Is cold email legal? GDPR and CAN-SPAM, in plain terms

A common assumption is that cold email became illegal the moment GDPR took effect, or that any unsolicited email in the US risks a lawsuit. Neither is really true — B2B cold outreach to a business contact is common and legal under both frameworks — but "legal" comes with real conditions attached, not a blanket pass. (This is general information, not legal advice; for anything specific to your situation, a lawyer familiar with your jurisdiction is worth the hour.)

GDPR doesn't require prior opt-in consent for B2B email sent under "legitimate interest," one of several lawful bases the regulation allows. In practice, that means you can email someone's business address without asking first, as long as the message is relevant to their actual role, you clearly identify who's contacting them and why, and they can opt out easily and immediately. What GDPR does require, without exception: honest sender identification, a working unsubscribe method, and stopping the moment someone objects. Some EU countries layer stricter national rules on top of GDPR itself, so it's worth checking local implementation rather than assuming the EU-wide baseline covers everything.

CAN-SPAM, the US framework, is more permissive on consent — no opt-in is required at all for commercial email. What it requires instead: accurate, non-spoofed sender information, a subject line that isn't deceptive about the email's content, a physical postal address somewhere in the message, and a clear opt-out mechanism honored within 10 business days of a request. Penalties are assessed per email, which is why the requirements aren't just a formality to skim past.

The two frameworks overlap more than they conflict: real sender identity, an honest subject line, a working unsubscribe, and actually stopping once someone asks. Every message a cold email tool sends should carry those by default rather than as something bolted on after a complaint — Talyro marks a lead do-not-contact automatically the moment a reply reads as an unsubscribe request or a bounce, and nothing further ever goes out to them after that.