Is cold email legal?
Yes in the US under CAN-SPAM, with rules on every message. In the EU, B2B outreach can rest on GDPR's legitimate interest.
Want to see it first? Book a demo
The short answer
- Cold email is legal in the United States under the CAN-SPAM Act, which the FTC describes as an opt-out law: no consent is needed before the first commercial email.
- CAN-SPAM requires honest headers, a subject line that doesn't mislead, a valid postal address and a working opt-out honored within 10 business days, per the FTC's compliance guide.
- Under GDPR, B2B cold email can rest on legitimate interest, Article 6(1)(f), backed by a written assessment, and the recipient can object to direct marketing at any time under Article 21.
- Sending cold email from a CRM changes nothing about the law, but a CRM that suppresses opt-outs at send time makes the opt-out rule far easier to keep.
CAN-SPAM lets you send first and stop on request
CAN-SPAM is what the FTC calls an opt-out framework. You don't need permission before the first email. You do need every message to meet a fixed set of rules, and you must stop when the reader asks.
The FTC's guide lists the rules plainly. Your "From" and routing details must be true. The subject line can't mislead, and a promotional email must be clear that it's an ad. You need a valid postal address in the message and an opt-out that works. You have 10 business days to honor an opt-out request. The guide also says the law makes no exception for B2B email.
Penalties count per email, not per campaign. The FTC puts the maximum civil penalty at $53,088 per violation as of 2026. The company promoted and the company that sent the email can both be liable, even when a third party did the sending.
GDPR asks for a lawful basis before you send
GDPR works the other way round. Before you process someone's personal data, including a work email address, you need a lawful basis. For B2B outreach, that's usually legitimate interest under Article 6(1)(f). Recital 47 of the regulation says direct marketing may be a legitimate interest.
Legitimate interest isn't automatic. You write a short assessment: is there a real business reason to contact this person, is email needed for it, and does your interest outweigh what they'd expect? Under Article 21, anyone can object to direct marketing, and you must stop at once. Several EU countries also add national e-marketing rules on top, so the recipient's country matters. Read is cold email legal in the EU for the assessment in detail.
CAN-SPAM and GDPR side by side
| Question | CAN-SPAM (US) | GDPR (EU) |
|---|---|---|
| Consent before the first email | Not required | Not required for B2B if legitimate interest applies |
| What you document | Nothing up front | A legitimate interest assessment |
| Opt-out | Honored within 10 business days | Stop direct marketing at once on objection (Article 21) |
| Address in the email | Valid postal address required | Your identity and contact details in the privacy notice |
| B2B exception | None | Legitimate interest is the usual B2B basis |
| Maximum penalty | $53,088 per violation | Up to 4% of global annual turnover or €20 million |
Sources: FTC CAN-SPAM Act Compliance Guide for Business (ftc.gov) and Regulation (EU) 2016/679 Articles 6, 21 and 83 (eur-lex.europa.eu), checked September 2026.
What a CRM should do for you
The law puts the rules on you, the sender. Your CRM's job is to make them hard to break. The riskiest moment is the gap between building a list and sending to it: someone unsubscribes on Tuesday, and Thursday's step goes out anyway.
SalesCrew closes that gap twice. Suppression is enforced when an audience is frozen, and checked again at the moment of send. An unsubscribe or a bounce puts the contact on the suppression list automatically, and every AI-written send waits in the approval queue for a person first. Consent, the legitimate interest assessment and the content of each email stay with you as the sender. See how the outbound tools fit together.
Check the recipient's country, not yours
Questions
- Is cold email from a CRM legal under GDPR and CAN-SPAM?
- Cold email from a CRM is legal in the US under CAN-SPAM and can be lawful in the EU under GDPR, if you meet each law's rules. Sending from a CRM changes nothing about the law. It does make the opt-out and suppression rules easier to keep, because one list covers every send.
- Does CAN-SPAM apply to B2B cold email?
- Yes. The FTC's compliance guide states that CAN-SPAM makes no exception for business-to-business email. Every commercial email to a US recipient is covered, whether the reader is a business contact or a consumer.
- What is the penalty for breaking CAN-SPAM?
- Up to $53,088 per violation, per the FTC's guidance as of 2026. Each non-compliant email can count as a separate violation. Both the company promoted in the email and the company that sent it can be held liable.
- Do I need consent to cold email a business contact in the EU?
- Not always under GDPR. B2B outreach can rest on legitimate interest, Article 6(1)(f), backed by a written assessment. Some EU countries add their own e-marketing rules on top, so check the rules where the recipient lives.