Cold email laws by country
Which rules apply depends on where your recipients are, not just where you are. Here’s what each major law asks of a cold email, from official sources, and which parts Inboxed handles for you.
This is general information, not legal advice.
It summarises the law as published on 8 November 2026. Laws, guidance and how regulators apply them change, and your situation may differ. For decisions that matter, ask a lawyer qualified where you and your recipients are.
| Where | Consent before the first email | B2B | Opt-outs |
|---|---|---|---|
| United StatesCAN-SPAM Act | Not required; opt-out model | No B2B exception | Within 10 business days |
| European UnionGDPR and ePrivacy | Depends on the country (ePrivacy); GDPR needs a lawful basis | Varies: e.g. Germany requires prior consent, France allows B2B with conditions | Stop on objection (GDPR Art. 21) |
| United KingdomPECR and UK GDPR | Not for corporate subscribers; needed for sole traders and some partnerships | Allowed to companies, LLPs and similar | Must offer one; honour objections |
| CanadaCASL | Required: express or implied | Implied consent possible (published address, relevant to role) | Within 10 business days |
| AustraliaSpam Act 2003 | Required: express or inferred | Inferred consent possible (conspicuously published work address) | Within 5 working days |
Simplified. Each page explains the conditions and links to the legislation or regulator.
United States
CAN-SPAM Act
CAN-SPAM doesn’t require consent before you send a commercial email. It requires honesty, a way to identify and reach you, and a working opt-out that you honour. It applies to business-to-business email too.
European Union
GDPR and ePrivacy
Two layers of EU law apply to cold email. The GDPR decides whether you may use someone’s personal data at all. The ePrivacy rules, implemented differently in each member state, decide whether you may send them marketing by email. Both have to allow it.
United Kingdom
PECR and UK GDPR
In the UK, the Privacy and Electronic Communications Regulations (PECR) decide whether you can email someone for marketing, and the UK GDPR governs the personal data. The key question is who you are emailing: a company, or an individual such as a sole trader.
Canada
CASL
Canada’s Anti-Spam Legislation (CASL) is a consent law: you need express or implied consent before sending a commercial electronic message. For B2B cold email the important route is implied consent from a conspicuously published business address, which comes with conditions you must be able to prove.
Australia
Spam Act 2003
Australia’s Spam Act requires three things of every commercial electronic message with an Australian link: consent, clear identification of who sent it, and a working unsubscribe. For B2B cold email, consent can be inferred from a work address that was conspicuously published, under strict conditions.
What Inboxed does everywhere
- Your company name and postal address in every campaign email’s footer; campaigns can’t launch without them.
- A visible unsubscribe line and one-click unsubscribe headers on every campaign email, applied immediately.
- A suppression list every campaign checks, including unsubscribes, bounces, complaints and blocked domains.
- Erase a person for GDPR erasure requests, and optional automatic data retention.
What stays with you
- Deciding who you may email in each country, and having consent where the law requires it.
- An honest sender, subject and message, and a real postal address.
- Telling people how you use their data, and answering their requests.
See the acceptable use policy and the complete cold email guide.
Warm up today. Launch when you’re ready. Pay only for emails that send.
No subscription, no card to start. Connect a mailbox and warmup begins in under a minute.