Cold Outreach and the Rules: What GDPR and CAN-SPAM Actually Say

Cold outreach sits in a part of the law that most freelancers have strong opinions about and little information on. The two common positions — "cold email is illegal now" and "it's B2B so none of it applies" — are both wrong, and both lead to bad decisions.

What follows is a plain summary of how the main regimes treat business-to-business email. It is general information, not legal advice; rules differ by country and change, and anything that matters commercially is worth putting to a solicitor in your own jurisdiction.

The regimes you're likely dealing with

• GDPR (EU) and the UK GDPR — how personal data may be processed. A named business address like john@firm.co.uk is personal data; info@firm.co.uk generally is not.
• ePrivacy rules (PECR in the UK, national equivalents in the EU) — these, not GDPR, govern marketing messages, and they treat corporate subscribers more permissively than individuals.
• CAN-SPAM (US) — permits cold commercial email outright, provided you identify yourself, don't deceive, and honour opt-outs.
• CASL (Canada) — notably stricter, generally requiring consent, with narrow implied-consent exceptions such as a published business address relevant to the role.

The practical upshot: cold B2B email is lawful in most of these places if done properly, and the differences are mostly about how much you must do before pressing send.

Legitimate interest, and what it actually demands

Under GDPR, business outreach usually relies on legitimate interest rather than consent. That is a real basis, not a loophole, but it comes with conditions that are easy to meet and easy to fail.

It requires that your interest is genuine, that the processing is necessary for it, and that it doesn't override the recipient's rights. In practice it means your message must be relevant to their job: emailing a plumbing firm about its website is defensible, emailing the same firm about an unrelated product is harder to argue.

It also means being able to say where the address came from. "From the contact page of their website" is a good answer. "A list I bought" is a much worse one, which is one more reason scraped-and-sold lists are a poor foundation.

The four things to put in every message

1. Identify yourself properly. Real name, business name, and a genuine postal address or registered company detail in the footer.
2. Don't deceive. Accurate sender name, honest subject line. The fake "Re:" trick isn't just tacky; under CAN-SPAM a misleading header is specifically prohibited.
3. Offer a way out. For one-to-one mail a plain sentence — "tell me to stop and I will" — is usually enough; a bulk send needs a proper unsubscribe link.
4. Honour it immediately. Remove them everywhere, not just from the current sequence. CAN-SPAM allows ten days; treating it as same-day is both safer and simply decent.

Where designers most often go wrong

• Buying lists, which makes provenance impossible to explain and relevance unlikely
• Emailing named individuals at firms with no connection to what you offer
• Continuing a sequence after someone has replied asking to be left alone
• Scraping personal addresses from social profiles, which is a different and weaker position than a published business contact
• No postal address in the footer — trivially fixable, and one of the most common breaches
• Assuming "B2B" removes all obligations, which is true in no jurisdiction

Keeping a record costs nothing

If a complaint ever arrives, the useful thing is being able to show where the address came from and why you thought the message was relevant. A column in your prospect spreadsheet noting the source — "contact page, 12 March" — and another noting opt-outs is enough for a small operation.

It takes seconds per prospect and it converts a potentially awkward conversation into a short one.

Why this argues for small, targeted sending

Nearly every requirement above is easier when you send thirty relevant messages than when you send three thousand indiscriminate ones. Relevance is the heart of legitimate interest, provenance is simple when you gathered the addresses yourself, and opt-outs are manageable at small volume.

A targeted approach — finding the businesses whose websites are genuinely failing, taking the published business contact from their own site, and writing to each about that specific thing — happens to be both the most effective outreach and the easiest to defend. That alignment is not a coincidence; the rules were written to discourage exactly the spray-and-pray approach that also doesn't work.

One more time, plainly

This is a summary written for designers, not a legal opinion, and it cannot account for your country, your client's country, or how the rules have moved since. If outreach is going to be a significant part of your business, an hour with a solicitor is cheap insurance.