Cold Email Laws by Country A practical guide for B2B outreach in 2026

Two questions, not one

People often ask if cold email is "legal" as though there is a single yes or no answer. In practice there are two separate questions. First, is the way you built your list allowed. Second, is the message you send allowed where the recipient lives.

Building a list from a public source like Google Maps is mostly about the first question. You are noting business names, categories, public phone numbers and addresses. That is generally treated differently from harvesting private personal data, a distinction we cover in is it legal to scrape Google Maps and personal vs business data scraping.

The second question is where country-specific email law lives. A perfectly sourced list can still break the rules if the message ignores local requirements. That is what this guide focuses on.

How the major regimes compare

Laws change and enforcement varies, so treat the table below as an orientation rather than a checklist. It shows the general posture each region takes toward business-to-business cold email.

Two clusters emerge. The United States takes an opt-out approach: you may send without prior permission if you meet strict content and unsubscribe rules. Canada and Australia sit at the other end, generally expecting some form of consent before the first message.

CAN-SPAM: an opt-out model

The US CAN-SPAM Act does not require prior consent to send a commercial email. Instead it sets rules for how the message must look and behave. The Federal Trade Commission maintains a clear CAN-SPAM compliance guide that spells out the basics.

In short: no deceptive subject lines or headers, a clear disclosure that the message is an ad where relevant, a valid physical postal address, and a working opt-out that you honor promptly. We go deeper on how this touches scraped lists in CAN-SPAM and scraped leads.

GDPR and ePrivacy: consent and legitimate interest

Europe is the most nuanced region. The General Data Protection Regulation governs how you handle personal data, while the ePrivacy rules govern electronic marketing. For B2B, some member states allow contacting a business role address under a legitimate interest basis, while others are stricter.

A named individual's work email can still be personal data, which means transparency, a lawful basis, and the right to object all matter. For the interaction between scraping and GDPR, see Google Maps scraping and GDPR and the broader question in do you need consent to email businesses.

The United Kingdom follows a related path under UK GDPR and PECR. Messages to corporate subscribers, meaning companies rather than named people, tend to be treated more leniently than messages to individuals and sole traders, though an easy opt-out is always expected.

Consent-first regimes

Canada's Anti-Spam Legislation is one of the strictest frameworks in the world. It generally expects express or implied consent before you send a commercial electronic message, along with clear identification and a functioning unsubscribe. The regulator publishes guidance on the CASL requirements.

Australia's Spam Act 2003 takes a similar consent-based stance, again pairing permission with sender identification and an unsubscribe option. Implied consent can exist in some business contexts, for example where a business has published an address without a "no unsolicited email" note, but the safe reading is to treat these markets as consent-first.

Rules that travel almost everywhere

Rather than memorize every statute, build outreach that respects the shared core. If you do these four things, you are aligned with the spirit of most regimes at once.

The extension is the means, the dashboard is the end

The Vonsel Chrome extension is a way to gather public business data from Google Maps without copying rows by hand. It is free, with no trial and no card, because capturing listings is only the first step. The value is in what you do next.

Inside the Vonsel dashboard, those businesses land in a mapped CRM. Email Intelligence can draft a message tailored to each business, and Reviews Intelligence surfaces the context that makes outreach relevant rather than generic. That relevance matters legally too, since a targeted, useful message is easier to justify than a blast.

None of that changes the law. It simply makes it easier to send fewer, better, and clearly identified messages, which is exactly the direction every regime pushes you. For a hands-on view of sending, see your first cold email to a local business and why raw scraped lists can hurt deliverability.

A simple way to stay on the right side

Know where your recipient is and apply the stricter of the two frameworks in play, yours and theirs. Keep your list clean, keep records of opt-outs, and never reuse a stale list you cannot account for. Our safe scraping checklist pairs well with this on the data side.

Finally, remember scope. This article explains general concepts and cannot cover every jurisdiction, exception, or recent update. For anything with real stakes, talk to a qualified lawyer in the relevant country before you press send.