Can I cold email them? The rules in 23 countries.

Australia allows commercial email with consent, and consent is inferred when a work address is conspicuously published, carries no "no unsolicited messages" notice, and your message relates to that person's work. Every message needs accurate sender details and a working unsubscribe, and opt-outs take effect after 5 business days.

What it takes

• Consent is required, but is inferred if a work address for an employee, director, officer, partner, office-holder or self-employed person is conspicuously published, with no statement refusing unsolicited commercial messages, and the message relates to their work-related business, functions or duties
• Message must clearly and accurately identify who authorised it and how to contact them; the contact details must be reasonably likely to stay valid for at least 30 days
• Include a functional unsubscribe facility (statement plus address) that works for 30 days
• Opt-outs take effect after 5 business days

Law: Spam Act 2003 s.16, s.17, s.18; Sch 2 cl 4 (inferred consent from publication), cl 6 (withdrawal)

Austria bans advertising email without the recipient's prior consent, and the ministry states this covers business recipients too. The existing-customer exception is narrow. Administrative fines of up to €50,000 are possible, so don't cold email Austrian contacts without consent.

What it takes

• Email (including SMS) sent for direct advertising is not allowed without the recipient's prior consent
• The ministry says this applies in the business sector as well as to non-businesses
• Existing-customer exception needs: sale, own similar products, clear free opt-out at collection and each message, and no prior refusal
• Never conceal the sender's identity; always provide a genuine address to which stop requests can be sent

Law: TKG 2021 §174(3), (4), (5); penalty §188(4)

Penalties: Administrative fine up to €50,000 for §174(3)/(5) breaches (§188(4) TKG 2021)

Belgium requires prior consent for advertising email. The exception covers impersonal company addresses such as info@ or sales@. A personal work address like name.surname@company.be needs consent. Include an opt-out in every message and stop when asked.

What it takes

• Advertising by email needs the recipient's prior, free, specific and informed consent
• Exception for legal persons applies only if the email address is impersonal (info@, sales@); a personal address such as name.surname@company.be belongs to a natural person and needs consent
• The exception works only for products aimed at legal persons, not for reaching individuals through a company address
• Every advertising email must tell the recipient they can opt out and give a way to do so electronically; honour requests

Law: Code of Economic Law (CDE) art. XII.13 §1-2; Royal Decree of 4 April 2003 art. 1(2°) and art. 2

We found no email-marketing statute in Brazil; the data-protection law (LGPD) governs. Using an address the person made public can rest on legitimate interest if it fits why they published it, you use only the data you need and you honour objections. Ask a Brazilian lawyer for large campaigns.

What it takes

• No email-marketing statute found; the LGPD governs use of the address
• Consent is waived for data the person made manifestly public, but you must respect the purpose and good faith behind its publication, and the LGPD's principles and the person's rights still apply
• Legitimate interest must be tied to concrete legitimate purposes, use only strictly necessary data, and be transparent
• The person can object to processing that relies on a consent waiver or legitimate interest if the Law is not followed

Law: LGPD (Lei 13.709/2018) arts 7(IX), 7 §§3-4, 7 §6, 10, 18 §2, 52

Penalties: Simple fine up to 2% of Brazilian revenue, capped at R$50,000,000 per infraction (art. 52, II)

Canada requires consent. For a cold work email the route is implied consent: the person published the address openly without saying they don't want unsolicited offers, and your message is relevant to their role. Identify yourself with a mailing address and another contact method, include a free unsubscribe and honour it within 10 business days. You must be able to prove the consent, so ask a lawyer if you are unsure the address was openly published.

What it takes

• Consent is required. For a cold work email the route is implied consent: the person conspicuously published the address, with no statement that they don't want unsolicited commercial messages, and your message is relevant to their business, role, functions or duties (or they gave you the address themselves without saying they don't want such messages)
• Identify yourself: your name (and who you send for), mailing address, and a phone number, email address or web address
• Include an unsubscribe mechanism that is free and uses the same electronic means; act within 10 business days; contact details and unsubscribe address valid at least 60 days
• You carry the burden of proving consent (s.13)
• CASL applies only if a computer system located in Canada is used to send or access the message (s.12(1))

Law: CASL (S.C. 2010, c.23) s.6(1)-(2), s.10(9)(b)-(c), s.11, s.12(1), s.13, s.20(4); Electronic Commerce Protection Regulations (CRTC), SOR/2012-36 s.2

Penalties: Up to $10,000,000 per violation for organisations and $1,000,000 for individuals (s.20(4); ISED page says the same)

Denmark requires prior consent for direct marketing by email, and the Consumer Ombudsman says this covers businesses and both generic and personal work addresses. Messages must say they are marketing, name who is behind them and give a stop address. Violations can be punished with a fine.

What it takes

• Prior consent is required for direct marketing by email to anyone, including businesses and personal or generic work addresses
• The message must make clear it is marketing, name on whose behalf it is sent, and give an address (or link) to stop it
• Consent must be documented and withdrawable easily and free of charge
• Existing-customer exception (§10(2)) has several conditions that all must be met

Law: Markedsføringsloven §10(1)-(3)

Penalties: Breach of §10(1)-(3) can be punished with a fine; the guidance gives no amount

The French regulator CNIL accepts cold email to professionals on the basis of legitimate interest, but only if the message relates to the person's profession, they have been told their address may be used for prospecting and they can object easily. Generic company addresses such as info@ fall outside these rules. For individuals acting privately, consent is required.

What it takes

• Professionals: prospecting can rest on legitimate interest if the subject of the solicitation relates to the person's profession
• The person must have been told their address may be used for prospecting and be able to object (easy, free), including in each message
• Generic company addresses (info@, contact@) are outside these principles per CNIL
• Individuals acting privately: prior consent required
• Include valid contact details for stop requests

Law: CPCE art. L34-5; GDPR arts 6(1)(f), 14, 21

Germany requires the recipient's prior express consent for advertising email, including to business recipients. The law allows presumed consent only for phone calls. A cold sales email can lead to injunction claims from competitors or associations, so don't send without consent unless a German lawyer has cleared it.

What it takes

• Prior express consent of the addressee for advertising by email, with no carve-out for business recipients
• Presumed consent exists only for phone calls to non-consumers (Nr. 1), not for email (Nr. 2)
• Existing-customer exception (§7(3)) needs a sale, own similar products, no objection and a notice at collection and every use; it does not fit a cold first contact
• Always: do not conceal the sender's identity; give a valid address for stop requests (§7(2) Nr. 3)

Law: UWG §7(1), §7(2) Nr. 2 and Nr. 3, §7(3); remedies §8

Penalties: No fine for email: §20 UWG fines (up to €300,000) cover phone and automatic-caller advertising to consumers. Civil injunction and removal claims by competitors and qualified associations (§8 UWG)

India has no rule specific to unsolicited email: the telecom spam rules cover calls and SMS, and the new data-protection law's main duties are not yet in force. That law also excludes personal data a person made public themselves. Even so, send relevant, identified messages, stop when asked, and take advice for large campaigns.

What it takes

• The telecom spam rules (TCCCPR 2018) cover voice calls and SMS, not email
• The Digital Personal Data Protection Act 2023 does not apply to personal data the person made public themselves (s.3(c)(ii)(A))
• DPDP Rules 2025 were notified in Nov 2025 with an eighteen-month phased compliance period, so main obligations are not yet in force (around May 2027)
• Good practice: identify yourself, keep it relevant, stop when asked

Law: DPDP Act 2023 s.3(c)(ii); DPDP Rules 2025; TCCCPR 2018 reg. 2 (definition of commercial communication); no email-specific statute found

Irish law lets you email a work address without prior consent if it appears to be used mainly for that person's work and your email relates solely to that work. Companies can opt out, and you must then stop. Give a valid address for stop requests and don't hide who you are, because each unlawful email is a separate offence.

What it takes

• To a natural person: consent is needed, EXCEPT a work address that reasonably appears to be used mainly in their commercial or official activity, where your email relates solely to that activity
• To a non-natural person (company): allowed unless they have notified you they do not consent; stop if they do
• Include a valid address at which you can be contacted / to which stop requests can be sent; do not disguise or conceal the sender
• If the address identifies a person, GDPR also applies (lawful basis, transparency, right to object)
• Each unlawful email is a separate offence

Law: S.I. No. 336/2011 (ePrivacy Regulations) reg. 13(1), 13(2), 13(4), 13(10)(c), 13(12), 13(13)-(15)

Penalties: On indictment: up to €250,000 (body corporate) or €50,000 (natural person), per email (reg. 13(13)(b), 13(15))

Italy requires prior consent for promotional email, and the regulator says an address being easy to find online does not give permission. A single email counts, not only mass sending. Treat Italy as consent-first and check with an Italian lawyer before cold outreach.

What it takes

• Prior consent of the 'contraente o utente' is required for promotional email
• The Garante says a single email counts; mass sending is not required for the rules to apply
• An address being easy to find online does not authorise promotional email without consent
• Soft opt-in only for your own similar products to customers who gave the address in a sale
• Do not conceal identity; give a contact point to exercise data rights (art. 130(5))

Law: D.Lgs. 196/2003 (Codice privacy) art. 130(1)-(2), (4), (5); Garante guidelines on promotional activity and spam, 4 July 2013

Japan allows advertising email to a business or self-employed person who has published their email address on the internet, unless the page says they refuse such email. You must show your name, your address and a way to opt out, and stop when asked. Breaking a government order under the Act is a criminal offence, with fines up to ¥1 million, or ¥30 million for companies.

What it takes

• Advertising email (特定電子メール) may be sent to a body, or to an individual who runs a business, that has published its email address on the internet, unless the page also says it refuses such email
• The Act itself doesn't require the email to relate to their work, but keeping it relevant is the safer course
• You must show your name, a way to opt out, your postal address and a contact for complaints; stop when someone refuses
• Never falsify sender information (art. 5)
• The Act covers sending from or to telecom equipment in Japan

Law: Act on Regulation of Transmission of Specified Electronic Mail (平成14年法律第26号) arts 2, 3(1)(iv), 3(3), 4, 5, 7, 34, 37; Enforcement Regulations (平成14年総務省令第66号) arts 3, 9

Penalties: Breaching a government order (art. 7) or falsifying sender information: up to 1 year's imprisonment or ¥1,000,000 (art. 34); companies up to ¥30,000,000 (art. 37)

Dutch law requires prior consent for unsolicited commercial email, to companies and individuals alike. The exception is for contact details the recipient has designated and published for receiving commercial approaches, and an ordinary work or contact address is not obviously that. Messages must show the true sender and a valid address or number for stop requests.

What it takes

• Prior consent is required for unsolicited commercial email to companies and to natural persons acting in business
• Exception: no consent needed if you use contact details the recipient has designated and published for receiving unsolicited commercial communication, and you use them for that purpose (art. 11.7(3)(a))
• The explanatory memorandum's example is an address the recipient published on their website as available for this kind of communication, so an ordinary work or contact address is not clearly covered
• State the true identity of the sender and a valid postal address or number for stop requests (art. 11.7(6))
• Burden of proof of consent is on the sender

Law: Telecommunicatiewet art. 11.7(1), (3), (6); enforcement art. 15.1(3), 15.4(2)

Penalties: ACM fine up to €900,000 or, if more, 1% of turnover (art. 15.4(2))

New Zealand treats an openly published business address as deemed consent if there is no refusal notice and your message is relevant to the person's business or role. Identify yourself with contact details that stay valid for 30 days, include a free unsubscribe and act on requests within 5 working days. DIA says fines can reach $500,000.

What it takes

• Deemed consent when someone conspicuously publishes their address in a business or official capacity, there is no statement refusing unsolicited commercial messages, and your message is relevant to their business, role, functions or duties
• Identify the business responsible and how to contact it; contact details must be reasonably likely to stay valid for at least 30 days
• Include a free, clear unsubscribe facility using the same medium; honour requests within 5 working days
• A single message can be spam; it need not be bulk

Law: Unsolicited Electronic Messages Act 2007 s.4 (consent), s.9, s.10, s.11 (as cited by DIA)

Penalties: Up to $500,000 (DIA)

Since 10 November 2024, Poland's Electronic Communications Law bans commercial information to a subscriber or end user by email and similar means without their prior consent. The text is not limited to consumers. The telecoms regulator can fine up to 3% of annual revenue or PLN 1,000,000. Ask a Polish lawyer if you plan to rely on legitimate interest for B2B.

What it takes

• Since 10 Nov 2024, art. 398 of the Electronic Communications Law bans sending commercial information, including direct marketing, to a subscriber or end user by terminal equipment (incl. interpersonal communications services) without their prior consent
• Consent can be given by providing an electronic address for the purpose of receiving commercial information (art. 398(2))
• The previous rule, art. 10 of the Act on Electronic Services, was repealed
• Sending in breach is also an act of unfair competition (art. 398(4))

Law: Prawo komunikacji elektronicznej (Dz.U. 2024 poz. 1221) art. 398, art. 446(5); Dz.U. 2024 poz. 1222 art. 26(3) (repeal of UŚUDE art. 10)

Penalties: UKE fine up to 3% of previous-year revenue or PLN 1,000,000, whichever is higher (art. 446(5))

Singapore's Spam Control Act covers bulk sending only, defined as more than 100 similar messages in 24 hours, 1,000 in 30 days or 10,000 in a year. Below that, one-to-one business email is outside the Act, and the data-protection law does not apply to business contact information. In bulk you need an unsubscribe facility, an "<ADV>" label and accurate contact details.

What it takes

• The Spam Control Act applies only to unsolicited commercial messages sent in bulk: more than 100 similar messages in 24 hours, more than 1,000 in 30 days, or more than 10,000 in a year
• If bulk, the Second Schedule applies: unsubscribe facility (honour within 10 business days), '<ADV>' label in the subject, accurate and functional contact details
• The PDPA's data protection provisions do not apply to business contact information
• The Do Not Call Registry covers Singapore telephone numbers (calls, texts, faxes), not email addresses

Law: Spam Control Act 2007 s.6, s.7, s.11, Second Schedule; PDPA 2012 s.4(5), Parts 9 and 9A

South Africa's POPIA prohibits direct marketing by email unless the person consented or is an existing customer, and the Act can protect companies as well as individuals. You may ask for consent only once, and every message must name the sender and give a stop address. Administrative fines can reach R10 million.

What it takes

• Direct marketing by email is prohibited unless the data subject consented or is an existing customer (own similar products, with a chance to object)
• 'Person' and data subject can include an identifiable existing juristic person, so companies can be covered
• You may approach a person only once to ask for consent, and only if they have not already withheld it
• Every direct-marketing message must give the sender's identity and an address to ask that messages stop

Law: POPIA (Act 4 of 2013) s.69(1)-(4), s.109; Information Regulator Guidance Note on Direct Marketing

Penalties: Administrative fine up to R10 million (s.109(2)(c))

Spain prohibits commercial email that the recipient has not requested or expressly authorised, and the rule covers companies and people acting professionally. The only exception is an existing customer relationship. Identify the sender clearly and include an easy opt-out. Fines go up to €30,000 for minor and €150,000 for serious breaches.

What it takes

• Commercial email not previously requested or expressly authorised by the recipient is prohibited; the recipient can be a legal person or acting professionally
• Only exception: prior contractual relationship, own similar products, with a free opt-out at collection and in every message
• Commercial communications must be clearly identifiable as such and name the person on whose behalf they are sent
• Do not hide the sender's identity; include a valid email address for opt-out

Law: Ley 34/2002 (LSSI) art. 21(1)-(2), art. 20(1),(4), art. 3(d), arts 38-39

Penalties: Minor: up to €30,000; serious (e.g. mass or insistent sending, art. 38.3.c): €30,001-150,000 (art. 39.1)

Sweden requires consent for marketing email to individuals, including sole traders, but not for companies and other legal entities. Every marketing email must still carry a valid address for stop requests. Whether a named employee counts as an individual is not settled in the sources checked, so take the cautious route for named people.

What it takes

• Prior consent is required for email marketing to a natural person
• No consent rule applies to legal persons (companies, foundations, agencies), but every marketing email must still carry a valid address for stop requests, including to legal persons
• Sole traders count as natural persons; whether a named employee of a company does is not settled
• GDPR applies when you email a named person: say where you found the address and stop on objection

Law: Marknadsföringslagen (2008:486) 19 § and 20 §; Prop. 2003/04:43; marketing disruption fee 29-31 §§

Penalties: Marketing disruption fee: at least SEK 10,000 and at most 4% of annual turnover (31 §)

Swiss law requires consent for mass advertising sent by email, with the sender named and an easy way to refuse. A genuinely individual, hand-written message is not "mass" on the wording, but that reading is untested and templated campaigns are likely caught. Ask a Swiss lawyer before sending sequences.

What it takes

• Applies to 'Massenwerbung' (mass advertising) sent by telecommunication; BAKOM describes it as 'automatischer Massenversand'
• Needs the recipient's prior consent, the correct sender, and an easy free way to refuse
• Exception for customers who gave contact details in a sale, for own similar products, with refusal notice
• A genuinely individual, hand-written one-off email is not 'mass' on the wording; untested, and templated sequences are likely caught

Law: UWG (SR 241) Art. 3(1)(o); Art. 23(1)

Penalties: Intentional breach of Art. 3: prosecuted on complaint, up to three years' imprisonment or a monetary penalty (Art. 23(1))

We could not find a UAE rule that clearly binds a foreign sender of one-to-one B2B email. The telecom regulator's spam policy defines spam as marketing sent without consent, but it sets duties for licensed operators. The data-protection law exists, but its regulations and enforcement body were not confirmed. Ask first or get local advice.

What it takes

• The TDRA policy defines spam as marketing electronic communications sent without the recipient's consent, and applies to all electronic communications with a UAE link, but the compliance duties it sets fall on telecom licensees
• The federal data protection law allows processing of data made public by the person themselves without consent and gives a right to object to direct-marketing processing
• The law's executive regulations and the UAE Data Office could not be confirmed as in force
• Cautious approach: ask first, identify yourself, stop on request

Law: TDRA Regulatory Policy on Unsolicited Electronic Communications (v1.0, 30 Dec 2009) arts 1.11, 3.1, 3.3; Federal Decree-Law 45/2021 arts 4(2), 17(1)

The UK treats companies and individuals differently. Marketing email to a limited company, LLP or Scottish partnership needs no consent under PECR, but sole traders and other partnerships count as individuals and you need their consent first. Either way, don't hide who you are and give a working opt-out, and if the email names a person, UK GDPR applies, including their absolute right to object. If you can't tell which type of business it is, the ICO says to treat it as an individual.

What it takes

• Corporate subscribers (companies, LLPs, Scottish partnerships, some public bodies): no PECR consent needed for B2B marketing email
• Sole traders and other partnerships (English, Welsh, Northern Irish) are treated as individuals: you need their specific consent; the soft opt-in needs contact details obtained in a sale or negotiation, so it does not fit a first cold email
• Always: do not disguise or conceal your identity; give a valid address to opt out
• If you know the person's name, UK GDPR applies: lawful basis (usually legitimate interests), transparency, and their absolute right to stop direct marketing
• If unsure which type the subscriber is, the ICO says to treat it as an individual subscriber

Law: PECR 2003 (SI 2003/2426) reg. 22 (individual subscribers) and reg. 23 (identity, opt-out address); UK GDPR art. 21; Data (Use and Access) Act 2025 (PECR fines)

Penalties: ICO: fines of up to £17.5 million or 4% of global turnover under PECR, since the Data (Use and Access) Act's change on 5 February 2026 (ICO statement)

The US does not ban cold B2B email, but CAN-SPAM covers business email as well as consumer email. Your message needs an accurate sender, a non-misleading subject line, a clear sign that it is an advertisement, your valid postal address and a working opt-out, honoured within 10 business days. Penalties apply per email, so ask a lawyer before any large campaign.

What it takes

• No false or misleading header information; no deceptive subject line
• Disclose clearly and conspicuously that the message is an advertisement
• Include your valid physical postal address (street address, registered PO box or registered private mailbox)
• Include a working opt-out (must work for at least 30 days); honour opt-outs within 10 business days; no fee and no extra information beyond an email address
• You are also responsible for what others send on your behalf

Law: CAN-SPAM Act, 15 U.S.C. 7701-7713; core duties 15 U.S.C. 7704(a)(1),(3),(4),(5); penalties 15 U.S.C. 7706

Penalties: Up to $53,088 per violating email (figure printed in the FTC guide)