Cold email rules by country

The rules at a glance

Two layers apply in Europe. GDPR governs the personal data you hold about a named person, such as anna.berg@company.se. Each country's own e-marketing law, based on the EU ePrivacy Directive, governs whether you may send the email at all. The table below covers the second layer, plus the US. Confidence is ours: high means we checked the statute and regulator guidance, moderate means we are confident about the rule but not every edge, low means check locally before relying on it.

United States: CAN-SPAM

CAN-SPAM covers commercial email, including B2B. It does not require consent before the first email. It does require that you:

• Use accurate From, To and routing information that identifies you.
• Write a subject line that matches the content. A fake "Re:" on a first email is deceptive.
• Identify the message as an advertisement in a clear way, unless the person agreed to get it.
• Include a valid physical postal address.
• Explain how to opt out, keep the opt-out working for at least 30 days after sending, and honour it within 10 business days.
• Stay responsible for email that others send for you.

The FTC can seek civil penalties of more than $50,000 per violating email, an amount adjusted for inflation each year. Some states have their own rules on deceptive email, so honesty matters more than any template.

European Union: GDPR and legitimate interest

A work email that names a person is personal data. To process it you need a lawful basis under Article 6. For B2B outreach that is usually legitimate interest, Article 6(1)(f). Recital 47 says direct marketing may be a legitimate interest, but you still have to pass a three part test and write it down:

1. Purpose: is there a real business reason, such as offering something relevant to this person's job?
2. Necessity: is email to this person a reasonable way to reach that purpose?
3. Balance: would this person reasonably expect it, and does your interest outweigh theirs? A relevant note to a head of finance about finance software passes more easily than a generic blast.

Because you collected the address from somewhere other than the person, Article 14 asks you to tell them who you are, where you got their data, why you use it and how to object, at the latest in your first email. A short line plus a link to your privacy notice is the common way to do it. Under Article 21, an objection to direct marketing is absolute: stop at once and keep their address on a suppression list so it never comes back.

GDPR is only half the picture. Even with a sound legitimate interest, the country's e-marketing law (the rows in the table) can still forbid the email.

United Kingdom: PECR

PECR separates individual subscribers (people, sole traders and some partnerships) from corporate subscribers (limited companies, LLPs, government bodies). Marketing email to corporate subscribers does not need consent, but every email must say who you are and give a valid address to opt out. If you email a named employee, UK GDPR still applies, so the legitimate interest test and transparency rules above apply too. The ICO enforces both.

Germany: UWG § 7

Germany is the strictest major market. UWG § 7(2) treats advertising by email without the recipient's prior express consent as an unacceptable nuisance, and that applies to businesses as well as consumers. The only carve out is § 7(3): you may email an existing customer about similar products if you got their address in connection with a sale, they did not object, and you tell them about their right to object when you collect the address and in every email.

German courts have held that even a single unsolicited advertising email can be unlawful. The usual consequence is a formal warning letter (Abmahnung) from a competitor, an association or the recipient, with a demand to sign a cease and desist declaration and pay legal costs. For outreach to Germany, the safer routes are a warm introduction, a channel the person has invited, or a request for consent that is not itself advertising.

France: CPCE L34-5 and the CNIL

France needs prior consent for marketing email to consumers. For professionals, the CNIL accepts email without prior consent when the message relates to the recipient's profession, for example accounting software offered to a finance director. Each email must identify you and offer a simple way to opt out, and GDPR transparency still applies to the personal data.

Netherlands: Telecommunicatiewet 11.7

The Dutch rule on unsolicited electronic communication covers business recipients as well as consumers, so cold marketing email generally needs prior consent. There is an existing customer exception similar to Germany's. The ACM enforces it. We rate this moderate because the line between a relevant business enquiry and marketing is fact specific.

Nordics: Sweden, Denmark, Finland and Norway

• Sweden: consent is required for marketing email to individuals, including sole traders. Email to legal persons is allowed if it identifies you and offers a valid opt-out address.
• Denmark: the Marketing Practices Act requires prior consent for electronic marketing to anyone, businesses included.
• Finland: consent is required for individuals. Direct marketing to legal persons is allowed unless the recipient has refused it, so the opt-out must be easy and free.
• Norway: the consent rule is written for natural persons. How it applies to a named employee at a company is not settled enough for us to give a clear answer. Ask a Norwegian adviser.

How Reach handles this

Reach handles per-country consent rules, such as Germany's UWG § 7, along with unsubscribe links and a do-not-email list, so the rules travel with every goal. You still approve every email before it goes out, and the privacy page explains how we treat the data. None of this replaces advice from a lawyer for your situation.