Cold Email Compliance in 2026: Running B2B Outbound Legally Under CAN-SPAM, GDPR, and CASL

Every outbound team eventually gets the same question from legal, and it almost always arrives the week before a big sending ramp: “are we allowed to do this?”

The honest answer is yes, in most B2B markets, with conditions. Cold email is not banned anywhere that matters commercially. What is regulated is how you obtained the address, what you claim in the message, whether the recipient can make you stop, and whether you actually stop. Teams get into trouble on the fourth one far more often than the first.

At GroomLead we build outbound systems on a pay-per-lead model, which means a suspended domain or a blocked sending identity costs us directly. That incentive has made us build compliance into the plumbing rather than into a policy document nobody reads. This guide is the version we use internally, written for operators rather than lawyers.

This is not legal advice. It is the operational checklist that keeps you out of the situations where you would need some.

Short answer

Is cold email legal in 2026? Yes, for B2B outreach in the United States, most of the EU, the UK, and Canada, provided you meet the rules of the recipient’s jurisdiction. The US (CAN-SPAM) permits unsolicited commercial email outright, requiring only accurate headers, a physical address, a clear opt-out, and honoring that opt-out within ten business days. The EU and UK (GDPR plus ePrivacy) require a lawful basis, usually legitimate interest, which in practice means a documented business relevance, a privacy notice, and a working objection path. Canada (CASL) is the strictest: it requires consent, express or implied, and implied consent has an expiry date.

The practical rule across all of them: know where the recipient is, be honest about who you are, make stopping trivial, and keep a suppression list you can prove works.

The four obligations that exist everywhere

Jurisdictions differ in the details, but every regime in scope for B2B outbound enforces some version of the same four things. If you build for these, local variation becomes a matter of tuning rather than redesign.

Obligation	What it means operationally	Where teams fail
Lawful basis or permission	A defensible reason this specific person is receiving this specific message	Buying a list with no provenance and no record of how it was built
Accurate identification	Real sender name, real company, real reply-to, non-deceptive subject line	Fake personal domains, subject lines implying a prior conversation that never happened
Working opt-out	One obvious way to stop, honored quickly and without conditions	Opt-out that only covers one sequence, or requires a reply the inbox nobody monitors
Suppression and retention	Opt-outs persist across tools, domains, and re-imports; data is not kept forever	A new sequence re-imports an old CSV and emails people who unsubscribed last year

The fourth row is where the real risk sits. Regulators rarely act on a single unwanted email. They act on patterns, and the clearest pattern of bad faith is contacting someone who already asked you to stop. That is also the complaint most likely to be filed, because it is the one that feels personal to the recipient.

United States: CAN-SPAM

CAN-SPAM is the most permissive major regime, and it is widely misunderstood in both directions. It does not require consent before sending. It also does not give you a free pass.

What it requires:

• Accurate header information. The from, reply-to, and routing data must identify the actual sender. Spoofing or disguising origin is the conduct the statute was written for.
• A non-deceptive subject line. It must reasonably describe the message. “Re: our conversation” to someone you have never spoken with is the textbook violation, and it is also the single most common tactic in low-quality outbound.
• Identification as an advertisement. The commercial nature must be clear from the message, though B2B outreach that plainly states its purpose generally satisfies this without a banner label.
• A valid physical postal address. A real street address or registered PO box for the sender.
• A clear opt-out mechanism, honored within ten business days, with no fee, no login, and no information required beyond the email address and an optional preference choice.

Penalties are assessed per email, which is what makes volume sending the aggravating factor rather than the offense. A sloppy 50,000-address campaign is not fifty thousand times more legal than a careful one.

State law sits on top of this. Several US states now impose additional disclosure or consent requirements, and a handful treat deceptive subject lines more aggressively than the federal baseline. If you send at meaningful volume into the US, treat the strictest applicable state standard as your floor rather than tracking fifty variants.

European Union and United Kingdom: GDPR and ePrivacy

Two instruments apply, and conflating them causes most of the confusion. ePrivacy governs whether you may send an unsolicited commercial message. GDPR governs whether you may hold and process the personal data that made the send possible. You need to satisfy both.

For B2B outreach to a corporate role address, most member states permit sending under legitimate interest rather than prior consent. Legitimate interest is not a checkbox. It is an assessment you are expected to have actually performed, and it has three parts:

1. Purpose. A genuine business reason for the outreach.
2. Necessity. Email is a proportionate way to pursue it.
3. Balance. Your interest does not override the recipient’s rights and reasonable expectations.

What makes this pass or fail in practice is relevance. A message to a VP of Revenue Operations at a 400-person software company about outbound tooling is defensible on its face. The identical message to a school administrator is not, and no amount of documentation rescues it. Targeting precision is a compliance control, not just a conversion lever.

The operational requirements that follow:

• A privacy notice the recipient can reach, explaining the processing, the source of the data, the retention period, and their rights.
• Source documentation. You should be able to say where an address came from. “A vendor” is a weak answer; “public company website, enriched from a named provider on this date” is a strong one.
• An objection path that works on first request, including requests that arrive as a plain reply rather than a click.
• Defined retention. Indefinite storage of contacts who never engaged is hard to justify against the necessity test.

Member states vary. Germany and Austria apply consent expectations more tightly even in B2B contexts, and individual named addresses attract more scrutiny than generic role inboxes. Segment your EU sending by country rather than treating the bloc as one rule.

The UK runs the same structure post-Brexit, with the ICO applying a corporate-subscriber carve-out that makes B2B sending to companies, partnerships, and incorporated bodies broadly permissible, while sole traders and individuals are treated as consumers.

Canada: CASL

CASL is the outlier, and the one most US teams get wrong by assuming their CAN-SPAM setup travels north. It does not. CASL requires consent before sending, in one of two forms.

Express consent is an affirmative opt-in, and it does not expire.

Implied consent arises from a defined set of relationships, and it does expire:

• An existing business relationship, such as a purchase or contract, generally supports implied consent for two years from the relevant event.
• An inquiry or application from the recipient supports six months.
• Conspicuous publication: an address published publicly (on a company site, in a directory) without a statement refusing unsolicited email, where your message relates to that person’s role. This is the basis most cold outbound into Canada relies on, and the role-relevance requirement is doing real work. A published address does not authorize messaging someone about something outside their function.

CASL also requires full sender identification and a functioning unsubscribe honored within ten business days, and it carries a private right of action in addition to regulatory penalties. The combination of mandatory consent, time-limited implied consent, and real enforcement is why Canada deserves its own segment, its own copy, and its own suppression logic in your sending setup.

Where compliance and deliverability converge

Here is the part that gets underweighted in legal reviews: almost every compliance control is also a deliverability control. Mailbox providers do not read statutes, but they measure the same behaviors the statutes target.

• Accurate sender identity and authenticated domains are both a CAN-SPAM requirement and the foundation of inbox placement.
• Relevance is the GDPR balancing test and also the thing that keeps complaint rates below the threshold where filtering turns against you.
• A frictionless unsubscribe is a legal obligation and the cheapest available substitute for a spam complaint, which is the signal that actually damages your domain.
• Suppression hygiene prevents the repeat-contact complaint and simultaneously stops you from burning reputation on an audience that has already self-selected out.

If you are already running disciplined deliverability practice, you are most of the way to compliant. We covered the sending-infrastructure half of this in detail in our guide to cold email deliverability and inbox placement. The two disciplines fail together and improve together.

Building compliance into the system rather than the policy

Compliance that depends on every rep remembering a rule will fail at scale. The controls that survive are the ones in the pipeline.

Control the list at the source. Provenance has to be a field, not a memory. When your lead lists are assembled from observable signals rather than bought in bulk, the lawful-basis question answers itself: you can state exactly what you observed and when. Building lists from buying signals (job changes, competitor connections, website activity) the way CAM does produces contacts whose business relevance is documented by construction, which is precisely what a legitimate-interest assessment asks you to show.

Segment by jurisdiction before you segment by persona. Jurisdiction determines which rules apply, so it should be the first split in your sequencing logic, not an afterthought applied to finished campaigns. In practice this means a contact record carries a country, and the country selects the template set, the footer, and the consent requirement.

Make opt-out detection a system function. Most opt-outs do not arrive as link clicks. They arrive as a reply saying “please remove me,” “not interested, take me off this,” or something considerably less polite, and they land across dozens of sending accounts. If a human has to notice each one and manually suppress it, you will miss some, and the ones you miss are your highest-risk contacts. This is the specific failure that Underfive.ai addresses by pulling every sending account into one unified inbox, where AI inbox agents label replies and draft responses in under five minutes. Classification at that speed means an opt-out gets recognized and acted on while the sequence is still running, not after the next three steps have already sent.

Suppress globally and permanently. One suppression list, enforced at send time across every tool, domain, and sending identity, checked on every import. Not per campaign. Not per sequence. The re-import of a stale CSV is the most common way a compliant program generates a non-compliant send.

Log enough to reconstruct a decision. If a recipient asks why they received a message, you want to answer with a record: this is the signal we observed, this is the date, this is the basis, this is when you opted out and when it took effect. That log is also the fastest way to shut down an internal escalation.

What to stop doing

Specific practices that are either unlawful in a major jurisdiction or reliably trigger the complaints that lead to enforcement:

• Fake-thread subject lines. “Re:” and “Following up on our call” to a stranger are deceptive-subject violations under CAN-SPAM and read as bad faith everywhere else.
• Impersonating a personal domain or a person who does not work at your company.
• Opt-out that only stops one sequence. A recipient asking to be removed means removed, not paused on this campaign.
• Conditional unsubscribe. Requiring a login, a reason, a survey, or a reply to a monitored-nowhere address.
• Scraped personal addresses. Personal and sole-trader addresses are treated as consumer contacts in the EU, UK, and Canada. Keep outbound to corporate role addresses.
• Sending into Canada on a CAN-SPAM assumption. No consent basis means no send, regardless of how well the copy performs.
• Keeping non-responders indefinitely. Define a retention window and enforce it.

Frequently asked questions

Is cold email legal in 2026? Yes, for B2B outreach in the US, most of the EU, the UK, and Canada, subject to each jurisdiction’s rules. The US permits unsolicited commercial email with accurate identification and a working opt-out. The EU and UK generally permit B2B outreach under legitimate interest with a privacy notice and an objection path. Canada requires express or implied consent before sending.

Do I need consent to send cold email? It depends on the recipient’s country. No prior consent is required under US CAN-SPAM. The EU and UK typically allow B2B sending under legitimate interest rather than consent. Canada’s CASL does require consent, either express or implied, and implied consent expires (two years for an existing business relationship, six months for an inquiry).

Does GDPR ban cold email? No. GDPR governs the processing of personal data, not whether you may send a commercial message. B2B outreach to corporate role addresses is generally lawful under legitimate interest, provided you have documented the basis, published a privacy notice, can identify the data source, honor objections, and limit retention.

How fast do I have to honor an unsubscribe? CAN-SPAM and CASL both allow up to ten business days. GDPR expects objections to be actioned without undue delay. Operationally, suppress immediately: the ten-day window is a legal ceiling, not a target, and a contact who unsubscribes mid-sequence will receive the next step unless suppression is enforced at send time.

Is buying a lead list legal? Purchasing is not itself unlawful in the US, but it is the fastest route to a GDPR problem, because you inherit an obligation to document provenance and lawful basis that most list vendors cannot support. Lists built from observable signals with recorded sources are both more defensible and substantially more accurate.

Do I need a physical address in every email? Yes under CAN-SPAM, and sender identification requirements under CASL and ePrivacy mean a real business address in the footer is the correct default for every jurisdiction.

Does a one-person sequence need the same controls as a 50,000-send campaign? The obligations are identical; only the exposure scales. Penalties under CAN-SPAM are assessed per message, so volume multiplies the cost of a defect rather than creating it.

The checklist

Before your next sequence goes live:

1. Every contact record carries a country, and country drives template and consent logic.
2. Every contact record carries a documented source and date.
3. Sender name, company, reply-to, and physical address are real and present in the footer.
4. Subject lines describe the message and imply no relationship that does not exist.
5. A privacy notice is reachable from every send into the EU or UK.
6. Opt-out is one step, unconditional, and detected in replies as well as clicks.
7. Suppression is global, permanent, and enforced at send time on every import.
8. Canadian contacts have a recorded consent basis, with implied consent dated and expiring.
9. Retention windows are defined and actually run.

None of this slows a well-built outbound program down. It mostly forces the targeting discipline that makes the program work in the first place: knowing who you are writing to, why they are relevant, and when to stop.

If you want the system built rather than documented, talk to us. We engineer the sending infrastructure, the list provenance, and the suppression logic as one pipeline, because in practice they are one pipeline.