Cold email compliance checker
Cold email to a business is lawful in the US, Canada and the UK — but under three different regimes, and a campaign that is fine in the US can be unlawful in Canada without changing a word. Answer three questions to see which rules apply.
CAN-SPAM
Permitted, provided the message carries the required disclosures.
Why
- CAN-SPAM is an opt-out regime: you may send commercial email to a business without prior consent, provided the message meets the disclosure rules.
- There is no consent requirement and no distinction between a company and a sole trader.
Your message must include
Identify yourself
Your real name or business name, and accurate header information. No misleading "from" or subject line.
Provide a working opt-out
A clear way to stop receiving email, functional for at least 30 days after sending, honoured promptly.
Include a physical postal address
A valid physical address for your business. A PO box registered to you is acceptable.
Verify before sendingrecommended
Bounce rates above roughly 3% damage your sending domain for every future campaign, compliant or not.
Check first
- Opt-outs must be honoured within 10 business days — do it immediately instead.
- Some US states add their own rules; check if you are targeting a single state heavily.
The rules, by market
United States — CAN-SPAM
An opt-out regime. You may send commercial email to a business without prior consent, provided the message carries the required disclosures.
- No consent is needed before the first message.
- No distinction between an incorporated company and a sole trader.
- Opt-outs must be honoured within 10 business days — do it immediately instead.
- Some states add their own rules, worth checking if you target one heavily.
Canada — CASL
A consent regime, and the opposite of the US default. You need express or implied consent before sending, and penalties are substantially higher than under CAN-SPAM.
- Express consent: they gave you the address directly. This is the strongest position.
- Implied consent: the address is published conspicuously by the business, the page carries no statement refusing unsolicited email, and your message relates to their role.
- An address on the business’s own contact page normally satisfies implied consent.
- A directory listing is weaker ground — some directories add addresses the business never published. Verify it appears on their own site first.
United Kingdom — UK GDPR and PECR
The answer turns entirely on whether the recipient is incorporated. Corporate subscribers may be emailed without prior consent; sole traders may not.
- Incorporated companies and LLPs are corporate subscribers and may be sent marketing email without prior consent.
- Sole traders and unincorporated partnerships are individual subscribers — cold marketing email to them without consent is not permitted.
- Companies House is free and settles the question in seconds. A sole trader trading under a business name is not a corporate subscriber.
- You still need a lawful basis under UK GDPR. Legitimate interests normally applies to B2B outreach, and the assessment should be written down.
What every compliant message needs
- Accurate sender identification — your real name or business name, and honest header and subject lines.
- A working opt-out or objection route, honoured promptly and permanently.
- A valid physical postal address in the US and Canada; a reachable privacy notice in the UK.
- A record of where the address came from and when — reconstructing this after consent is questioned is not possible.
One case fails in all three markets: an individual’s personal address, or any address that was scraped or guessed rather than published for contact. Use a published business address — a contact page, a listing, or a role address such as info@ or hello@ — instead.
This is not legal advice. It is a summary of how these regimes are structured, written to help you ask the right questions. Regulations change and individual circumstances vary — verify your own obligations before sending at volume, and take advice if anything is unclear.
Common questions
Is cold email legal in the United States?
Yes. CAN-SPAM is an opt-out regime, so you may send commercial email to a business without prior consent. The message must identify you accurately, carry a working unsubscribe mechanism, and include a valid physical postal address. Opt-outs must be honoured within 10 business days.
Is cold email legal in Canada?
Only with consent. CASL is a consent-based regime, which is the opposite of the US default. Implied consent covers a business email address the business published conspicuously without a statement refusing unsolicited email, where your message relates to their role. Penalties are substantially higher than under CAN-SPAM.
Is cold email legal in the United Kingdom?
It depends on whether the recipient is incorporated. Under PECR, limited companies and LLPs are corporate subscribers and may be emailed without prior consent. Sole traders and unincorporated partnerships are treated as individuals and require consent. You can check incorporation status free on the Companies House register.
What is the difference between CAN-SPAM and CASL?
CAN-SPAM is opt-out: you may send until the recipient asks you to stop. CASL is opt-in: you need express or implied consent before you send at all. An email campaign that is fully compliant in the United States can be unlawful in Canada without a single word changing.
Can I email an address I found on a business directory?
In the US, yes. In Canada it is risky, because CASL implied consent depends on the business having published the address itself — some directories add addresses the business never published. Verify the same address appears on the business's own website before sending to a Canadian recipient.
Do I need to include a physical address in a cold email?
Yes in both the United States and Canada, where it is a statutory requirement. A PO box registered to your business is acceptable. In the UK a postal address is not strictly mandated by PECR but you must identify yourself and provide a route to object.
Send compliant email from your own inbox
SMM Lead Finder finds local businesses with real social media gaps and the contact published on their own site — which is the address these rules are built around. Outreach sends from your connected Gmail, so identification and reply handling stay with you.