The Legal Basics Every B2B Cold Email Program Needs to Cover

Most teams land on one of two wrong assumptions: that B2B cold email is exempt from spam law because there is no bulk list involved, or that GDPR makes any unsolicited email illegal outright. Neither is true, and the gap between those two wrong assumptions is where the real compliance risk sits. Below is the plain-language version of what CAN-SPAM and GDPR actually require for targeted B2B outreach, and the handful of things teams consistently get wrong.

Two wrong assumptions that create most of the risk

The first wrong assumption is that CAN-SPAM only covers bulk consumer email, so a targeted message to a handful of named decision-makers at specific companies is somehow outside its scope. It is not. CAN-SPAM applies to any email whose primary purpose is commercial, and volume has nothing to do with whether the law applies — it affects how aggressively an operation gets flagged for enforcement, not whether the underlying rules apply to a given message.

The second wrong assumption runs the other direction: that GDPR effectively bans cold outreach because it requires opt-in consent for everything. GDPR does not require consent for every use of personal data — it requires a valid legal basis, and for B2B outreach that basis is usually legitimate interest, not consent. The practical effect is that reasonably targeted B2B cold email is legal under GDPR, provided the sender can show the outreach is relevant to the recipient's professional role and gives them an easy way to say no.

What both frameworks actually regulate is narrower and more mechanical than either assumption suggests: accurate sender identification, honest subject lines, a working opt-out, and — for GDPR — a documented reason for processing someone's personal data and a way to honor their objection. Getting those mechanics right matters more than resolving an abstract question of whether cold email is allowed.

What CAN-SPAM actually requires

CAN-SPAM does not require the recipient to have opted in, and it does not ban cold outreach to a business inbox. It regulates how the message presents itself and what happens after someone asks to stop hearing from you. The requirements that matter for a B2B cold email program are narrow and checklist-able rather than a broad judgment call.

• Accurate header information: the from name, from address, and reply-to domain must actually belong to the sender — spoofed or misleading sending domains are the clearest CAN-SPAM violation and also the fastest way to tank domain reputation regardless of legality.
• Non-deceptive subject lines: a subject line has to reflect the content of the email honestly — calling a first-touch cold email a 'follow-up' or 're:' to fake a prior relationship crosses this line and is also just bad practice for reply rate.
• A valid physical postal address: every commercial email needs a real postal address somewhere in the message, typically the footer — a PO box or registered agent address is acceptable, but omitting it entirely is a common oversight.
• A working opt-out mechanism: recipients need a clear, functioning way to opt out of future email, and it has to keep working for at least 30 days after the message is sent.
• Opt-outs honored within 10 business days: once someone opts out, no further commercial email can go to that address after that window — this is the requirement teams miss most often when suppression lists live in a separate tool from the one doing the sending.
• Accountability for what's sent on your behalf: if an agency or an outsourced SDR team sends on your behalf, you are still responsible for their compliance with all of the above.

What GDPR actually requires for B2B outreach

GDPR applies whenever you are processing the personal data of an individual physically located in the EU or EEA, and a work email address tied to a named person counts as personal data even though it is a business address. A generic inbox like info@company.com does not carry the same personal-data status, but sales@ and info@ addresses are rarely useful for cold outreach anyway, so this distinction matters less in practice than people expect.

Consent is one legal basis for processing that data, but it is not the one most B2B cold outreach uses. Legitimate interest is the more common basis: you can argue a legitimate interest in reaching a named professional about something plausibly relevant to their role, provided that interest is balanced against the individual's rights and expectations. That balancing has to be a real, documented judgment — not just an assumption that B2B automatically qualifies — and it changes the moment the outreach stops being plausibly relevant to the person's actual job.

Beyond the legal basis itself, GDPR requires transparency about who is emailing someone and why, a straightforward way to object to further contact, and reasonable limits on how long you retain contact data that never converts into a relationship. If contact data crosses outside the EEA to a vendor or CRM hosted elsewhere, that transfer needs its own safeguards, typically covered by the vendor's standard contractual clauses rather than anything the sender has to build themselves.

One detail worth flagging separately: individual EU member states implement the ePrivacy rules that sit alongside GDPR differently, and a few — Germany is the most commonly cited example — apply a stricter reading of what counts as acceptable unsolicited B2B email than the EU baseline. If a program sends heavily into one specific EU country, it's worth checking that country's national interpretation rather than relying on the general GDPR legitimate-interest reading alone.

Where B2B teams get this wrong

The mistakes that actually generate legal and deliverability risk are rarely about the big conceptual question of whether cold email is allowed. They are almost always mechanical gaps in an otherwise reasonable program.

• Suppression lists that live in one tool but sending that happens through another, so an opt-out recorded in the CRM never reaches the mailbox actually sending the next sequence.
• Subject lines and opening lines that fake a prior relationship — 're: our conversation' when there was none — which is both a CAN-SPAM problem and a fast way to generate spam complaints.
• No physical address anywhere in the email or the footer, usually because a template was copied from a transactional email design that never needed one.
• Treating 'legitimate interest' as a blanket permission rather than a case-by-case judgment — sending outreach to a role that has no plausible connection to what's being pitched weakens the legitimate-interest argument considerably.
• Buying or scraping a contact list with no record of where the data came from or why outreach to it is justified — if a data protection authority or a recipient ever asks, 'we bought a list' with no further documentation is a weak answer.
• Continuing to email someone after they've replied 'not interested' or 'please remove me,' because the reply landed in a shared inbox that never fed back into the suppression list.

Building compliance into the sending workflow

Compliance holds up best when it's a property of the sending process, not a review step someone does after a campaign is already built. That means a footer template with a real address and a working opt-out link baked into every sequence by default, not added manually per campaign. It means a single suppression list that every sending tool checks against before a message goes out — including the AI-rendered or personalized versions of a template, which is where suppression checks get skipped most often because they feel like a special case.

For GDPR specifically, keep a short, written record of the legitimate-interest reasoning for each significant segment of outreach — who you're contacting, why the outreach is relevant to their role, and what the opt-out process looks like. This does not need to be a legal document; a few sentences per campaign or per ICP segment is usually enough to show the judgment was actually made, which is what regulators and any accidental audit are really checking for.

Finally, treat any reply that reads as an objection — 'not interested,' 'please remove me,' 'stop emailing this address' — as an immediate, permanent suppression event, not a soft signal to deprioritize. Routing those replies automatically into a suppression list, rather than relying on someone to notice and manually update a spreadsheet, closes the gap where most real opt-out failures actually happen.

A pre-send checklist

Before a new sequence goes live, this short list catches most of what actually causes compliance problems in practice.

• Sending domain and reply-to address are real and match the identity presented in the from name.
• Subject line and opening line accurately represent this as a first-touch message if it is one.
• A real physical address appears somewhere in the email.
• The opt-out mechanism is tested and confirmed working, and feeds into the same suppression list every sending tool checks.
• For EU/EEA contacts, there's a one-paragraph note on file explaining the legitimate-interest basis for this specific segment.
• Any vendor or CRM holding EU contact data outside the EEA has the appropriate transfer safeguards in place.
• Replies indicating an objection are routed automatically into suppression, not manually triaged by whoever happens to check the inbox.

FAQ