--- title: "Cold Email Laws by Country: 12 Laws Compared" description: "Is cold email legal? Compare 12 laws, from CAN-SPAM and CASL to GDPR, PECR and POPIA: opt-in or opt-out for B2B, key rules and maximum fines." path: /cold-email-laws family: laws updated: 2026-10-17 html: /cold-email-laws sources: - "https://www.govinfo.gov/content/pkg/USCODE-2023-title15/html/USCODE-2023-title15-chap103-sec7704.htm" - "https://laws-lois.justice.gc.ca/eng/acts/E-1.6/FullText.html" - "https://eur-lex.europa.eu/eli/reg/2016/679/oj" - "https://www.legislation.gov.uk/uksi/2003/2426/regulation/22" - "https://cppa.ca.gov/pdf/20260101_ccpa_statute.pdf" - "https://www.gesetze-im-internet.de/uwg_2004/__7.html" - "https://laws-lois.justice.gc.ca/eng/acts/P-8.6/FullText.html" - "https://www.planalto.gov.br/ccivil_03/_ato2015-2018/2018/lei/l13709.htm" - "https://www.gov.za/sites/default/files/gcis_document/201409/3706726-11act4of2013protectionofpersonalinforcorrect.pdf" - "https://sso.agc.gov.sg/Act/PDPA2012" - "https://www.legislation.gov.au/C2004A01214/2016-03-10/2016-03-10/text/original/pdf" - "https://www.meity.gov.in/static/uploads/2024/06/2bf1f0e9f04e6fb4f8fef35e82c42aa5.pdf" - "/anti-spam" - "/terms" - "/features" facts: laws_covered: "12" opt_out_laws: "5" opt_in_laws: "5" mixed_laws: "2" checked: "2026-10-17" --- # Cold Email Laws by Country B2B cold email is opt-out under CAN-SPAM, the UK's PECR, the CCPA, the LGPD and Singapore's PDPA: you can send until people object. Germany's UWG, CASL, POPIA and Australia's Spam Act need consent first, as will India's DPDP Act. The GDPR and PIPEDA depend on the country or the contact. ## Not Legal Advice > Not legal advice. We checked this page against the law's text and the regulator's guidance on October 17, 2026; it has not been reviewed by a lawyer. ## How Do Cold Email Laws Compare? **In short:** 5 of the 12 laws let you email business contacts until they opt out; 5 need consent first; 2 depend on the country or the contact. **Cold email laws compared, checked October 17, 2026** | Law | Where | Model for B2B email | Maximum penalty | Page | | --- | --- | --- | --- | --- | | CAN-SPAM Act | United States | Allowed, opt-out | USD 53,088 per email | [CAN-SPAM Act: What It Means for Cold Email](/cold-email-laws/can-spam) | | CASL | Canada | Consent first; implied consent for published work addresses | CAD 10 million per violation | [CASL (Canada): What It Means for Cold Email](/cold-email-laws/casl) | | GDPR | European Union and EEA | Legitimate interest; consent rule varies by country | EUR 20 million or 4% of worldwide turnover, whichever is higher | [GDPR: What It Means for Cold Email](/cold-email-laws/gdpr) | | UK GDPR and PECR | United Kingdom | Allowed to companies, opt-out; sole traders need consent | GBP 17.5 million or 4% of worldwide turnover, whichever is higher | [UK GDPR and PECR: What They Mean for Cold Email](/cold-email-laws/uk-gdpr-pecr) | | CCPA and CPRA | California, United States | Allowed; privacy rights apply to covered businesses | USD 7,988 per intentional violation | [CCPA and CPRA: What They Mean for Cold Email](/cold-email-laws/ccpa-cpra) | | UWG | Germany | Not allowed without prior consent | EUR 250,000 per injunction breach; GDPR fines up to EUR 20 million or 4% | [UWG Section 7 (Germany): What It Means for Cold Email](/cold-email-laws/uwg) | | PIPEDA | Canada | Exempt if role-relevant; CASL still governs the email | CAD 100,000 fine (not for consent breaches) | [PIPEDA: What It Means for Cold Email](/cold-email-laws/pipeda) | | LGPD | Brazil | Allowed on legitimate interest, opt-out | 2% of revenue in Brazil, up to BRL 50 million per infraction | [LGPD (Brazil): What It Means for Cold Email](/cold-email-laws/lgpd) | | POPIA | South Africa | Consent first; one consent-request email allowed | ZAR 10 million fine; up to 10 years in prison for ignoring an enforcement notice | [POPIA (South Africa): What It Means for Cold Email](/cold-email-laws/popia) | | Singapore PDPA | Singapore | Allowed, opt-out; bulk email needs an label and an unsubscribe | SGD 1 million or 10% of Singapore turnover (PDPA) | [Singapore PDPA: What It Means for Cold Email](/cold-email-laws/pdpa-singapore) | | Spam Act 2003 | Australia | Consent first; inferred consent for published work addresses | AUD 728,000 per day (AUD 3.64 million with a prior record) | [Spam Act 2003 (Australia): What It Means for Cold Email](/cold-email-laws/spam-act-australia) | | DPDP Act | India | Consent first, once the core rules start | INR 250 crore; INR 50 crore for consent and notice breaches | [DPDP Act (India): What It Means for Cold Email](/cold-email-laws/dpdp-india) | ## What Is the Difference Between Opt-In and Opt-Out? **In short:** Opt-out laws let you send the first email and make you stop when the person objects; opt-in laws need consent before the first email. - Opt-out for B2B email: CAN-SPAM Act, UK GDPR and PECR, CCPA and CPRA, LGPD, Singapore PDPA. - Opt-in for B2B email: CASL, UWG, POPIA, Spam Act 2003, DPDP Act. - Depends on the country or the contact: GDPR, PIPEDA. Privacy laws such as the GDPR, the CCPA, PIPEDA and the LGPD do not ban cold email on their own. They govern the personal data behind it: the lawful basis, the notice you give and the right to object or delete. Anti-spam laws such as CAN-SPAM, CASL, PECR, POPIA section 69 and Australia's Spam Act govern the message itself. Ken's view: apply the rule of the country where each recipient is, not where you send from. CASL, Australia's Spam Act, the GDPR and the LGPD all reach senders abroad. ## How Ken Helps **In short:** Ken Campaigns handles opt-outs, suppression and sending limits; it does not make your emails lawful, and the law stays your responsibility. - Campaign emails must include a legally appropriate opt-out or unsubscribe mechanism unless Ken approves another lawful approach in writing, and Ken can run the unsubscribe links, reply-based opt-outs and suppression for you (Ken Terms of Service, section 7.3). - Ken's anti-spam policy puts opt-outs, abuse complaints, spam-trap notices and hard bounces on a suppression list that applies across every domain and mailbox Ken operates, and never expires it. - Ken tracks every bounce, unsubscribe and spam report, and every campaign rotates across several inboxes to stay under daily send limits. - You give Ken your legal entity name and mailing address for the email footer, and Ken will not knowingly use materially false or misleading headers, sender details or subject lines (Terms, section 7.2). - Ken's anti-spam policy bars purchased and scraped lists, and accounts found sending unsolicited bulk email are suspended (section 6). - Ken's terms leave the legality of your offer, audience and data, and any consents and notices the law requires, with you (section 7.1). Under each law on this page, that includes your consent records, privacy notices and lawful basis. - [Join the waiting list](/waitlist) - [Read Ken's anti-spam policy](/anti-spam) ## FAQ ### Is cold email illegal? Not in general. In the US, CAN-SPAM allows B2B cold email without consent if you follow its rules, and the UK allows it to companies under PECR. Germany, Canada, Australia and South Africa require consent first, though Canada and Australia accept consent implied from a published work address that fits your message. ### Is cold email legal in the EU? Often, but it depends on the country. The GDPR allows legitimate interest for direct marketing if you give notice and honor objections, while each country's ePrivacy law decides whether B2B email needs consent first: France allows B2B email related to the person's job, while Germany and Italy require consent. ### Is cold email legal in the UK? Yes, to companies and LLPs. PECR does not require consent for corporate subscribers, but you must identify yourself and give a valid opt-out address, and sole traders and some partnerships need consent. ### Is cold email legal in Canada? Only with consent under CASL, but consent is implied when the person conspicuously published their work address without a no-solicitation note and your email relates to their role. PIPEDA does not apply to a work email used solely for a role-relevant message. ### Which law has the highest fines for cold email? Among fixed caps, the GDPR's EUR 20 million and the UK's GBP 17.5 million are the largest, and both rise to 4% of worldwide annual turnover. CASL allows up to CAD 10 million per violation and CAN-SPAM up to USD 53,088 per email, while Australia's Spam Act reaches AUD 3.64 million a day for a company with a prior record and Singapore's PDPA 10% of Singapore turnover. ### Do these laws apply if my company is in another country? Usually yes. CASL, Australia's Spam Act, the GDPR and the LGPD all reach senders abroad when the recipient or the offer is in their territory, so follow the rule where your recipient is. ## Related - [CAN-SPAM Act: What It Means for Cold Email](/cold-email-laws/can-spam) - [CASL (Canada): What It Means for Cold Email](/cold-email-laws/casl) - [GDPR: What It Means for Cold Email](/cold-email-laws/gdpr) - [UK GDPR and PECR: What They Mean for Cold Email](/cold-email-laws/uk-gdpr-pecr) - [CCPA and CPRA: What They Mean for Cold Email](/cold-email-laws/ccpa-cpra) - [UWG Section 7 (Germany): What It Means for Cold Email](/cold-email-laws/uwg) - [PIPEDA: What It Means for Cold Email](/cold-email-laws/pipeda) - [LGPD (Brazil): What It Means for Cold Email](/cold-email-laws/lgpd) - [POPIA (South Africa): What It Means for Cold Email](/cold-email-laws/popia) - [Singapore PDPA: What It Means for Cold Email](/cold-email-laws/pdpa-singapore) - [Ken anti-spam policy](/anti-spam) ## Sources | Source | URL | Checked | | --- | --- | --- | | 15 U.S.C. 7704, requirements for commercial email | https://www.govinfo.gov/content/pkg/USCODE-2023-title15/html/USCODE-2023-title15-chap103-sec7704.htm | 2026-10-17 | | Canada's Anti-Spam Legislation, S.C. 2010, c. 23, full text | https://laws-lois.justice.gc.ca/eng/acts/E-1.6/FullText.html | 2026-10-17 | | GDPR, Regulation (EU) 2016/679, Articles 3, 5, 6, 12 to 15, 21, 77 to 79, 82 and 83 | https://eur-lex.europa.eu/eli/reg/2016/679/oj | 2026-10-17 | | PECR regulation 22 (unsolicited email) | https://www.legislation.gov.uk/uksi/2003/2426/regulation/22 | 2026-10-17 | | CCPA statute text, effective January 1, 2026 (CPPA copy) | https://cppa.ca.gov/pdf/20260101_ccpa_statute.pdf | 2026-10-17 | | UWG section 7 (German) | https://www.gesetze-im-internet.de/uwg_2004/__7.html | 2026-10-17 | | PIPEDA, S.C. 2000, c. 5, full text | https://laws-lois.justice.gc.ca/eng/acts/P-8.6/FullText.html | 2026-10-17 | | LGPD, Lei No. 13.709/2018, compiled text | https://www.planalto.gov.br/ccivil_03/_ato2015-2018/2018/lei/l13709.htm | 2026-10-17 | | Protection of Personal Information Act 4 of 2013 | https://www.gov.za/sites/default/files/gcis_document/201409/3706726-11act4of2013protectionofpersonalinforcorrect.pdf | 2026-10-17 | | Personal Data Protection Act 2012 | https://sso.agc.gov.sg/Act/PDPA2012 | 2026-10-17 | | Spam Act 2003, Compilation No. 10 (authorised text) | https://www.legislation.gov.au/C2004A01214/2016-03-10/2016-03-10/text/original/pdf | 2026-10-17 | | Digital Personal Data Protection Act, 2023 (MeitY copy) | https://www.meity.gov.in/static/uploads/2024/06/2bf1f0e9f04e6fb4f8fef35e82c42aa5.pdf | 2026-10-17 | | Ken anti-spam policy (sections 4 and 6) | /anti-spam | 2026-10-17 | | Ken Terms of Service (sections 7.1 to 7.3) | /terms | 2026-10-17 | | Ken features: deliverability monitoring and multi-inbox rotation | /features | 2026-10-17 | ## Changelog - 2026-10-17: Page published.