Cold Outreach Laws Explained: CAN-SPAM, GDPR, PECR and CASL for B2B Teams

By Laurel · Updated Oct 8, 2026

Cold outreach law has two layers. Data protection law (GDPR, UK GDPR) governs how you collect, hold and use a person's details. E-marketing law (CAN-SPAM, PECR, CASL, the TCPA) governs the message you send. B2B isn't exempt from either, though the rules differ by country and by who receives the message. This is general information, not legal advice.

"B2B is fine" is a common refrain in outbound teams, and it's a half-truth. The US has no business-to-business exception for email, the UK exempts company mailboxes from its email consent rule but not the named person's data, and Canada puts consent first. Inside the EU, the answer changes by country.

This guide covers the main Western rules, each tied to its regulator or statute, with a comparison table and a checklist. The motion they sit inside is in the outbound sales playbook.

Key Facts

• The FTC says CAN-SPAM has no business-to-business exception, requires opt-outs to be honored within 10 business days, and allows penalties of up to $53,088 per violating email.
• The ICO says PECR's email consent rule doesn't apply to corporate subscribers, but does reach sole traders and some partnerships.
• GDPR Recital 47 says direct marketing may be regarded as a legitimate interest, and Article 21 ends that use of a person's data once they object.
• Canada's Anti-Spam Act bars commercial messages without express or implied consent and puts the burden of proving consent on the sender.
• The FTC says most calls to businesses are exempt from the National Do Not Call Registry.

The Two Layers: Data Protection and E-Marketing

Every cold message touches two bodies of law, and knowing one doesn't cover the other.

Layer One: Data Protection

Data protection law asks whether you may collect, store and use a person's details at all: GDPR in the EU, UK GDPR in the UK. The ICO is direct about business contacts. If you can identify an individual, directly or indirectly, it's personal data even when they act in a business capacity. A named employee's work email usually qualifies, while a generic IT-department mailbox generally doesn't. Where the data came from matters, which is why how B2B contact data works is the companion read.

Layer Two: E-Marketing Law

E-marketing law regulates the message and the channel: CAN-SPAM and the TCPA in the US, PECR in the UK, CASL in Canada, and national laws built on the ePrivacy Directive in the EU. It asks what the message must contain, whether you needed permission first, and how fast you must stop.

Why One Doesn't Cover the Other

Take a cold email to a named director at a UK limited company. PECR's consent rule doesn't apply to corporate subscribers, so layer two doesn't demand consent. But UK GDPR still applies to the director's data, so layer one demands a lawful basis, privacy information and a way to object. The reverse holds too: the ICO says that if you rely on legitimate interests for direct marketing, the marketing must still comply with PECR. Each regime also defines its own reach, so check whether a country's law applies before emailing into it from abroad.

United States: CAN-SPAM, Calls and Texts

CAN-SPAM: Rules for the Email Itself

CAN-SPAM covers commercial email, meaning a message whose primary purpose is advertising or promoting a commercial product or service. A cold sales email qualifies, and the FTC's guide is blunt that the law makes no exception for business-to-business email. The requirements:

• Accurate headers. The From, To and reply-to details, plus the sending domain and address, must not be false or misleading.
• Honest subject lines. The subject must reflect what's inside.
• An ad label and an address. Identify the message as an ad and include a valid physical postal address.
• An opt-out, honored within 10 business days. The mechanism must keep working for at least 30 days after sending, can't cost anything, and can't demand more than a reply email or a visit to one web page.
• No selling opted-out addresses. The one exception is a company you hired to help you comply.
• Oversight of others. Hiring a vendor or agency doesn't transfer legal responsibility.

Nothing in that list asks for permission before the first message. CAN-SPAM regulates what the email contains and what you do when someone says stop, a lighter first-send test than CASL's, so the stop request is where discipline matters. The FTC says each separate email in violation can draw penalties of up to $53,088. Mailbox providers add their own rules (cold email deliverability), and signature elements are in how to write a cold email.

US Calls and Texts

The business carve-out is wider here. The FTC says its Telemarketing Sales Rule exempts most calls to businesses, except calls selling nondurable office or cleaning supplies and calls targeting individual employees for their own use. The National Do Not Call Registry holds consumers' numbers, and sellers calling consumers must sync their lists at least every 31 days, per the FTC's Do Not Call guidance.

The separate risk is the Telephone Consumer Protection Act. 47 U.S.C. section 227 makes it unlawful to call a cellular number using an automatic telephone dialing system or an artificial or prerecorded voice without the called party's prior express consent, with limited exceptions. The wording doesn't separate business mobiles from personal ones. The FCC describes the TCPA as protecting consumers from unwanted calls and texts, and its February 2024 ruling confirmed that AI-generated human voices count as artificial voices. Whether a dialer is "automatic" is a question for counsel, so treat prerecorded drops, AI voice agents and automated texts to mobiles as consent-first until you have written advice. The cold calling fundamentals guide covers calling rules across markets.

European Union: GDPR and ePrivacy

GDPR: Legitimate Interest for B2B Outreach

Consent is rarely workable for a first message to a stranger, so the basis outbound teams usually consider is legitimate interests under Article 6(1)(f): processing necessary for the legitimate interests of the controller or a third party, unless the person's interests or fundamental rights and freedoms override them. Recital 47 says direct marketing may be regarded as a legitimate interest, and tells you to weigh people's reasonable expectations based on their relationship with you.

It isn't a free pass. The ICO describes a three-part test, and you need all three: a purpose test (is there a legitimate interest?), a necessity test (is using the data a targeted, proportionate way to pursue it?) and a balancing test (do the person's interests, rights or freedoms override yours?). Write the assessment down. It's easier to defend when the offer relates to the recipient's role, the list is narrow and objecting is easy.

Articles 14 and 21: Notice and Objection

When data comes from someone other than the person, such as a vendor or a company website, Article 14(3) says you must tell them within a reasonable period and at the latest within one month, or by your first communication if that comes sooner. The notice includes where you got the data. Article 21 gives people the right to object to direct marketing and ends the processing once they do. Under 21(4), the right must be brought explicitly to their attention, clearly and separately from other information, at the first communication at the latest.

In practice that means a notice line or privacy link in the first email, a clear way to object and a suppression record afterward, as the opt-outs and suppression lists guide explains. If lead capture runs through chat, the GDPR-compliant chat funnels guide covers that channel.

ePrivacy: Where B2B Email Rules Diverge

GDPR sets the data rules. The sending rule comes from the ePrivacy Directive, whose Article 13 allows automated calling, fax and email for direct marketing only with prior consent, with a narrow exception for a business's own customers. But paragraph 5 applies the consent rule to natural persons. For other subscribers, such as companies, member states must ensure their legitimate interests are sufficiently protected. So the EU has no single answer on B2B cold email. Two national examples show the spread:

• France. The CNIL's guidance on electronic prospecting says prospecting professionals can rest on legitimate interest when the message relates to the person's profession, the person was informed their address could be used for prospecting, and objecting is simple and free.
• Germany. Section 7(2) no. 2 of the Unfair Competition Act treats email advertising without the addressee's prior express consent as an unreasonable nuisance. The clause speaks of the addressee and doesn't carve out business recipients.

Same continent, opposite starting points. For each EU market, have someone qualified in that country's law confirm the rule.

United Kingdom: PECR and UK GDPR

PECR is the UK's e-marketing law. The ICO splits recipients into corporate subscribers (bodies with separate legal status, such as companies and LLPs) and individual subscribers, which include sole traders and some partnerships. For email and text marketing, PECR's consent rule doesn't apply to corporate subscribers, while individuals need specific consent or the soft opt-in. B2B email must still not hide your identity and must give a valid opt-out address, and the ICO says you should honor corporate opt-outs even though PECR doesn't strictly require it. A mailbox doesn't reveal which type you're writing to, so check company type before treating a contact as corporate.

For live calls, the ICO says you must check numbers against the TPS and, for corporate subscribers, the CTPS. A number must be on the register for 28 days before registration takes effect, and you must display your number, say who's calling and give contact details if asked. In 2026 the ICO fined Energy Prices Direct £160,000 over more than 700,000 unsolicited calls to numbers registered on the TPS and CTPS.

UK GDPR sits underneath, so named work emails are personal data and the legitimate interests test above applies. The ICO's B2B page also says it's under review because of the Data (Use and Access) Act, so read the current ICO guidance before hard-coding UK rules into a playbook.

Canada: CASL

Canada's Anti-Spam Act works the other way round from CAN-SPAM: consent comes first. Section 6(1) prohibits sending a commercial electronic message unless the recipient has consented, expressly or by implication, and the message meets the form requirements. A message is commercial if, judged by its content, one of its purposes is to encourage participation in a commercial activity (section 1(2)), so a cold sales email fits. The form requirements in section 6(2) are sender identification, contact information and a free unsubscribe mechanism, and section 11 requires an unsubscribe to take effect within 10 business days.

For a cold email, the question is whether consent can be implied. Section 10 keeps that narrow:

• Existing business relationship. A purchase within two years, or an inquiry or application within six months (section 10(10)). That helps with re-engagement, not with strangers.
• Conspicuous publication. The person published the address, with no statement refusing unsolicited commercial messages, and the message relates to their business, role or duties (section 10(9)(b)).
• Disclosed address. The person gave you the address on the same terms (section 10(9)(c)).

Section 13 puts the burden on you to prove consent, so keep the page URL and date with the contact record.

Email Rules Side by Side

This is the starting point for each regime, not a verdict on any campaign.

A Practical Compliance Checklist

Run this before a sequence goes live in a new market, then have a lawyer review it.

Before You Send

• Know the recipient's country and type. Company mailbox, named person or sole trader? The country picks the row in the table.
• Record the source and date of every contact. You need it for an Article 14 notice and to prove consent under CASL.
• Document your basis. For EU and UK named contacts, write the legitimate interests assessment. For Canada, note the consent type you rely on.
• Match the message to the role. The CNIL and CASL both tie B2B outreach to relevance to the recipient's job.
• Screen call lists. UK numbers against the TPS and CTPS, US consumer numbers against the Registry, and your own do-not-call list always.

In Every Message

• Real sender details and a matching subject. No fake "Re:", no hidden identity.
• Your name, company and postal address in the signature.
• A working opt-out. No fee, no login, nothing beyond a reply or a single page.
• For EU and UK named contacts, a notice. Where you got their details and how to object, shown clearly at first contact.

After You Send

• Suppress at once. The legal limit is 10 business days in the US and Canada, but a stop request should reach every tool the same day. Handling replies and booking meetings covers the reply side.
• Hold vendors to the same standard. The FTC says hiring another company doesn't transfer responsibility, and bought data stays your problem.
• Keep the records. Opt-outs, consent evidence, assessments and sources, in one place.
• Revisit the rules when you enter a new country or a regulator updates its guidance.

A source field and a do-not-contact flag on each record make this checklist easier to run. Rework's Lead Ops records the source of each lead and its Sales Ops CRM keeps activity on each contact, so the source note and the suppression flag live on the record instead of in a spreadsheet. The concept-level view is in outbound lead generation.

Pick Your Two Biggest Markets First

You don't need to master every regime before the next send. Find where most of your list sits, locate those two rows in the table, and write the rules your reps follow in a page of plain sentences. Then take that page to a lawyer who knows those countries, and update it when the regulators do. Singapore's Do Not Call register is covered in the WhatsApp for B2B outreach guide.