The Legal Side of Cold Email: A Complete Compliance Guide for 2026
Cold email is one of the most powerful revenue channels in B2B sales. But it is also one of the most legally misunderstood.
Every week, founders ask: "Is cold email legal?" The answer is: Yes, in most jurisdictions, cold B2B email is completely legal — but only if you follow specific rules that vary by country, region, and even industry.
This guide is the definitive 2026 compliance reference for B2B sales teams, agencies, and founders who want to scale outbound without ever risking a fine, lawsuit, or domain blacklist.
The Compliance Scenario: "The €16,000 Fine"
Meet Ethan, a SaaS founder expanding his product into the EU market.
- The Mistake: He scraped 5,000 business emails from LinkedIn and blasted them all with a single campaign. No unsubscribe link. No company address. No opt-out mechanism.
- The Consequence: A German prospect reported the email to their local data protection authority. Under GDPR, the authority issued Ethan's company a €16,000 fine for non-compliant unsolicited commercial communication.
- The Lesson: Had Ethan included a proper legal footer, an unsubscribe mechanism, and documented his "Legitimate Interest" basis, the exact same campaign would have been perfectly legal.
The 3 Major Legal Frameworks You Must Know
1. CAN-SPAM Act (United States)
CAN-SPAM is the federal law governing commercial email in the US. It is the most permissive framework in the world for cold email.
What CAN-SPAM Requires:
| Requirement | Details |
|---|---|
| Accurate "From" line | Your name and email address must be real |
| Non-deceptive subject line | Subject must accurately reflect the email content |
| Physical postal address | You must include a valid physical business address |
| Opt-out mechanism | You must provide a clear way to unsubscribe |
| Honor opt-outs within 10 days | Once someone unsubscribes, you have 10 business days to remove them |
| Identify as an ad | If the email is an advertisement, it must be labeled as such |
What CAN-SPAM Does NOT Require:
- Prior consent or opt-in (you CAN email someone who hasn't asked for it)
- Double opt-in confirmation
- "Legitimate Interest" documentation
Penalty: Up to $51,744 per individual email that violates CAN-SPAM.
Key Takeaway: In the US, cold B2B email is fully legal as long as you include an unsubscribe link, a physical address, and an honest subject line.
2. GDPR (European Union / UK)
GDPR is the world's most strict data privacy regulation. However, it does NOT outright ban cold B2B email.
The "Legitimate Interest" Loophole: Under GDPR Article 6(1)(f), you can send unsolicited B2B emails if you can demonstrate a "Legitimate Interest" in contacting the person. This means:
- The recipient's business is relevant to your product or service.
- You are contacting them in their professional capacity (not personal email).
- You have a reasonable expectation that they would find your outreach relevant.
What GDPR Requires for Cold B2B Email:
| Requirement | Details |
|---|---|
| Legitimate Interest Assessment (LIA) | Document why contacting this prospect is justifiable |
| Clear identity disclosure | State who you are and your company name |
| Easy opt-out | Provide a one-click unsubscribe mechanism |
| Data processing disclosure | Explain what data you hold and why |
| Right to erasure | If they ask, you must delete all their data within 30 days |
Penalty: Up to €20 million or 4% of annual global revenue (whichever is higher).
Practical Tip: If you are emailing EU prospects using Mailshrine, ensure your CSV includes a "Source" column (e.g., "LinkedIn Profile," "Company Website") to document your Legitimate Interest justification.
3. CASL (Canada)
Canada's Anti-Spam Legislation (CASL) is the most restrictive cold email law in the Western world.
The Key Rule: CASL requires Express Consent before you can send commercial electronic messages. This means, in theory, cold email to Canadian businesses is prohibited unless you have one of these exceptions:
| Exception | Allows Cold Email? |
|---|---|
| "Conspicuous Publication" | Yes — if the recipient's email is publicly listed on their website AND your email is relevant to their professional role |
| Existing Business Relationship | Yes — if you have transacted with them in the past 2 years |
| Referral | Yes — if someone referred you (must name the referrer) |
Penalty: Up to $10 million CAD per violation.
Key Takeaway: For Canadian prospects, only email addresses that are publicly listed on company websites with no "do not email" restrictions.
4. Spam Act 2003 (Australia)
Australia's Spam Act covers all commercial electronic messages sent to or from Australia.
Key Requirements:
| Requirement | Details |
|---|---|
| Consent | You need either express consent or "inferred consent" (existing business relationship, publicly listed email) |
| Identify yourself | Include your name, business name, and ABN (Australian Business Number) |
| Unsubscribe mechanism | Functional unsubscribe that works for at least 30 days after sending |
| Honor opt-outs within 5 days | Faster than CAN-SPAM's 10-day window |
Penalty: Up to $2.22 million AUD per day for serious violations.
Key Takeaway: Australia treats "inferred consent" similarly to GDPR's Legitimate Interest — if the email is publicly listed and your product is relevant to their business role, you can email them.
Global Quick-Reference: Region-by-Region Comparison
| Rule | US (CAN-SPAM) | EU (GDPR) | Canada (CASL) | Australia (Spam Act) |
|---|---|---|---|---|
| Prior consent needed? | No | Legitimate Interest | Yes (with exceptions) | Inferred or Express |
| Unsubscribe required? | Yes | Yes | Yes | Yes |
| Physical address required? | Yes | Recommended | Yes | Yes (ABN required) |
| Opt-out compliance window | 10 business days | "Without undue delay" | 10 business days | 5 business days |
| B2B cold email allowed? | ✅ Yes | ✅ With LIA documentation | ⚠️ Limited exceptions | ✅ With inferred consent |
| Max penalty | $51,744/email | €20M or 4% revenue | $10M CAD | $2.22M AUD/day |
The Universal Compliance Checklist
Before you send any cold email campaign in 2026, verify all 9 requirements:
- Your real name and company name are visible in the "From" fieldNot completed
- The subject line accurately describes the email contentNot completed
- Your physical business address is included in the footerNot completed
- An unsubscribe link (or "reply STOP") mechanism is presentNot completed
- You are sending to a business email, not a personal addressNot completed
- You have documented where you found their email (LinkedIn, website, etc.)Not completed
- You are honoring unsubscribes within 5-10 business days (per jurisdiction)Not completed
- Your sending domain has valid SPF, DKIM, and DMARC records configuredNot completed
- You have a published DMARC policy of at least p=quarantine (required for 5,000+ daily senders in 2026)Not completed
The Perfect Compliant Cold Email Footer (Copy-Paste Ready)
---
{Your Name} | {Title}
{Company Name}
{Street Address}, {City}, {State} {ZIP}
>
You are receiving this email because your professional profile on {Source} suggests our {Product} may be relevant to your team.
If you prefer not to receive further messages, simply reply "STOP" or [click here to unsubscribe].
This footer satisfies CAN-SPAM, GDPR, and most international compliance requirements simultaneously.
How Mailshrine Helps You Stay Compliant
Mailshrine has built-in compliance safeguards:
- Automatic Unsubscribe Handling: When a prospect replies "STOP" or "Unsubscribe," Mailshrine automatically adds them to a global suppression list.
- Bounce Management: Hard bounces are instantly removed from active sequences, protecting your sender score.
- Source Tracking: Mailshrine's CSV import tracks the "Source" field for each contact, giving you a documented Legitimate Interest audit trail.
- Rate Limiting: Mailshrine's Natural Dispersion Engine prevents you from ever exceeding safe sending thresholds.
What Happens If You Get Caught: Real Enforcement Cases
These are not hypothetical — they are real penalties issued to companies in recent years:
| Company | Violation | Penalty |
|---|---|---|
| Compu-Finder (Canada) | Sent emails without consent or proper unsubscribe | $1.1 million CAD |
| Uber (France) | GDPR data processing violations in email communications | €400,000 |
| Flurry (US) | Deceptive subject lines and failure to honor opt-outs | $3.5 million USD |
| Various SMBs (Germany) | Unsolicited B2B emails without Legitimate Interest documentation | €5,000-€50,000 per case |
The pattern is clear: the fines are not for sending cold email. They are for sending cold email without the proper compliance footer, unsubscribe mechanism, or consent documentation.
Citations & References
- Reference: FTC: CAN-SPAM Act Compliance Guide
- Reference: GDPR.eu: Legitimate Interest Explained
- Reference: Canadian Government: CASL Overview
Written by Ethan H., Compliance Consultant. Ethan advises Series A and B startups on building legally bulletproof outbound email programs that scale across US, EU, and Canadian jurisdictions.
