Is B2B Cold Email Legal in the UK? Yes, Except for Sole Traders

In April 2020, a small London software firm emailed up to 9,000 people it had gathered "via things like LinkedIn connections, events, people that emailed me." One person complained. The ICO fined the firm £40,000.

Yes, B2B cold email is legal in the UK when you email limited companies or LLPs. PECR doesn't require their consent. You do have to say who you are, give people a working way to opt out, and have a UK GDPR lawful basis, usually legitimate interests, for emailing a named person. Sole traders and most partnerships are the exception. PECR treats them like consumers, so you need their consent.

This is general information, not legal advice. I run a cold email company, not a law firm. Check the primary sources linked below, or ask a UK data protection adviser.

Every guide on page one of Google says roughly that. None of them put numbers on where the risk actually sits. So I pulled two datasets: the government's count of UK businesses by legal form, and the 229 PECR fines in the ICO's fines register since 2012.

In those 229 fines, I couldn't find one for cold emailing a limited company. The risk sits in two places: the sole traders and partnerships that slip onto your list, about 1 in 9 businesses with 2 to 49 staff, and the person who asks you to stop.

What does PECR actually say about B2B email?

PECR, the Privacy and Electronic Communications Regulations 2003, is the UK's rulebook for marketing by phone, text and email. Its consent rule for marketing email is regulation 22, and the first line decides almost everything. Regulation 22 "applies to the transmission of unsolicited communications by means of electronic mail to individual subscribers."

A subscriber is whoever holds the contract for the email service. For a work inbox, that's normally the employer. So PECR doesn't ask "is this a business?" It asks "what kind of legal person owns this inbox?"

Sources: PECR regulation 2 and the ICO's business-to-business marketing guidance, checked October 2026.

The soft opt-in won't rescue a cold campaign. It only covers people whose details you got "in the course of the sale or negotiations for the sale" of something, and only for your own similar products.

Regulation 23 covers every marketing email, whoever gets it. Its two big duties are simple. You can't disguise or hide who's sending, and you must give a valid address where the recipient can ask you to stop.

How many UK businesses count as "individuals"?

More than you'd guess. At the start of 2025 the UK had 5.69 million private-sector businesses, according to the Department for Business and Trade's 2025 Business Population Estimates. 3.2 million were sole proprietorships, 57% of the total. Another 368,000, or 6%, were ordinary partnerships. Only 2.1 million, 37%, were companies, a count that includes LLPs.

So most UK businesses count as "individuals." That sounds scary until you split it by size.

Source: Department for Business and Trade, Business Population Estimates 2025, Table 3, n = 5.69 million businesses, start of 2025. LLPs count as companies.

The sole trader problem is mostly a one-person problem. 78% of UK businesses with zero or one employee are sole traders or partnerships. At 2 to 9 employees it's 12%, and from 10 up it's under 10%. Across 2 to 49 employees, it's about 1 in 9.

If your buyers are companies with real teams, almost everyone on your list is a corporate subscriber. If you sell to freelancers, tradespeople or one-person consultancies, most of your list needs consent first.

How many contacts on a real UK list could be sole traders?

It depends almost entirely on the size of the companies you target. Apply the government's numbers to your own list's size mix and you get a fair first guess.

Source: Department for Business and Trade, Business Population Estimates 2025, Table 3, start of 2025, checked October 2026. LLPs count as companies.

Here's the math for a common B2B list. Split it evenly across companies with 2-9, 10-49 and 50-249 staff, and about 8 in 100 contacts sit at a business PECR may treat as an individual. Aim only at companies with 50 or more staff and it drops to about 3 in 100 or fewer. Add freelancers and one-person consultancies and it climbs fast, because nearly 8 in 10 of those businesses need consent.

That's a first guess, not a verdict, so check your own list with the steps further down.

A LinkedIn label isn't a legal form, either. Plenty of firms that call themselves a partnership on LinkedIn are LLPs, which are corporate. A sole trader can also call itself "Privately Held." Treat flagged rows as "check before sending," not as a verdict.

Do I still need UK GDPR if PECR says yes?

Yes. PECR decides whether you can send the email. UK GDPR decides whether you can use the person's data. A named work address like [email protected] is personal data "even if they are acting in their business capacity," the ICO says.

UK GDPR asks three things of a cold email to a named person:

1. A lawful basis. Usually that's legitimate interests. Since 5 February 2026, Article 6(11)(a) of UK GDPR names direct marketing as an example of one. You still have to pass the three-part test of purpose, necessity and balance in the ICO's legitimate interests guidance, updated 23 March 2026. In plain words, is the offer relevant to their job, do you use only the data you need, and would they expect to hear from you? The same guidance says legitimate interests only works where PECR doesn't already demand consent, so it can't cover sole traders.
2. Telling them. When the data didn't come from the person, Article 14 says you must give privacy information "at the latest at the time of the first communication," including where you got their details. Many senders do this with one line in the first email and a link to a full privacy notice.
3. Stopping when asked. Once someone objects to direct marketing, Article 21 says their data "shall no longer be processed for such purposes."

Most guides miss an odd gap here. For email, "PECR does not say that you must comply with a corporate subscriber's opt-out," the ICO notes. But the person behind the inbox can object under UK GDPR, and the ICO is blunt about it. "This right is absolute and there are no grounds for you to refuse." The company's opt-out is optional on paper. The person's is not. I'd honor both, on one "do not email" list. Our guide to cold email opt-out rules under CAN-SPAM, GDPR and CASL covers how fast to process them.

What changed for UK cold email in 2026?

The Data (Use and Access) Act 2025 got Royal Assent in June 2025. Most of its data protection changes started on 5 February 2026, the ICO confirmed.

The fixed ceiling on a PECR fine is now 35 times higher. Yet at least two top-ranking cold email guides I read in October 2026 still quote £500,000. The ICO's B2B and email marketing pages also say they're "under review" because of the new Act, so recheck them before a big launch.

What does the ICO actually fine people for?

The ICO publishes a register of the civil fines it has issued. I took every PECR fine in it, 229 from November 2012 to May 2026 worth £24.0 million in total, and tagged each by channel. Where the ICO's description was blank, I used press coverage.

Source: ICO register of civil monetary penalties, n = 229 PECR fines, November 2012 to May 2026. Channel tagged by Kenso. 2026 covers January to May.

Calls made up 129 fines, or 56%, and texts 55, or 24%. Email, alone or with texts, came to 38 fines. That's 17% of the count and £2.5 million, about 11% of the money. The register isn't perfect. I found two 2026 fines on the ICO's enforcement pages that it doesn't list, both for calls.

Every email fine I checked came down to missing consent from individual people. That isn't luck. PECR's consent rule only protects individual subscribers, so a consent fine is always about individuals. Under PECR, an email to a company mainly has to clear the regulation 23 duties that cover everyone: don't hide who you are, and give a way to opt out. I didn't find one email fine for breaking only those.

So who did get fined? Lots of consumer brands, mostly for emailing their own customers without valid consent. Flybe sent 3.3 million emails to people who had told it they didn't want marketing. Honda, Royal Mail, BT, Virgin Media and HelloFresh are on the list too. The other pattern is lead-generation firms mailing consumers on vague third-party "consent." ZMLUK, fined £105,000 in December 2025, sent 67 million emails using data mainly from one website whose sign-up page listed 361 "partner" companies, the ICO said.

B2B isn't a free pass on every channel. In 2023 the ICO fined three firms a combined £300,000 for unwanted marketing calls to businesses, Maxen Power Supply among them. Calls have a do-not-call list for companies, the Corporate Telephone Preference Service. Email has none, so your own suppression list is the register.

The closest thing to a cold email case is Studios MG, the firm from the opening. The ICO's penalty notice says it emailed 8,000 to 9,000 people on 30 April 2020 to sell surgical masks. The complainant had signed up to a London tennis website in 2015. Studios MG had no evidence of consent, couldn't say where his address came from, and had deleted its database by the time it answered the ICO. The ICO later cut the fine to £30,000, and the tribunal still threw out the firm's appeal.

If you can't show who's on your list, you can't show they're companies. That's the whole lesson.

Fines have also gotten rarer: 33 in 2021, 7 in 2025, 5 from January to May 2026. Fewer fines, a much higher ceiling. I wouldn't read that as permission.

How do I check if a UK business is a sole trader?

Four checks cover most of it.

1. Look for the legal name. Ltd, Limited, PLC and LLP all mean corporate. Watch for "LP" without the second L. In England, Wales and Northern Ireland a limited partnership is still a partnership. UK companies must show their registered number and office on their website under regulation 25 of the 2015 trading disclosure rules. No company number anywhere is a flag.
2. Search Companies House. Companies and LLPs have a company number there. Sole traders and ordinary partnerships aren't listed at all.
3. Default the tiny ones to "individual." Put one-person businesses, freelancers and "self-employed" profiles in a separate pile, and leave them out of the cold campaign.
4. Keep a note of the check. If someone complains, you want to show you looked.

The same filters that keep you compliant also keep your list clean. Our guide to building a cold email lead list around your ICP goes deeper.

What does a compliant UK cold email look like?

None of this makes an email good. It makes it legal. A relevant email that's easy to stop is also the one least likely to get reported as spam. When "please remove me" replies come in, handle them the same day.

Frequently asked questions

Can I cold email a sole trader in the UK?

Not without consent. PECR treats sole traders like consumers. The soft opt-in only helps if you got their details during a sale or negotiation and you're marketing similar products.

Do I need an unsubscribe link in a UK B2B cold email?

PECR asks for a valid address where people can ask you to stop, not a link. The ICO's own email marketing checklist says to offer an opt-out "by reply or unsubscribe link" and act on it promptly, so a "reply no thanks" line works if someone actually reads the replies.

Is it legal to buy a UK B2B email list?

Buying one isn't illegal, but you're responsible for how you use it. You still need a lawful basis and must tell people where you got their details. PECR also covers anyone who "instigates" a marketing email, so outsourcing the list or the sending doesn't take the responsibility off you.

Does UK GDPR apply to info@ or sales@ addresses?

Usually not. If you don't know the name of the person you're emailing, the ICO says "you are not processing personal data and the UK GDPR does not apply." PECR still does, so you still need to identify yourself and offer an opt-out.

The bottom line

UK cold email to companies is legal, and I couldn't find a single ICO fine for doing it properly. The email fines went to senders who emailed individuals without consent or couldn't show who was on their list. On a list spread across small and mid-size companies, that means checking the 8 or so contacts in 100 who might be sole traders or partnerships. At Kenso we run done-for-you cold email and LinkedIn outreach for B2B companies on infrastructure we own, and a human approves every campaign before the first email goes out. If you want to test the UK market, your first campaign is free.