Written by Nilansh Gupta, co-founder of Digital Patron, a cold email agency in Gurugram that runs outbound into the US and UK for Indian companies. This is a plain-English summary of the official guidance, not legal advice; each rule links to the regulator's own page.
Checked against official sources on 9 Nov 2026.
The short answer
- US
- B2B cold email is legal without prior consent. CAN-SPAM is an opt-out law, and the FTC says plainly that "the law makes no exception for business-to-business email", so every rule below applies to B2B too (FTC: CAN-SPAM Act, a compliance guide for business).
- UK
- B2B cold email to corporate subscribers (limited companies, LLPs, Scottish partnerships, some government bodies) is allowed without consent under PECR. Email to sole traders and some partnerships is treated like email to consumers and generally needs consent (ICO: business-to-business marketing). If the email names a person, UK GDPR applies as well.
Get 20 free leads that match your ideal customer
Paste your website. Rumo, our AI GTM agent, works out who buys from you and finds 20 of them.
Free, no card.
US and UK side by side
| Rule | US (CAN-SPAM, FTC) | UK (PECR + UK GDPR, ICO) |
|---|---|---|
| Consent before a B2B email | Not required | Not required for corporate subscribers; generally required for sole traders and some partnerships (unless soft opt-in) |
| Identify the sender | Headers ("From", "Reply-To", routing) must be accurate | Must not disguise or conceal your identity |
| Subject line | Must not be deceptive | No specific PECR rule; misleading content still breaches fairness under UK GDPR |
| Say it is an ad | Clear and conspicuous disclosure required | No specific label required |
| Postal address | Valid physical postal address in every email | A valid contact address for opt-outs |
| Opt-out | Clear opt-out; honour within 10 business days; must work for at least 30 days after sending; no fee or extra data beyond an email address | Valid address to opt out; stop when asked; ICO advises a "do not email" list screened against new lists |
| Named contacts' data | No equivalent federal rule | UK GDPR applies: lawful basis (usually legitimate interests), privacy information, right to object |
| Who is liable | The advertiser and the sender; you cannot contract it away | The organisation sending or instigating the marketing |
| Maximum penalty | Up to $53,088 per violating email | Up to £17.5m or 4% of global turnover since 5 Feb 2026 |
- ICP listFrom Apollo and Sales Navigator, verifiedsearching “founding AE” on ashbyhqNorthwindFounding AEfit 96dana@northwind.io verified
- Warmed domainsIn your name, 15-day warm-upMailbox 1, day 15 of 15Mailbox 2, day 15 of 15Mailbox 3, day 15 of 15
- Personal sequenceDrafted with AI, approved by a humanTo dana@northwind.ioStep 1 of 4Northwind’s first AE hireApproved by a human
- Replies handledSorted and answered the same dayInterestedNot nowObjection
- Meeting bookedInvite sent with the contextCall with Dana, NorthwindInvite sent
US: what CAN-SPAM requires of a B2B cold email
The FTC's compliance guide lists the requirements. In order:
- No false or misleading header information. "From", "To", "Reply-To" and routing details must identify the person or business who sent the message.
- No deceptive subject lines. The subject must reflect what is in the email.
- Identify the message as an ad, clearly and conspicuously.
- Include your valid physical postal address. A street address, a registered post office box or a private mailbox registered with a commercial mail receiving agency.
- Tell recipients how to opt out of future email from you, in a way an ordinary person can recognise and use.
- Honour opt-outs within 10 business days. The opt-out must work for at least 30 days after you send, and you cannot charge a fee or ask for more than an email address and a single page visit.
- Monitor anyone sending on your behalf. Both the company whose product is promoted and the company that sends the email can be held responsible.
Penalties: "Each separate email in violation of the CAN-SPAM Act is subject to penalties of up to $53,088" (FTC, inflation-adjusted). Source: FTC: CAN-SPAM Act, a compliance guide for business.
UK: what PECR requires of a B2B cold email
PECR (the Privacy and Electronic Communications Regulations) splits recipients by subscriber type, per the ICO (ICO: business-to-business marketing; ICO: electronic mail marketing (PECR)):
Corporate subscribers: no consent needed
Companies, LLPs, Scottish partnerships and some government bodies are corporate subscribers. You can send them unsolicited marketing email without consent or a soft opt-in, on two conditions: you must not disguise or hide your identity, and you must give a valid contact address so they can opt out. The ICO calls it good practice to keep a "do not email" list of businesses that object and to screen new lists against it.
Sole traders and some partnerships: treat as individuals
Sole traders and some partnerships are individual subscribers, and PECR protects them like consumers. You generally need their consent, unless the soft opt-in applies: you got their details during a sale or negotiation, you are marketing your own similar products, and you offered an opt-out when you collected the details and in every message. The ICO says you cannot tell a sole trader from a limited company by the email address alone, and that if you are unsure, treat the contact as an individual.
UK GDPR still applies to named people
An address like jane.smith@company.co.uk is personal data, so UK GDPR applies even in B2B. Most B2B senders rely on legitimate interests, which needs a documented balancing test, a privacy notice telling the person where you got their data, and an immediate stop when they object (ICO: choosing your lawful basis for direct marketing). A generic address such as info@company.co.uk holds no personal data, so UK GDPR does not apply to it, but PECR still does.
Fines went up in 2026
Section 115 of the Data (Use and Access) Act 2025 came into force on 5 February 2026 and lifted the maximum PECR fine from £500,000 to UK GDPR levels: £17.5 million or 4% of global annual turnover, whichever is higher.
Is outbound worth it for you?
Move the sliders to your own numbers. These are your assumptions, not a forecast or a promise of results.
- Deals a month
- 0.8
- Return on fee
- 2.5x
- Deals to break even
- 0.32
Comfortably worth it on these numbers.
Digital Patron's plans start at $800 a month, and most programmes run $800 to $6,000+ depending on your offer, deal size and audience. Every other number here is your own assumption; we don't publish meeting counts or guarantees. All plans are on the pricing page.
A checklist for Indian companies emailing US and UK buyers
The rules follow the recipient, not the sender. An Indian company emailing a buyer in Texas follows CAN-SPAM; emailing a buyer in Manchester, it follows PECR and UK GDPR.
- Put a real physical postal address in every email footer (required in the US, sensible in the UK).
- Give a working opt-out in every email and process it fast: within 10 business days for the US, and straight away for the UK.
- Keep one suppression list across every mailbox and domain, and check it before each send.
- Use honest "From" names and subject lines that match the email.
- For UK lists, remove sole traders and non-LLP partnerships unless you have consent, and treat unclear contacts as individuals.
- For UK named contacts, write a legitimate interests assessment and tell people in the first email where you got their details.
- If an agency sends for you, ask how it handles each point above. Under CAN-SPAM you stay liable for what it sends.
Compliance is separate from deliverability. Authentication (SPF, DKIM, DMARC) and warm-up decide whether email reaches the inbox; see email deliverability. For running outbound into these markets, see US and UK outbound for Indian companies and India-based cold email agencies for US B2B.
FAQ
Common questions on US and UK cold email rules, answered from the FTC and ICO guidance above.
