Skip to main content
Academy · Module 2 of 9

The law of cold email

Five legal regimes, from opt-out (US) to consent-first (Canada, Australia). What each requires in the email, how fast opt-outs must be honored, and what counts as consent.

14 min read · Course overview

Objectives

In this module

  • Distinguish opt-out regimes (CAN-SPAM) from consent regimes (CASL, Australia's Spam Act).
  • List what every CAN-SPAM commercial email must contain.
  • Know when UK and EU B2B email needs consent, and why GDPR still applies to named contacts.
  • Apply the opt-out deadlines for each jurisdiction.
2.1

Two kinds of regime

Anti-spam laws split into opt-out regimes, where you may email first and must stop when asked, and consent regimes, where you need permission (express or implied) before the first email. The United States is opt-out. Canada and Australia require consent. The UK and EU sit between, depending on whether the recipient is a company or a person and on the GDPR status of their data.

Where you are based matters less than where your recipient is. A US company emailing Canadian prospects is subject to CASL. Relevance comes up again and again: France, Canada and Australia all tie permissibility to whether the message relates to the recipient's professional role [3,5,9].

2.2

United States: CAN-SPAM

The FTC is explicit that “the law makes no exception for business-to-business email” [1]. CAN-SPAM requires no prior consent, but every commercial email must:

  • Use accurate header and routing information (From, To, Reply-To).
  • Use a subject line that isn't deceptive. A fake “Re:” on a first email fails this.
  • Identify the message as an advertisement where applicable.
  • Include a valid physical postal address: a street address, a registered P.O. box or a commercial mail receiving agency.
  • Explain clearly how to opt out, with a mechanism that works for at least 30 days after sending.
  • Honor opt-outs within 10 business days, without charging a fee or asking for more than an email address.
  • Remain your responsibility even if an agency or tool sends for you.
  • Penalties run up to $53,088 per violating email as of the January 2024 inflation adjustment [1]; the figure is adjusted yearly.
2.3

United Kingdom: PECR and UK GDPR

Under the UK's PECR rules you may email corporate subscribers (companies, LLPs, government bodies) without consent, provided you identify yourself, give a valid address for opt-outs and keep a do-not-email list [2]. Individual subscribers, including sole traders and some partnerships, need consent or the “soft opt-in”, which covers only existing customers for similar products and never bought-in lists [2].

PECR not requiring consent doesn't mean anything goes. A named employee's address is personal data, so UK GDPR still needs a lawful basis, usually legitimate interests [2]. The ICO's updated guidance (March 2026) says legitimate interests can support direct marketing where it is proportionate and unsurprising, and the right to object to direct marketing is absolute [4].

The Data (Use and Access) Act 2025 raised the maximum PECR fine from £500,000 to £17.5 million or 4% of global turnover [6]. The government considered extending consent rules to B2B email and decided not to [6].

2.4

European Union: ePrivacy and GDPR

Article 13 of the ePrivacy Directive requires prior consent for unsolicited email marketing to natural persons, and leaves member states to protect legal persons' interests as they choose [7]. B2B rules therefore vary by country.

France is a useful example: the CNIL allows email to professionals without prior consent if the message relates to their job, such as software pitched to an IT director, and they can object easily. Generic addresses like info@ fall outside these principles [3]. Check each target country's rule before sending; don't assume France's applies everywhere.

GDPR applies to named business contacts everywhere in the EU. The EDPB's guidance on legitimate interest stresses that direct marketing doesn't automatically qualify: the purpose, necessity and balancing test still applies [8]. In practice: document a legitimate interest assessment, keep messages role-relevant, tell people in the first email where you got their data and how to object, and honor objections permanently.

2.5

Canada: CASL

CASL is the strictest of the five for cold outreach. You need consent before sending a commercial message, plus sender identification and an unsubscribe mechanism [5].

Implied consent exists in narrow cases: an existing business relationship (a purchase or contract in the past two years, or an inquiry in the past six months), or “conspicuous publication”, where the recipient published the address themselves, didn't say “no unsolicited messages”, and your message is relevant to their role [5]. The burden of proving it falls on you, and addresses from third-party lists generally won't qualify [5].

Unsubscribes must be processed within 10 business days and the mechanism must work for at least 60 days after sending. Penalties reach C$10 million per violation for organizations [10].

2.6

Australia: the Spam Act

Australia requires consent, express or inferred, plus accurate sender identification and a working unsubscribe [9]. Inferred consent can come from a conspicuously published address, but only if the message relates to the recipient's role [9].

Unsubscribes must be actioned within five working days, cost nothing, work for at least 30 days, and require no login or extra personal information [11]. The regulator enforces this: ACMA penalized Telstra A$626,000 in March 2025 because its unsubscribe process asked for a PIN or extra personal details [12].

Key takeaways

Remember this

  • B2B email is not exempt from CAN-SPAM; include a postal address and a working opt-out.
  • The recipient's country decides which law applies.
  • Canada and Australia need consent; published addresses only count when the message fits the recipient's role.
  • UK and EU named contacts are personal data, so GDPR applies even when ePrivacy rules don't require consent.
  • The fastest opt-out deadline wins: 48 hours for Gmail bulk senders, five working days in Australia, 10 business days in the US and Canada.
Exercise

Map your list to the law

Use one real list you plan to email.

  1. Step 1

    Break the list down by recipient country. Note which regime applies to each slice.

  2. Step 2

    For any Canadian or Australian contacts, write down the consent basis you'd rely on. If you can't name one, remove them.

  3. Step 3

    Check your email footer has a physical postal address and an opt-out link, and that opt-outs are suppressed across every campaign, not just one.

  4. Step 4

    For UK and EU contacts, draft the two sentences you'll include explaining where you got their address and how to object.

In AngelSend

Where this lives in the product

Postal address and footer

Settings → Compliance holds the physical mailing address CAN-SPAM requires; campaign emails carry it with an unsubscribe link in the footer.

Three do-not-email lists

Suppress an address for your account, a project or a whole team. A recipient who unsubscribes is recorded org-wide, and opting someone out cancels anything already queued to them.

Compliance archive

For teams that need records, the compliance archive keeps an append-only copy of every email sent and received in a project, captured before the email leaves.

Check yourself

Quiz

Pick an answer to see the explanation.

  1. Q1Does CAN-SPAM apply to business-to-business email?

  2. Q2Under PECR, can you send a cold email to a UK limited company without consent?

  3. Q3Which regime requires consent before a cold commercial email?

  4. Q4How quickly must an unsubscribe be actioned under Australia's Spam Act?

Sources

  1. [1]CAN-SPAM Act: A Compliance Guide for Business — U.S. FTC
  2. [2]Electronic mail marketing (Guide to PECR) — UK ICO
  3. [3]La prospection commerciale par courrier électronique — CNIL
  4. [4]ICO updates legitimate interests guidance after DUAA changes — DMA (UK)
  5. [5]Guidance on Implied Consent (CASL) — CRTC
  6. [6]The Data (Use and Access) Act: PECR reform — Mayer Brown
  7. [7]Directive 2002/58/EC (ePrivacy Directive) — EUR-Lex
  8. [8]GDPR: When Can Data Controllers Rely on Legitimate Interests? New Guidelines from the EDPB — Morgan Lewis
  9. [9]Spam Act 2003 (Cth), incl. Schedule 2 — Federal Register of Legislation
  10. [10]A Million Reasons to Comply: CRTC issues $1.1 million penalty — Blaney McMurtry
  11. [11]ACMA enforcement action: do your marketing communications comply with the Spam Act's unsubscribe rules? — Clayton Utz
  12. [12]Telstra penalised for spam breaches — ACMA

This course summarizes published rules, regulator guidance and third-party research as of October 2026. It is not legal advice; check with counsel before emailing into a jurisdiction. Vendor benchmark figures are each vendor's own data and definitions.

1. Getting to the inbox3. Who to email

Practice on
your own outreach.

Start with a $3.99 Starter Pack — no subscription required.

Get started freeBook a demo

Starter pack from $3.99 · CAN-SPAM compliant · Reputation protected