# Cold email rules
> What CAN-SPAM, GDPR, PECR, CASL and the Spam Act actually say, and how to send cold mail compliantly.
Source: https://docs.ayinbox.com/learn/cold-email-rules/
* Cold email is not illegal in most places, but the rules differ by country.
* Everywhere: a real sender, a clear opt-out, and opt-outs honoured.
* Canada, and consumer mail in the EU and UK, need consent first.
Why this matters [#why-this-matters]
Cold email is not illegal in most jurisdictions, but the rules around it vary. Getting them wrong invites both fines and the worse outcome: spam complaints that damage your sender reputation across the entire contact list.
This guide is general information, not legal advice. If you're sending at scale to regulated jurisdictions, run your specific approach past counsel.
United States: CAN-SPAM (2003) [#united-states-can-spam-2003]
CAN-SPAM applies to "commercial electronic mail messages". It does *not* require prior consent for cold B2B email. It does require:
* Truthful "From" and routing information.
* Subject lines that aren't misleading.
* Identification as an advertisement (interpreted loosely for B2B context).
* A valid physical postal address.
* A clear unsubscribe mechanism honoured within 10 business days.
For AY Inbox's defaults, this means: include a physical address in your sender profile, never spoof a name or domain, and ensure unsubscribe replies are auto-suppressed.
European Union and UK: GDPR + PECR [#european-union-and-uk-gdpr--pecr]
GDPR applies to personal data of EU/UK residents. PECR (in the UK) and ePrivacy directives in EU member states specifically cover electronic marketing.
B2B cold mail [#b2b-cold-mail]
Cold mail to **corporate** recipients (a named role at a company) is generally permitted under "legitimate interest" if:
* The recipient has a clear business reason to receive the message (relevance test).
* You can demonstrate you've considered their rights and interests (balancing test).
* You provide a clear opt-out mechanism.
* You honour opt-outs immediately.
* You can tell them, on request, where you obtained their contact details.
B2C marketing mail [#b2c-marketing-mail]
Generally requires prior consent. Cold marketing to consumer addresses in the EU/UK is risky without it.
Country notes [#country-notes]
* **Germany.** The Act against Unfair Competition (UWG, section 7) treats advertising email sent without the recipient's prior express consent as an unreasonable nuisance, and German courts have applied it to business recipients as well as consumers. Germany is the strictest major market for cold email, which is why it is on every new workspace's consent list.
* **Morocco.** Law 09-08 on the protection of personal data, enforced by the CNDP, requires the prior consent of the person for direct marketing by email. If you write to Moroccan contacts, consider adding `MA` to the consent list.
* **Elsewhere in the EU.** Several member states (Austria, Italy and Poland among them) also read their ePrivacy rules as requiring consent for business recipients. Check each country you write to and add it to the list where that is the case.
Data processing record [#data-processing-record]
Keep a record of where you sourced each contact and the legitimate interest you relied on. AY Inbox's contact import wizard captures source and import notes for exactly this.
Canada: CASL (2014) [#canada-casl-2014]
CASL is the strictest of the major regimes. It requires *express or implied consent* before sending commercial electronic messages to Canadian recipients.
Implied consent exists where the recipient has a relevant existing business relationship, conspicuously published their business email without an explicit "no marketing" statement, or asked for information from your business in the last 6 months.
Every message must include sender identification, contact info, and a working unsubscribe. Penalties for non-compliance can reach CAD $10M per violation for organisations.
Australia: Spam Act 2003 [#australia-spam-act-2003]
Requires consent (express, inferred or implied), accurate sender identification and a functional unsubscribe. Inferred consent is generous for B2B but not consumer marketing.
Practical cold-mail compliance checklist [#practical-cold-mail-compliance-checklist]
1. Use a real From: name and a domain you actually own.
2. Include a physical mailing address in your sender profile or footer.
3. Provide a clear opt-out, such as "Reply STOP to opt out" or a one-click link.
4. Auto-suppress recipients who opt out, across all future sequences and campaigns.
5. Record where each contact was sourced and your basis for contacting them.
6. Only contact role accounts and named business addresses for B2B; avoid personal addresses unless you have explicit consent.
7. Customise the message for relevance: boilerplate to thousands of strangers is the loudest possible compliance and reputation risk.
8. Skip Canadian and EU consumer-mail recipients unless you have documented consent, and list the countries where you rely on consent so AY Inbox holds those contacts until it is recorded.
9. Honour opt-outs within 24 hours, not the legal maximum.
10. If you operate a privacy policy, link to it from your footer.
How AY Inbox helps [#how-ay-inbox-helps]
* Sender profiles include physical address fields that render in every send.
* Every campaign email carries an opt-out: a reply-to-opt-out line by default, or an unsubscribe link, plus optional RFC 8058 headers. See [unsubscribe and suppression](/guides/unsubscribe/).
* Opt-out detection on incoming replies (unsubscribe, "remove me", "stop emailing me").
* Workspace-wide suppression list shared across [sequences](/guides/sequences/), with addresses and whole domains added by hand.
* Contact source captured at [import](/guides/contacts-crm/); preserved through merges.
* A workspace [consent list](/guides/contacts-crm/#prior-consent) of countries (Germany by default) whose contacts are held from every campaign email until consent is recorded on the contact. A contact whose country is unknown is not held, so keep the country field filled for the countries that matter.
* An optional [review of each lead's first email](/guides/campaigns/#review-first-emails-before-they-send) before it sends, so a person reads exactly what goes out.
* Region-aware sending windows so you don't accidentally blast at 3am local time.
> Compliance and reputation are the same conversation. Senders who skip the basics burn through contact lists and end up in spam filters whether or not the regulator ever shows up.