Is cold email legal in 2026? (GDPR, CAN-SPAM, the real rules)
VGCold email to businesses is legal in the US (CAN-SPAM) and the EU/UK (GDPR / PECR) if you have a legitimate business reason to contact them, identify yourself honestly, stay relevant, and make opting out easy. The rules are about respect, not prohibition.
This is not legal advice, it's a practical map. Cold email is legal for B2B almost everywhere; the question is how you do it.
United States (CAN-SPAM)
- Don't use deceptive subject lines or headers.
- Identify who you are and include a real physical address.
- Give a clear way to opt out, and honour it promptly.
EU & UK (GDPR / PECR)
B2B cold email is generally allowed under "legitimate interest", provided your message is relevant to the recipient's role, you can justify why you contacted them, and you offer an easy opt-out. Targeting a VP of Sales about a sales tool is defensible. Spraying everyone is not.
The simple compliance test
Could you explain, to the person's face, why you emailed them specifically and how you'll stop if they ask? If yes, you're almost certainly fine. If your targeting only works because it's anonymous and scattershot, that's the part that gets you in trouble.
Cold email isn't illegal. Irrelevant, deceptive, hard-to-unsubscribe email is. Stay on the right side of that line.
Want this for your team?
A free 30-min call. We map one of your workflows live.