The Cold Email Legal Guide — GDPR, CAN-SPAM and Beyond (Send Without Fines)

EmailKing Team · Last updated: September 30, 2026

In global outreach the scariest opponent isn't a competitor — it's a regulator. CAN-SPAM violations can cost up to $53,088 per email (the 2025 inflation-adjusted maximum); GDPR fines reach €20 million or 4% of worldwide annual turnover, whichever is higher. The rules are clearer than they look, though: figure out whether your target country is opt-out or opt-in, and half the work is done.

Opt-out regimes (US CAN-SPAM): you may send — but you must stop

In the US, CAN-SPAM lets you send B2B cold email without prior consent, provided you: ① use accurate header and "From" information, ② use a non-deceptive subject line, ③ identify the message as an ad (unless the recipient already consented), ④ include a valid physical postal address, and ⑤ offer a clear opt-out and honor it within 10 business days. Sending to addresses harvested by automated means from a site that says it won't share them makes a violation an aggravated one. Meet these and a relevant cold email is a lawful business proposal.

Opt-in regimes (EU: GDPR + ePrivacy): prepare your legitimate interest

The EU has two layers. GDPR requires a lawful basis for processing the address — for B2B that is usually legitimate interest, which means the pitch must be clearly relevant to the recipient's role, the address should be a published business address, and you must tell them where you got their data and how to object or request deletion, at the latest in your first email. On top of that, national ePrivacy rules govern marketing email itself, and they differ: some countries allow B2B email to work addresses without consent, while others — Germany notably — generally require prior consent even in B2B. Check per country before scaling volume.

Other opt-in countries: South Korea and Canada (CASL)

South Korea's Information and Communications Network Act requires the recipient's explicit prior consent for commercial advertising email (fines up to ₩30 million); the subject line must start with "(광고)" ("advertisement") and the message must carry the sender's name, contact details and an opt-out method. It also bans collecting email addresses from websites with automated tools without the site operator's prior consent (up to one year in prison or a ₩10 million fine). Canada's CASL also requires consent, but implied consent can apply when an address is conspicuously published, carries no notice refusing unsolicited messages, and your message is relevant to the person's role.

The practical checklist — a baseline for every jurisdiction

① Collect only published business addresses (and check that your collection method is allowed where you operate). ② Get consent first where the law requires it (e.g. South Korea, Canada, Germany). ③ Pitch only what's relevant to the recipient's role. ④ Every email carries an opt-out. ⑤ Honor opt-outs immediately and keep a suppression list. ⑥ Identify yourself with a real address. ⑦ Verify to minimize bounces. This list is legal hygiene and deliverability best practice at the same time — lawful sending is deliverable sending.

Where tooling helps

EmailKing only reads publicly accessible web pages — it doesn't mine private databases or log in to anything. Its syntax and MX checks at extraction time lower bounce risk. But no tool can tell you whether you have a legal basis or consent to email someone, and in some countries (South Korea, for example) automated collection itself needs the site operator's consent. Final compliance responsibility sits with the sender, so review target-country rules before any large campaign (this article is not legal advice).

Frequently Asked Questions

Are B2B and B2C rules different?

B2C is far stricter in most countries. This guide — and EmailKing's intended use — is B2B with published business addresses. Consumer cold email has separate, much tougher consent requirements.

Do I need an unsubscribe link, or is reply-to-opt-out enough?

For 1:1-style cold email, "just reply if you'd rather not hear from me" is widely accepted, and CAN-SPAM accepts a working reply address as the opt-out mechanism as long as it keeps working for at least 30 days after you send. What matters is that the mechanism is clear and requests are actually honored, immediately.

Should I just avoid Europe because of GDPR?

No. With a legitimate-interest basis, a relevant pitch, source disclosure and prompt deletion handling, B2B outreach happens in Europe every day — but check national rules first, since some countries (Germany, for one) require consent even for B2B. What doesn't work is careless bulk blasting.

For a deeper dive, see the Complete Cold Email Guide, Part 4.

Next Steps

Every outreach motion starts with a clean lead list. EmailKing pulls the emails a website publishes and checks each one's syntax and mail server (MX) on the spot — the free plan (25 URLs/mo) is enough to start today.

Start extracting leads free →

Next step

Read the cold email strategy guide Free spam word checker