Is cold email legal?

Short answer: in most of the places small firms sell to, yes, as long as you follow a few simple rules. In some countries you need permission first, even to write to a business.

This is how the rules look for one firm writing to another, one person at a time. I'm not a lawyer and this isn't legal advice. It is what I found when I had to work it out for Gako, which checks every email against these rules before it goes.

The rules almost everywhere

Wherever cold email is allowed, the same few things come up:

• Say who you are. The From line is you or your firm. No made-up names.
• An honest subject. It describes what the email is about.
• A way to say no. A working unsubscribe link or a reply that stops all further email, honoured straight away.
• A way to reach you. Your firm's name and contact details at the bottom.
• Never write again after a no. To anyone at that address, from any of your mailboxes.

Gako puts the footer on every email for you and keeps one list of everyone who has said no, so nobody is written to twice.

United States: allowed

The US has CAN-SPAM. No permission is needed, including for business email. Each email needs a real sender, an honest subject, a clear line that it is a business offer, your postal address and a working way to opt out. Opt-outs must be honoured within 10 business days. Gako honours them at once.

United Kingdom: allowed for companies

You can email people at limited companies without asking first. Sole traders and ordinary partnerships are treated like private people, and they need to have agreed first. A named person's work email is personal data under UK GDPR, so you need a fair reason to contact them (selling something that fits their job counts) and a link to a privacy notice.

European Union: it depends on the country

There is no single EU answer.

• France, Ireland and Sweden work much like the UK: companies yes, individuals and sole traders no.
• Germany, Austria, Spain, Italy, Poland, Denmark and the Netherlands expect permission first, even for business email. Gako doesn't send cold email there.
• Belgium allows a company's general inbox (info@, contact@) but not named people.

Everywhere in the EU, GDPR applies to a named person's work address: have a fair reason, tell them who you are, and let them object.

Canada: allowed if they published the address

Canada's anti-spam law needs consent, but it counts as given when the person published their address themselves and your email fits their role. In practice: an address from the firm's own website, about something to do with their job, is fine. An address bought from a data provider is not.

Australia: much the same as Canada

Australia's Spam Act also needs consent, and again it is inferred when the address is openly published and your email is relevant to the person's role. Use addresses the firm shows on its own site.

Singapore: allowed

Singapore's Spam Control Act regulates cold email but doesn't ban it. You need a working unsubscribe, a true subject and sender, and a way to reach you. Once you send in bulk (more than 100 similar emails in a day, 1,000 in a month or 10,000 in a year), the subject must also start with <ADV>. Business contact details are outside most of Singapore's data protection law, so a work email needs no consent there.

What I do with this

Gako looks up which country each firm is in and applies that country's rules before it writes. Where a country needs consent, it warns you and holds those emails; they only go if you choose to take that on. Where a country bans cold email, it doesn't send at all.

If you sell to firms in the US, the UK, Singapore and most of the English-speaking world, cold email is a normal, legal way to find clients. Keep it honest and make saying no easy.

Gako handles the rules above for you. It costs 4 cents an email sent; start with your website.