- In the US, CAN-SPAM covers business-to-business email too. Every commercial email needs honest headers, your postal address and a working opt-out.
- In the UK, PECR's consent rule for email marketing doesn't apply to companies, but it does apply to sole traders and some partnerships. UK GDPR still applies to named people.
- Send fewer, well-researched emails, and stop the moment someone asks.
A small software company buys a list of 5,000 email addresses. It sends the same message to all of them on Monday morning.
By Wednesday, a few people have replied angrily, many emails have bounced, and the domain has started landing in spam folders.
Cold email can work for business-to-business sales. It works when it is careful, personal and legal. This guide explains the basic rules we follow in every B2B lead generation project.
This guide explains the main rules in plain English. It is not legal advice. Laws differ by country, so check the official guidance under Sources, or ask a lawyer, for your situation.
What counts as a cold email?
A cold email is a message to someone who hasn’t contacted you before, usually to start a business conversation.
If its main purpose is to promote your product or service, the law treats it as commercial or marketing email. That is true whether you send one email or a thousand.
The US: CAN-SPAM
In the United States, the main law is the CAN-SPAM Act. The FTC’s guide is clear that it makes no exception for business-to-business email.
CAN-SPAM doesn’t require consent before you send. Instead, every commercial email must follow some rules:
- Honest header information. The “From” name and address must show who is really sending.
- An honest subject line. It must not mislead about what is inside.
- Your valid physical postal address.
- A clear way to opt out. It must work, and you must honour opt-out requests within 10 business days.
- You are responsible. If someone else sends for you, both of you can be held responsible.
The UK: PECR and UK GDPR
In the UK, two sets of rules matter.
PECR covers electronic marketing. Its email marketing rule, which generally requires consent, doesn’t apply to “corporate subscribers”. These are limited companies, LLPs, government bodies and similar organisations.
It does apply to sole traders and some partnerships. Treat them like consumers: you need their consent, or the “soft opt-in” from a previous sale.
For every marketing email, even to companies, you must say who you are and give a valid address for opt-outs.
UK GDPR also applies when an email address identifies a person, such as sara.ahmed@company.co.uk. That is personal data, even at work. You need a lawful reason to use it, you must tell people how you use their data, and they can object to direct marketing at any time.
| Who you email | US (CAN-SPAM) | UK (PECR) |
|---|---|---|
| A limited company | Allowed, with the rules above | Consent rule doesn’t apply. Identify yourself and offer opt-out |
| A sole trader | Allowed, with the rules above | Consent or soft opt-in needed |
| A named employee | Allowed, with the rules above | PECR as for the company, plus UK GDPR for personal data |
How to keep outreach respectful
The rules are the minimum. Good outreach goes further.
- Research first. Only email companies that genuinely match what you offer.
- Write to one company at a time. Mention something real from their website.
- Keep it short. Four or five sentences and one clear question.
- Send fewer emails. A small number of good emails beats a big blast.
- Make stopping easy. “Reply ‘no thanks’ and I won’t write again” is clear and kind.
Company names, websites and general business addresses are good starting points. Our guide is web scraping legal? explains what to be careful about when collecting data.
Where AI helps, and where it doesn’t
Claude, an AI model, can read a company’s public website and draft a short email that mentions something relevant. n8n, a tool that connects your apps and runs steps automatically, keeps the list, records replies and makes sure opt-outs are never emailed again.
AI should not decide who to email or send without review. In our builds, a person approves every email before it goes out.
The recipe
Automation recipe: careful B2B outreach
- When this happensYou have a researched list of companies that match your ideal customer.
- The system doesEach company is checked – is it a company or a sole trader, and which country is it in?
- ThenClaude drafts a short, personal first email based on the company’s public website.
- ThenA person reviews and approves every draft before it is sent.
- ThenReplies and opt-outs are recorded, and anyone who opts out is never emailed again.
- You onlyApprove every email, reply to every answer, and handle opt-outs the same day.
- n8n
- Claude
- Gmail
- Google Sheets
Common mistakes
Buying a list. You don’t know where the data came from or whether the people match your service.
No postal address or opt-out. Both are required in the US for commercial email.
Treating sole traders like companies in the UK. They need consent or the soft opt-in.
Ignoring replies. A “no thanks” is an opt-out. Record it the same day.
Sending from your main domain at high volume. Bounces and complaints can hurt delivery for all your normal email.
A simple next step
Look at your last outreach email. Does it have your real name, your postal address and a clear way to stop? If not, fix the template before sending another.
For building a good list, read lead list vs qualified pipeline. For what to do when someone replies, see lead follow-up: what to send on day 1, day 3 and day 7.
Want a careful outreach system? Book a free video call.
Sources
- FTC: CAN-SPAM Act compliance guide for business
- ICO: business-to-business marketing
- ICO: electronic mail marketing under PECR
This guide was drafted with AI assistance, then reviewed, fact-checked and edited by MD Al Amin.
Quick questions
Do I need consent to email another business?
In the US, CAN-SPAM doesn't require consent before sending, but it sets rules for every commercial email. In the UK, PECR's consent rule doesn't apply to corporate subscribers such as limited companies, but it does apply to sole traders and some partnerships. Other countries have their own rules.
Is a personal-looking email from a person exempt?
No. What matters is the purpose. An email that promotes your product or service is commercial, whether it is sent to one person or a thousand.
What about the EU?
Rules differ between EU countries, and some require consent even for business addresses. Check the rules for each country before emailing people there.