Do Cold Emails Need an Unsubscribe Link? US, UK and Canada

Usually, yes. A cold email that pitches a product or service is a commercial message. The US CAN-SPAM Act and Canada's anti-spam law, CASL require such messages to carry a working way to opt out. In the UK, PECR regulation 23 bans marketing email that gives no valid address for opt-out requests. B2B sales email is inside all three, and the rules differ by country.

The law asks for a method, and a clickable link is only one form of it. In the US, a clear "reply to opt out" line can meet the rule. Gmail adds its own layer: bulk senders must put a visible link in the body and one-click unsubscribe in the headers. That part is inbox policy, not law.

So the answer depends on two things: the law where the recipient sits, and the rules of the inbox they read in. Mix the two up and you will wrongly treat a footer link as optional everywhere, or as a legal must everywhere.

Cold outreach that works runs on at least 5-6 touch points, and the opt-out has to work in every one of them. A missing exit is the cheapest risk to remove. Whether you may email a stranger in the first place is a separate legal question, and in the UK and EU it turns on legitimate interest.

Which cold emails have to carry an opt-out?

Three things decide it: what the message does, where the recipient is and which mailbox they use. Content comes first. If the main purpose of the email is to sell, US, Canadian and UK rules all treat it as marketing.

That holds for founders, SDRs and agencies sending prospecting email from any tool. The exception is mail that is truly transactional or relationship-based, such as a receipt or an account notice.

Geography matters next. Our campaigns mostly reach buyers in the USA, the UK and Europe, in English. The exception is the prior-consent trio of Germany, Austria and Czechia: no cold email there without a compliant basis, so those buyers get LinkedIn outreach.

Here is how the rule sets compare.

What does CAN-SPAM require in the US?

The FTC is direct about scope. The law covers "all commercial messages" and "makes no exception for business-to-business email." A cold email to a plant manager is held to the same standard as a promo sent to a shopper.

Every such message has to explain clearly and conspicuously how the recipient can opt out. You can offer a reply address or another simple online route. The opt-out must stop every marketing message from you, including future campaigns, and you get 10 business days to act on it. The route itself must keep working for at least 30 days after each send.

Look at what the FTC leaves out. It never requires the words "unsubscribe link." A line such as "Reply 'no' and you won't hear from me again" can satisfy the US rule, as long as someone reads the replies and removes those people inside the deadline.

The FTC's guide puts penalties at up to $53,088 for each email that breaks the law, a maximum in effect since January 17, 2025 and still the guide's figure at the time of writing.

In August 2024 the agency announced that security camera maker Verkada would pay a $2.95 million penalty under CAN-SPAM. Verkada sent more than 30 million commercial emails over three years, and the FTC said those emails broke CAN-SPAM in four ways, including ignoring requests to unsubscribe.

What do the UK and Canada require?

UK: PECR and the ICO

PECR splits recipients in two. The consent rule in regulation 22 applies only to individual subscribers. Companies and LLPs (limited liability partnerships) are corporate subscribers, and the ICO's B2B guidance says you do not need their consent under PECR to email them.

The opt-out duty reaches further. Regulation 23 forbids marketing email that disguises who sent it or gives no valid address for opt-out requests. The ICO's guidance, updated 28 April 2026, applies both duties to every recipient. It also says opting out must be simple, and you should not make people create an account or log in to do it.

Timing is vaguer than in North America. Neither regulation sets a number of days, and the ICO only says to act "promptly." Corporate opt-outs carry a quirk: PECR does not strictly oblige you to honor them, yet the ICO says you should. Once a named person is on the other end, UK GDPR applies too, including their absolute right to stop direct marketing use of their data.

Ignoring this got more expensive this year. From 5 February 2026, the ICO can fine up to £17.5 million or 4% of global turnover under PECR, as the ICO announced when the Data Use and Access Act took effect.

Canada: CASL and the CRTC

Canada's wording is the strictest. The CRTC says the unsubscribe mechanism must be "simple, quick and easy" for the person using it. A link is fine if it opens a page where the person can unsubscribe straight away.

The CRTC calls a multi-step route non-compliant: click a link, move through several pages, log in, and only then find the option. If your opt-out page asks for a password, it fails.

The timing sits in the Act itself, section 11. The unsubscribe address or page must stay valid for at least 60 days after sending, and a request must be processed no later than 10 business days after it arrives. That validity window is twice the US minimum.

This is not legal advice. If you send to a country where one fine would hurt, have a local lawyer read your footer once.

What do Gmail and other inbox rules require?

Since February 1, 2024, Google's sender guidelines have set requirements for anyone sending to personal Gmail accounts. Most of the list for all senders is technical: domain authentication (SPF or DKIM), reverse DNS, encrypted delivery and a low spam complaint rate.

One-click unsubscribe and a clearly visible body link sit in a separate section, for senders of more than 5,000 messages a day. There, Google requires both for marketing and subscribed messages. The bulk sender FAQ excludes transactional mail and recommends fulfilling unsubscribe requests within 48 hours, far faster than any deadline the laws in the table set.

A founder sending 40 emails a day is not automatically blocked for missing the headers. The same FAQ says Google does not automatically reject messages or mark them as spam just because they lack one-click.

Below that line, adding the headers is still cheap insurance, so check whether your sending tool supports them before you choose one.

Other providers publish their own requirements, so read the ones your prospects actually use.

Is a plain-text opt-out enough?

Under US law, often yes. Gmail's one-click rule is different: it needs the headers.

In the US, the FTC explicitly accepts a return email address, so "reply stop" can work if you act on it in time. In Canada, the CRTC's email example is a link to an unsubscribe page, and its reply-with-STOP example is written for text messages. Reply-only email opt-outs have thinner written support there, so add a link for Canadian lists.

A body link and one-click are separate mechanisms. A body link sends the reader to a page. One-click, defined in RFC 8058, lives in the headers, and the sender adds 2 lines:

List-Unsubscribe: <https://yourdomain.com/u/abc123>
List-Unsubscribe-Post: List-Unsubscribe=One-Click

The standard requires an HTTPS link that identifies the recipient and the list, plus a valid DKIM signature covering both headers. The mail client then shows its own unsubscribe button and sends the request for the reader. Nobody has to open your website.

Plain text has one practical weakness. It depends on a human reading replies. That is why I want one inbox manager on every reply inbox, so nothing gets missed. A "stop" reply that sits unread in a shared inbox for 3 weeks is 15 business days old. That breaks the US and Canadian deadlines and is hard to call prompt in the UK.

My rule: anything promotional at real volume gets a visible link plus one-click headers. Keep a reply line too, because some people will reply anyway, and a plain line reads more human than a block of legal text. In our campaigns the 3rd follow-up is usually what works best, and a prospect who skipped email one meets your footer there for the first time. So every step carries the exit.

Does an unsubscribe link help deliverability?

A link will not lift you into the inbox by itself.

The damage runs the other way. A reader who wants out and cannot find the exit has one button left, and it says "Report spam." Each report lands on your sending domain, which is how a campaign ends up in the spam folder. Slow removals make it worse, because the same annoyed people keep receiving follow-ups.

My team configures SPF, DKIM and DMARC and warms every new inbox for at least 10 to 14 days before volume goes out, and every campaign runs on dedicated IP addresses. Cold outreach also runs on separate sending domains, never your main company domain, so a flagged sender never drags your invoices and support mail into spam.

Honor every opt-out, keep those addresses on a permanent suppression list, and never re-import them with the next lead file. We also verify every address before sending and hold the bounce rate below 0.5%, because a dirty list and a missing exit damage the same sender reputation.

What should you put in the email?

Pick the row that matches your list. If it mixes countries, the strictest one sets your footer.

The footer checklist:

• Sender name and company name
• A physical postal address (CAN-SPAM requires one in every commercial email)
• One plain sentence saying how to opt out
• A working link to a one-step unsubscribe page
• One-click headers if your sending tool supports them
• A named person who checks opt-out replies every business day

A minimal version, with your own details in the brackets:

[Your name], [Company], [Street, city, country]
Not relevant? Reply "stop" or unsubscribe here: [link]. Either way, you won't hear from me again.

Keep the exit easy. No "tell us why" form, no gray 7-pixel text, no "manage preferences" maze. And never write "reply to unsubscribe" if nobody reads that inbox. Fix that first.

When can you skip the link?

Only when the message is truly transactional or relationship-based. The FTC guide lists five transactional or relationship categories. A message outside all five must give recipients a way to opt out.

A prospecting sequence never fits. Writing "following up on our conversation" above a pitch does not turn a sales email into a relationship message.

Existing customers do not exempt promotional mail either. In August 2023 the FTC charged that Experian sent marketing emails to people with Experian accounts without an unsubscribe link. The agency said those emails had nothing to do with the accounts, so they needed an exit. If a real customer relationship did not cover promotional mail there, a cold sequence to strangers has no claim at all.

Before your next send, mail your own sequence to a personal Gmail address. Click the opt-out, reply "stop" from a second address, and time how long each removal takes. If either takes longer than 48 hours, fix that before you touch the copy.

Not sure your footer and opt-out setup hold up across the countries on your list? Book a call and send me the footer, and I will go through it with you.