Cold email is legal in most places, but it comes with rules. They are not hard to follow, and most of them are simply good manners written down: say who you are, do not mislead, make it easy to stop, and stop when asked. This chapter covers the main laws for the United States, the European Union and the UK, and Canada, what they ask of you in practice, and the habits that keep a sending program clean. It is a practical guide, not legal advice.
Read this first
Laws change, and how they apply depends on where you are, where your readers are, and what you send. Use this chapter to understand the shape of the rules and to ask better questions. For anything you are unsure about, talk to a lawyer who knows your markets.
Why compliance is worth the effort
The obvious reason is the fines, which can be large. The less obvious reason matters more day to day. Almost every rule in these laws also protects your deliverability. Clear identity, honest subject lines and easy opt-outs reduce spam complaints. Fewer complaints keep your sender reputation healthy, which keeps you in the inbox. A compliant program and a well-delivered program look almost the same.
There is also trust. A reader who sees a real name, a real company and a clear way to say no is far more likely to answer than one who feels trapped. Following the rules is part of how a stranger decides you are worth a reply.
The main laws at a glance
| Region | Main law | Basic model | What it asks of cold email |
|---|---|---|---|
| United States | CAN-SPAM Act | You may email first, but must honour opt-outs | Honest headers and subject lines, a real postal address, a working opt-out, and fast handling of opt-outs |
| European Union | GDPR, plus national e-privacy rules | You need a lawful reason to use personal data | A lawful basis such as legitimate interest, clear information about where you got the data, and respect for objections |
| United Kingdom | UK GDPR and PECR | Similar to the EU, with a split between company and individual addresses | Identify yourself, offer an opt-out in every message, and take extra care with sole traders |
| Canada | CASL | You need consent, express or implied, before you send | Check that consent applies, identify yourself, and include a working unsubscribe |
United States: CAN-SPAM
In the US, you do not need permission before sending a first commercial email. You do need to follow a short list of rules in every message, and you need to stop when someone asks. The law covers business-to-business email too. There is no exception for writing to a company address.
- Honest header information. The From name, the reply-to address and the sending domain must be accurate and identify who is sending.
- Honest subject lines. The subject must reflect what the email is about. No fake "Re:" or "Fwd:" to suggest an earlier conversation that never happened.
- Say where you are. Include a valid physical postal address for your business.
- Tell people how to opt out. A clear, easy way to stop further email, that works without asking for anything more than an email address.
- Act on opt-outs quickly. Stop sending to anyone who opts out, and do not sell or pass on their address.
- You are responsible for others. If someone sends on your behalf, such as an agency, you can both be held responsible.
European Union: GDPR
The GDPR is about personal data, and a work email address with a person's name in it is personal data. To use it, you need a lawful basis. For B2B cold email, the basis most senders rely on is legitimate interest: you have a real business reason to contact this person, the message is relevant to their role, and it does not override their rights. Each EU country also has its own e-privacy rules for electronic marketing, and some are stricter than others.
Write down your reason
Why does this person, in this role, have a reason to care? Keep a short note per campaign. This is the core of a legitimate interest assessment.
Keep it relevant to the role
Write to people about their work. An offer about front desk software for a clinic owner fits. The same email to their accountant does not.
Say where you got their details, and that they can object
When data does not come from the person, the GDPR expects you to tell them who you are, why you are contacting them and where their details came from, at the latest in your first email. That first email must also point out, clearly, that they can object to direct marketing. A short line plus a link to your privacy notice covers it.
Respect objections at once
If someone objects to direct marketing, that is final. Stop, and add them to your suppression list so no colleague writes again.
Keep only what you need
Store the fields you actually use, and delete contacts you are no longer working with.
United Kingdom: UK GDPR and PECR
The UK keeps its own version of the GDPR, alongside the Privacy and Electronic Communications Regulations, known as PECR. PECR draws a useful line. Emails to corporate subscribers, such as a limited company address, can be sent without prior consent, as long as you identify yourself and give a simple way to opt out. Emails to individual subscribers, which include sole traders and some partnerships, generally need consent. So a cold email to a one-person business in the UK needs more care than one to a large company. The UK GDPR rules on lawful basis and data rights still apply in both cases.
Canada: CASL
Canada's anti-spam law is stricter than CAN-SPAM. It works on consent: before sending a commercial message, you need either express consent or a form of implied consent that the law recognises. One kind of implied consent matters most for cold email. If a person has published their business email address openly, without saying they do not want marketing messages, and your message is relevant to their role, that can count as implied consent. Writing to an address you guessed or bought does not.
- Check the consent before you send. For each Canadian contact, know which kind of consent applies, and keep a note of it.
- Identify yourself. Name the sender and the business, with contact details.
- Include a working unsubscribe in every message, and process requests promptly.
- Keep records. If you are asked, you need to be able to show why you believed you had consent.
What a compliant cold email contains
Accurate sender. A real person's name and your real company domain. No disguised or borrowed sending addresses.
The opt-out is the heart of it
Every law in this chapter agrees on one thing: when someone says stop, you stop. Handling opt-outs well is the single most important compliance habit, and it is where most problems happen in practice. The rules are rarely broken on purpose. They are broken when an opt-out in one campaign does not reach another campaign, when a colleague imports an old list, or when a casual "please don't email me" is missed in a busy inbox.
Request arrives. An unsubscribe click, or a reply asking to stop, however casually it is phrased.
Inbox rules are rules too
Besides the law, the large mailbox providers set requirements of their own. They are not laws, but breaking them can send your email to spam or get it rejected. Chapter 3 covers the technical setup in detail. From a compliance point of view, two points stand out: bulk senders must offer an easy unsubscribe, and Google tells senders plainly not to buy email addresses.
Bought lists: a legal and practical trap
Buying a list feels like a shortcut. In practice it causes trouble on every front. You usually cannot show where the data came from, which matters under the GDPR. The people on it never published their address with you in mind, which matters under CASL. The data is often stale, which drives up bounces. And people who never expected to hear from anyone like you are far more likely to mark your email as spam. Build your own lists from public, relevant sources, as Chapter 5 describes, and record the source for each contact.
Keep good records
If a reader or a regulator ever asks why you emailed someone, a simple record answers it. You do not need a complex system. You need a few fields that are filled in every time.
| Record | Why keep it |
|---|---|
| Where each contact came from | Answers the question "where did you get my details?" and supports your lawful basis |
| Why you contacted them | The campaign's reason and trigger, which shows relevance to their role |
| Country of the contact | Tells you which rules apply before you send |
| Every opt-out and objection, with the date | Proves you stopped, and stops anyone from writing again |
| Who sent what, and when | Shows what each person received if a complaint ever comes in |
Personal data and your tools
Every tool that touches your contact list is processing personal data for you: your sending platform, your enrichment sources, your AI tools, your spreadsheet. Know what each one stores and where. Use providers with clear data terms, and sign a data processing agreement where the law expects one. Do not paste contact lists into general chat tools. Give access only to the people who need it, and remove it when they leave. Chapter 11 covers the extra points for AI research and drafting.
A compliance checklist before each campaign
0 of 6 checked. Countries are known: You know where your contacts are, and which rules apply to each group.
When to get real legal advice
- Before entering a new country with its own rules, especially one known to be strict about marketing email.
- When writing to individuals rather than companies, such as sole traders, freelancers or consumers.
- In regulated industries such as health, finance or legal services, which often have extra rules on marketing.
- When you receive a complaint from a regulator, or a formal request from a person about their data.
Doing this in FirstSales
FirstSales applies an opt-out across all your campaigns, so a person who says stop in one sequence is not emailed by another. Sequences stop when someone replies, and research notes keep the reason for each contact next to the email. Per-mailbox daily limits and a DNS check when you connect a mailbox help you stay within inbox provider rules. You can see how opt-outs and replies are handled with sample data in the demo.
Key takeaways
- Cold email is legal in most places, but every region has rules. This chapter is a guide, not legal advice.
- In the US, be honest, include a postal address and a working opt-out, and act on opt-outs quickly.
- In the EU and UK, have a lawful basis, keep emails relevant to the role, and say where you got the data.
- In Canada, check consent before you send. A published business address can count, a bought one does not.
- When someone says stop, stop everywhere, at once, and keep them on a suppression list.
- Do not buy lists. Record the source and reason for every contact.
Respostas rápidas sobre a masterclass
Quantos e-mails frios devo enviar por dia?
Comece com 5-10 por caixa de entrada por dia em contas novas. Após 2-3 semanas de aquecimento, suba para 35-50 por caixa. Se precisar enviar 500+ e-mails por dia, use 10-15 caixas aquecidas e alterne os envios entre todas elas. Nunca force uma única caixa além de 50 e-mails frios por dia.
Qual é uma boa taxa de resposta no e-mail frio?
Não existe um número único e honesto. A taxa de resposta depende do seu mercado, da sua lista, da sua oferta e de como as respostas são contadas, então números de campanhas alheias raramente se aplicam. Compare cada campanha com os seus próprios resultados anteriores para o mesmo tipo de público e avalie pelas respostas interessadas, não pelo total. O capítulo 12 mostra como.
Qual deve ser o tamanho de um e-mail frio?
Mantenha os e-mails frios entre 50-125 palavras. Alguns estudos sugerem até 150 palavras para certos públicos B2B. E-mails mais curtos têm desempenho consistentemente melhor. Se você precisa de mais de 125 palavras para expor sua ideia, sua mensagem não está focada o suficiente.
Devo usar HTML ou texto puro nos e-mails frios?
Texto puro. Sempre. E-mails em HTML com logos, imagens e layouts formatados acionam filtros de spam e parecem e-mails de marketing. Um e-mail em texto puro de uma pessoa para outra é exatamente como um e-mail frio deve parecer. A única exceção é a sua assinatura, que pode incluir formatação básica.
Quantos follow-ups devo enviar?
Normalmente alguns poucos, com vários dias de intervalo, cada um trazendo algo novo: outro ângulo, um recurso útil ou uma pergunta simples. Pare assim que alguém responder e termine com um encerramento curto e educado. O capítulo 8 trata do ritmo e do que dizer em cada etapa.