2 of them, each read against the statute. If your list reaches a third EU country, find that country's own law before you trust any "EU" summary, this one included.

Canada and Australia: consent before the first send

Canada: CASL

Canada works the other way around from the US. Consent has to exist before the first commercial message, according to the CRTC's guidance on implied consent.

Express consent, an active opt-in, lasts until the person withdraws it. Implied consent is narrower. Section 10(9) of CASL lists three routes:

• An existing business or non-business relationship. For a business relationship, the CRTC and section 10(10) of the Act count 2 years from the last purchase or contract, or 6 months from an inquiry.
• An address the person published conspicuously, or had published, but only if the message relates to the person's role or duties and there is no statement next to the address saying they do not want unsolicited messages.
• An address the person gave you themselves, for example on a business card, without saying they do not want unsolicited messages, and only if the message relates to their role.

The time limits belong to the relationship route only.

A truly cold contact has no relationship with you and never handed you the address, so the published-address route is usually the only one left. Its conditions matter: an address in a directory is not enough on its own, and the message has to fit the person's job.

Every message needs a way to unsubscribe at no cost to the recipient. Under section 11 of the same Act, the address or link you give for it has to stay valid for at least 60 days after the send, and you get 10 business days to act on a request.

The penalty is in the Act itself. Section 20 of CASL caps an administrative monetary penalty at CAD 1 million per violation for an individual and CAD 10 million for any other person.

Australia: Spam Act 2003

The ACMA's guidance for senders sets out three duties: have consent, identify yourself with contact details, and include a working way to unsubscribe.

Consent can be express or inferred.

Do not assume a work address on a website or in a directory counts as inferred consent. For Australia, the ACMA's guidance on avoiding spam says you may infer consent only if the recipient "knowingly and directly" gave you their address and could reasonably expect marketing from your business.

The ACMA adds that this usually means "a provable, ongoing relationship with your business," with marketing directly related to that relationship. Read the guidance before the first send and keep any inferred-consent reasoning in writing.

In Norton Rose Fulbright's summary of the Act, a law firm's reading published in 2023, the business that sends the message "bears the onus of establishing consent."

The same summary says messages sent more than 5 business days after an unsubscribe breach the Act.

Penalties are counted per day, by the number of messages sent in breach that day. In the summary's worked example, more than 50 messages without consent in a single day meant 1,000 penalty units. At the value that applied from 1 July 2023, that was AUD 313,000.

Mass senders can send hundreds or thousands of messages a day for months, so the same summary says penalties "may reach to tens of millions."

I have not converted the 2023 example into a 2026 figure, because the penalty-unit value is indexed and changes; check the current figure before quoting it. The structure is the part that matters: more messages on more days means a bigger number.

What every cold email should carry, wherever it lands

The consent question changes country by country. The contents of the email change much less. This is what the sources above spell out, and where:

The technical side of identity, meaning the sending domain, authentication records and mailboxes, belongs with the setup work that comes before the first send. The law asks for an honest sender, and the setup lets a receiving server check that claim.

One campaign, several countries

One B2B list can easily span several rows of the table. A list of European software buyers, for example, can hold British, German and Czech addresses side by side.

Here is how to keep a mixed list under control:

1. Add a country column before anything else. Every contact gets the country the rules will be judged by. Without it, you cannot apply the table at all.
2. Split the list by row. US contacts and UK corporate addresses can go into an opt-out flow. Germany, the Czech Republic, Canada and Australia need a consent record, or a route the local rules allow, before the first send. Any other EU country waits until you have checked its own law.
3. Record where each address came from. Canada's implied-consent routes, the UK soft opt-in and GDPR's reasonable-expectation test all turn on it. A bought or scraped file with no source column answers none of them, one more reason the list outweighs the copy.
4. Keep one suppression list across every country and every tool. An opt-out in a British campaign should also stop the Canadian one, and the deadlines above are measured in days.

That is also how my team works. For Germany, Austria and the Czech Republic we send no cold email without a compliant basis and use LinkedIn instead, and anyone who asks us to stop goes on an exclusion list that every later campaign checks.

If an agency sends for you, all four still apply.

The FTC's line about not contracting away responsibility is the US version of a bigger question. Ask any agency before you sign: who keeps the consent records and the suppression list, and what happens to them when the contract ends.

It sits well next to the other questions to put to a lead gen agency.

Why this page carries a date

A disclosure first: my team sends cold email and LinkedIn outreach from Prague, so the Czech row is the law I work under.

Rules like these move, so every row names its source, and all of them were read again in late September and early October 2026.

Country column first. One suppression list for every tool. Then send.

Sending into several countries and unsure which rulebook comes first? Book a call and I will help you set up a country column and one suppression list.