Is Cold Email Legal? US, Canada, UK and Australia Compared
is cold email legalcold email lawslegal disclaimers for cold email footers
Is Cold Email Legal? US, Canada, UK and Australia Compared
Is cold email legal? Compare CAN-SPAM, CASL, UK PECR and Australia's Spam Act: legal basis, 2026 fines, enforcement cases, footer text and a checklist.
Is Cold Email Legal? US, Canada, UK and Australia Compared
By Carlos Agüero, who builds outreach automation, deliverability and AI video tools for B2B sales teams. He is not a lawyer, and this is general information, not legal advice. Last updated 22 October 2026.
Cold email is legal in the US, Canada, the UK and Australia, but each country permits it under a different rule: opt-out in the US, consent in Canada and Australia, and a corporate-subscriber exemption in the UK. The stakes just rose. On 5 February 2026 the UK lifted its maximum fine for marketing email breaches from £500,000 to £17.5 million or 4% of global annual turnover (Clifford Chance, 2026). This guide compares the four countries side by side. It covers the legal basis, penalties, real enforcement cases, footer text and a per-contact evidence log. If you also send formats like video in a first-touch email, the same rules apply to every message.
Key Takeaways
Cold email is not banned in the US, Canada, the UK or Australia, but the lawful route differs: US opt-out, Canadian and Australian consent, and UK corporate-subscriber status plus UK GDPR.
The UK Privacy and Electronic Communications Regulations (PECR) now allow fines of £17.5 million or 4% of global annual turnover, up from £500,000 (Clifford Chance, 2026).
The US ceiling is $53,088 for a knowing violation of an FTC rule, and the 2025 level stays in force for 2026 (Federal Register, 2026).
Australia's Spam Act can allow B2B cold email to a published work address, but only when the message is relevant to the recipient's role and no notice refuses unsolicited messages.
Every cold email footer should carry the sender's identity, a postal address and a working unsubscribe, and the sender should keep evidence of where each address came from.
Is cold email legal in the US, Canada, the UK and Australia?
Cold email is legal in the United States, Canada, the United Kingdom and Australia when the sender follows each country's rules on consent, sender identification and opt-out. None of the four bans it outright, but the ceilings differ sharply: $53,088 per knowing violation in the US (FTC, 2025) and £17.5 million or 4% of global annual turnover in the UK (Clifford Chance, 2026).
Isometric scene of an envelope on a pedestal beside four colored gates, each with a different lock
Cold email is a commercial message sent to someone who has not asked for it and has no relationship with the sender. The table below sets the four regimes next to each other. Penalty figures are statutory ceilings or recent enforcement examples from the sources cited in this guide, as of October 2026.
Country
Main law
Legal basis for cold B2B email
Maximum penalty or recent enforcement
United States
CAN-SPAM
Opt-out: no prior consent, but identification and a working opt-out
$53,088 for a knowing violation of an FTC rule (FTC, 2025)
Canada
CASL
Consent, express or implied, which the sender must be able to prove
$1,000,000 for an individual, $10,000,000 for any other person (Global Relay, 2026)
United Kingdom
PECR plus UK GDPR
Corporate-subscriber exemption; consent for individual subscribers
£17.5 million or 4% of global annual turnover (Clifford Chance, 2026)
Australia
Spam Act
Consent, which can be inferred from conspicuous publication
Tabcorp: $1.254 million, in Australian dollars (ReadWrite, 2026)
Why does jurisdiction follow the recipient, not the sender?
Anti-spam laws are generally understood to attach to where the message is received, not where the sender sits. On that reading, a US company emailing prospects in Toronto should plan for CASL, and the same company emailing Manchester should plan for PECR. This is a general principle that the sources cited here do not spell out, so confirm it with counsel for each market.
A single "US-compliant" template is therefore not enough. Most teams that scale outbound add a routing step:
Tag every contact with the recipient's country when you import it.
Assign the rule set for that country (opt-out, consent or corporate-subscriber check).
Block sends where no lawful basis is recorded.
Route exceptions to your compliance lead before the campaign starts.
Our new compliance lead asked if cold email is illegal. What is the honest answer?
Cold email is not illegal in itself in any of the four countries; it becomes illegal when the sender uses the wrong legal mechanism for the recipient. The US relies on opt-out, Canada and Australia on consent that can be implied or inferred, and the UK on a corporate-subscriber exemption plus UK GDPR. Real penalties exist: the ICO fined ZMLUK Limited £105,000 for over 67 million emails (ICO, 2026).
Most "yes if compliant" answers stop there. A compliance lead needs more, because the answer depends on two facts about every recipient: where they are, and what kind of recipient they are. A named person at a limited company in the UK is treated differently from a sole trader. A published work address in Australia is treated differently from a purchased list.
What should you tell leadership?
Three plain statements hold up in a review:
Cold email is a permitted channel, not a loophole. It is lawful only when each message meets the rules of the recipient's country.
Theoretical maximum fines are rarely what regulators impose, but the cases below show real penalties, and the UK ceiling has just risen sharply.
Proof sits with the sender in Canada and Australia, so records matter as much as the message.
What does the US allow for cold email under CAN-SPAM?
CAN-SPAM is the US federal law for commercial email, enforced by the Federal Trade Commission (FTC) as an FTC rule. It is an opt-out regime: cold email does not need prior consent, and senders are commonly expected to label ads, include a postal address and honor opt-outs. The maximum civil penalty for a knowing violation of an FTC rule is $53,088 (FTC, 2025).
Isometric mailbox with an unsubscribe lever and a postal address plaque on a clean platform
The US is the most permissive of the four. You may send first, but you must stop when asked. The sources cited in this guide do not include the FTC's CAN-SPAM compliance guide, so treat the requirement list above, and the common view that B2B messages are not exempt, as unverified summaries. Check them against the statute and the FTC guide with counsel before you finalize a template.
The $53,088 ceiling rose from $51,744 on 17 January 2025. It is often quoted per email, but the notice cited here does not state that framing, so confirm it with counsel. On 15 September 2026 the FTC confirmed there would be no inflation adjustment for 2026, saying "The FTC will continue to apply the 2025 civil penalty levels." (Federal Register, 2026).
Line chart: CAN-SPAM maximum civil penalty per violating email, 2024 vs 2025 inflation adjustment. Highest: 2025 (from 17 Jan) at 53,088 US$.
State laws and mailbox provider rules from Google, Yahoo and Microsoft sit on top of CAN-SPAM. They are outside this guide's scope, so ask counsel and your deliverability lead to cover them.
What does CASL require for cold email to Canadian prospects?
CASL is Canada's Anti-Spam Legislation, and it generally requires consent, express or implied, before a business sends a commercial email to a Canadian recipient, and the sender must be able to prove it. Statutory penalties reach $1,000,000 for an individual and $10,000,000 for any other person (Global Relay, 2026).
Isometric board with a checked tick box, document folders and a padlock representing Canadian consent rules
Implied consent is consent inferred from the recipient's circumstances rather than stated in words. One route is conspicuous publication, where a work address is openly published and the message relates to the recipient's role. Treat purchased or third-party lists with caution: they do not by themselves give you consent to rely on. Because the burden of proof sits with the sender, keep the source and date for every address.
The statutory maximums are not what most senders face. The Canadian Radio-television and Telecommunications Commission (CRTC) reported 123 warning letters and 1 Notice of Violation in its CASL enforcement snapshot to 30 September 2025 (CRTC, 2025). That pattern suggests enforcement leans on warnings, but a warning still means a regulator has your sending on file.
CASL is generally understood to expect the sender's name, a mailing address, another contact method and an unsubscribe mechanism in each message. None of the cited sources lists these elements, so check the current regulation text with Canadian counsel before finalizing your template.
What changed for UK cold email after the Data (Use and Access) Act?
PECR, the Privacy and Electronic Communications Regulations, is the UK law on electronic marketing, and since 5 February 2026 its maximum fine is £17.5 million or 4% of global annual turnover, whichever is higher, up from £500,000 (Clifford Chance, 2026). Cold email to company addresses is generally allowed, while individual subscribers need consent.
The change comes from the Data (Use and Access) Act 2025, which received Royal Assent on 19 June 2025. Addleshaw Goddard, a law firm, wrote that "this change makes compliance with PECR's rules on direct marketing more important than ever." (Addleshaw Goddard, 2025). Some pages still quote the old £500,000 cap, so check the date of any UK guidance you rely on.
Lollipop chart: Maximum UK PECR fine before and after the Data (Use and Access) Act 2025 (fixed-sum limb only; the 4% turnover alternative applies where higher). Highest: After the Act at 17,500,000 GBP.
The chart shows the fixed-sum limb only, rising from £500,000 to £17,500,000. The 4% turnover alternative applies where it is higher.
Corporate and individual subscribers
A corporate subscriber is a company or similar body, and PECR generally lets you email one without prior consent. Sole traders and ordinary partnerships are individual subscribers, so you need consent to email them. UK GDPR also still applies to a named work email, because it is personal data, so you should document a legitimate interests assessment. In every case, identify the sender and give a valid opt-out address.
What does UK enforcement look like?
The Information Commissioner's Office (ICO) fined ZMLUK Limited £105,000 for sending over 67 million marketing emails without valid consent, using third-party sourced data (ICO, 2026). The emails went out between January and July 2023. The ICO's statement was blunt: "The law here is clear: businesses must only send marketing messages to people who have freely and knowingly consented to receiving them." (ICO, 2026).
What does Australia's Spam Act allow for B2B cold email to business addresses?
Australia's Spam Act allows B2B cold email to a business address only with consent, and consent can be inferred when the address is conspicuously published, the message is relevant to the recipient's role and no notice refuses unsolicited messages. Enforcement is active: the Australian Communications and Media Authority (ACMA) issued Tabcorp a $1.254 million penalty in 2026 (ReadWrite, 2026).
Isometric office building with a published contact card on its noticeboard and an envelope arriving
Most guides give Australia one line. The detail is where compliance leads need it.
What is conspicuous publication under the Spam Act?
Conspicuous publication is the route by which consent can be inferred from an openly published work address. Legal commentary describes four conditions under Schedule 2, clause 4 of the Spam Act, all of which must hold. This guide's sources do not quote the clause, so read it with counsel before you rely on it.
The address is published (for example on a company website or a professional profile).
It is reasonable to assume the person agreed to receive messages at that address.
No statement says the person does not want unsolicited messages.
The message is relevant to the person's work role.
The sender carries the burden of proof. That makes a dated screenshot or archived copy of the publication worth keeping. Generic addresses such as info@ make the role-relevance test hard to show, so treat them as high risk and get legal advice before relying on them.
What do Australian penalties look like?
Tabcorp's penalty, an ACMA infringement notice stated in Australian dollars, followed 217,687 commercial electronic messages sent to 41,550 addresses despite withdrawn consent (ReadWrite, 2026). We use ReadWrite's figure throughout. The Focus Gaming News page quoted below carries a different US-dollar amount in its headline, which we do not use. ACMA member Samantha Yorke said: "The scale and range of these breaches point to serious weaknesses in TAB's compliance systems." (Focus Gaming News, 2026).
Clayton Utz, a law firm, reports that ACMA spam penalties over the 18 months to April 2025 totalled over $16 million (Clayton Utz, 2025). That is a law-firm tally, not an ACMA figure. Messages must also identify the sender and include a functional unsubscribe.
How can I cold email without breaking laws?
To cold email without breaking the law, send each message under the legal basis its recipient's country allows: opt-out in the US, consent in Canada and Australia, and corporate-subscriber status plus a lawful basis in the UK. Identify the sender, include a working opt-out, honor it promptly and keep a per-contact evidence record. The ICO fined ZMLUK Limited £105,000 for over 67 million emails sent without valid consent (ICO, 2026).
Isometric filing cabinet with labeled drawers, a checklist clipboard and an envelope tray
Follow these steps for every campaign:
Route by recipient country. Tag each contact and apply that country's rules, not your own.
Check the recipient type. In the UK, separate corporate subscribers from sole traders and partnerships.
Record the basis. For Canada and Australia, note how consent is implied or inferred. For the UK, document a legitimate interests assessment.
Identify yourself. Use your real sender name, postal address and a reply path.
Provide a working opt-out. Honor it and add the address to a suppression list immediately. Opt-out deadlines differ by country, so confirm the current ones with the FTC, CRTC and ACMA.
Keep evidence. Store proof you can show a regulator.
What legal disclaimers and opt-out text should every cold email footer include?
A cold email footer should show who you are, where you are, how to reach you and how to leave. No disclaimer cures a message sent without a lawful basis, so the footer supports compliance and does not replace it. Use the strictest element from each country in one template. The elements below come from our reading of common practice and are not quoted from the statutes, so have counsel confirm them.
Country
Footer elements to include
United States
Identification as an advertisement, valid postal address, opt-out
Canada
Sender name, mailing address, another contact method, unsubscribe
United Kingdom
Sender identity, valid opt-out address
Australia
Sender identification, functional unsubscribe
All four
No personal data demanded to unsubscribe
A single footer that satisfies all four might read like this (replace the placeholders, and have counsel review it):
[Company legal name], [street address, city, postal code]. Contact: [email address] or [phone number]. This is a commercial message. You are receiving it because [reason, for example: your business address is published on your website and this offer relates to your role as Head of Operations]. To stop receiving emails from us, click Unsubscribe or reply "unsubscribe". We will not ask you for any further information.
What should you log for each contact?
An evidence log turns "we believed we had consent" into something you can show. Keep one row per contact:
Field
What to record
Why it matters
Source
URL or list name where the address was found
Shows where the data came from
Date
When you collected it
Shows whether the publication was current
Screenshot
Capture of the published address and any "no solicitation" notice
Supports the conspicuous-publication test
Role relevance
Why the message relates to the person's work role
Needed for inferred consent in Australia
Recipient type
Corporate or individual subscriber (UK)
Decides whether consent is needed
Suppression record
Date and channel of any opt-out
Proves you honored it
What about outsourced SDRs and sending tools?
Sending through an agency or a tool does not by itself remove your responsibility for the message. Treat vendors as part of your compliance chain, and ask any vendor for its suppression process in writing. Your counsel can tell you how liability is shared in each country. For a format-specific view of a first-touch message, see this guide to what video outreach is.
Our data: Potion by SendPotion holds SOC 2 Type I (an independent third-party audit). Its GDPR and CCPA alignment is self-claimed, attorney-reviewed via a public Data Processing Agreement (DPA) and Privacy Policy. Neither replaces your own consent and opt-out process.
Who is the cold email laws comparison not for?
The cold email laws comparison in this article is for compliance and sales leaders who need a working summary of four countries' rules, and it is not legal advice. It leaves out EU member state laws, US state laws, mailbox provider rules and unverified opt-out deadlines. Several figures, such as the over $16 million Australian total, come from law-firm tallies (Clayton Utz, 2025).
Some limits to keep in mind:
Not legal advice. Laws change. The UK moved its fine cap in 2026, and the FTC froze its penalty levels in September 2026. Confirm each point with counsel before you scale.
Four countries only. EU member states, India, the UAE and others have their own rules.
Maximums are ceilings. The penalty figures are statutory limits or single cases, not averages.
Some rules are summarized, not quoted. The CAN-SPAM requirements, the CASL footer elements, the Spam Act Schedule 2 conditions and the recipient-location principle are described from general commentary. Check them against the statutes and regulator guidance.
Some figures come from secondary sources. The CASL maximums come from a compliance vendor restating the statute, and the Tabcorp figure comes from trade press. Cross-check them against the statute and ACMA.
Canada's private right of action is not covered here, because sources disagree on its status.
Frequently Asked Questions
How can I cold email without breaking laws?
Cold email stays lawful when you match the legal basis to the recipient's country: opt-out in the US, consent in Canada and Australia, and corporate-subscriber status plus a lawful basis in the UK. Identify yourself, add a postal address and a working unsubscribe, honor opt-outs quickly, and keep a record of where each address came from.
What legal disclaimers and opt-out text should every cold email footer include?
Every cold email footer should include the sender's name, a physical postal address, another way to contact you, a plain statement that the message is commercial, and a working unsubscribe that does not demand personal data. No disclaimer fixes a message sent without a lawful basis, so the footer supports compliance but cannot replace it.
What does Australia's Spam Act allow for B2B cold email to business addresses?
Australia's Spam Act allows B2B cold email to a business address when the sender has consent, which can be inferred if the address is conspicuously published, no notice refuses unsolicited messages, and the message is relevant to the recipient's work role. The message must identify the sender and include a functional unsubscribe, and the sender carries the burden of proof.
Conclusion
Cold email is a lawful channel in the US, Canada, the UK and Australia, but only when each message follows the rules of the country where it lands. Keep these points:
The US uses opt-out, with a ceiling of $53,088 for a knowing violation of an FTC rule (FTC, 2025).
Canada and Australia are consent-based, and the sender must prove it.
The UK allows B2B email to corporate subscribers, and fines can now reach £17.5 million or 4% of global annual turnover (Clifford Chance, 2026).
One footer with identity, address, contact method and a clean unsubscribe covers all four.
A per-contact evidence log is your best defense in a review.
Start with the routing step and the footer, then build the evidence log. If your outbound includes personalized video, Start Free Trial to see how it fits into a compliant sequence.
Written by
Carlos Agüero
Carlos Agüero builds tools that help B2B sales teams sell smarter. As part of TargetGrid.ai, Skale.email, and Potion, he's focused on multi-channel outreach automation, inbox deliverability, and AI-powered video. Berkeley Haas COBE. Based in Santiago, Chile. Passionate about helping sales teams close more, faster, with less manual work.
Carlos AgüeroNov 1, 2026
