Is cold email legal? B2B rules in the UK, Germany, the US and the Gulf

One of the most common questions from companies looking for customers abroad is simple: is cold email legal? The short answer is that it depends on the country and the channel. In the UK you can cold email companies under certain rules, in Germany you mostly can't, and in the US it is allowed subject to a few technical requirements.

This guide summarises the core rules in the four markets ArgonOut works in. An important note: this article is for general information and is not legal advice. Rules change and the details of each campaign matter; before large-scale outreach, talk to an expert who knows the law in the relevant country.

Two concepts first

Electronic marketing rules govern when marketing by email, SMS and phone is permitted. In Europe these usually sit in separate laws: PECR in the UK, the UWG in Germany.

Data protection rules (GDPR and similar) apply whenever you process a person's name, work email or phone number. There is a difference between writing to a company's generic address and to an address containing a named manager's first and last name: the latter is personal data.

So for a cold email campaign to be compliant, you generally need a "yes" to two questions: may I send marketing to this person through this channel? And do I have a valid legal basis for processing this person's data?

UK: PECR and UK GDPR

In the UK, electronic marketing is governed by the Privacy and Electronic Communications Regulations (PECR). PECR splits recipients into two groups:

• Corporate subscribers: limited companies, LLPs and other incorporated bodies. You can send them marketing emails without prior consent.
• Individual subscribers: consumers, sole traders and unincorporated partnerships. As a rule, prior consent is required for them.

When emailing companies, these rules still apply:

• Don't hide who you are; the sending company must be clear.
• Offer a simple opt-out in every email.
• Keep a list of those who opt out and don't email them again.

When you write to a manager's personal work email, UK GDPR also applies. B2B outbound usually relies on "legitimate interests", which requires the message to be genuinely relevant to the person's role, the data source to be explainable and the person's right to object to be respected.

Phone: before calling companies in the UK, numbers should be screened against the Corporate Telephone Preference Service (CTPS). You should not make marketing calls to registered numbers without their consent.

For British business culture and more, see our UK B2B sales guide.

Germany: UWG and GDPR

Germany has some of the strictest rules in Europe. Section 7 of the UWG, the unfair competition act, regulates promotional contact by channel:

• Email: promotional emails generally require prior express consent, even when the recipient is a business. According to guidance from the German chambers of commerce (IHK), an email address on a business card or website, or an opt-out link in the email, does not replace that consent. There is a narrow exception for promoting similar products to existing customers.
• Phone: calls to businesses don't require express consent; "presumed consent" (mutmaßliche Einwilligung) can be enough. But this requires concrete circumstances from which genuine interest in the call can reasonably be inferred. The mere fact that a product could be useful to the business is not sufficient.

That's why outbound in Germany is usually built on LinkedIn and well-justified phone calls, with email coming in after the buyer has shown interest and agreed to it. More in our Germany and DACH B2B sales guide.

Austria and Switzerland have their own rules, which are not identical to Germany's; each DACH country should be assessed separately.

US: CAN-SPAM

Of the four markets, the US is the most flexible for cold email. The federal CAN-SPAM Act does not require prior consent for commercial email. Instead, every email must:

• Have accurate, non-misleading sender information and headers.
• Use a subject line that reflects the content.
• Be identifiable as a commercial message.
• Include the sender's valid physical postal address.
• Offer a clear, easy opt-out, with opt-out requests honoured within 10 business days.

Bear in mind that some states have additional privacy laws. On the phone side, there are separate and strict federal rules for automated calls and texts, especially to mobile numbers.

The Gulf: UAE and Saudi Arabia

The United Arab Emirates and Saudi Arabia have introduced comprehensive personal data protection laws in recent years. Broadly, they bring principles for processing personal data and direct marketing similar to the European approach, while implementation details are still developing.

In practice, B2B sales in the Gulf is relationship-driven: cold, bulk email performs weaker than personal connections, introductions and contacts made via LinkedIn. We recommend checking current regulations with a local expert before launching a campaign in this region.

Good practice in every market

Although country rules differ, these principles both reduce legal risk and improve results:

1. Write for the person and their role. You should be able to show the message is genuinely relevant to the recipient's job. Bulk, unpersonalised sends are both risky and ineffective.
2. Say clearly who you are. Company name, website and contact details in every message.
3. Offer an easy opt-out and respect it. Don't write again to anyone who says they're not interested, and keep that record across all channels.
4. Know your data source. Record where you got contact details and be able to explain it when asked.
5. Keep volumes reasonable. High volume increases both complaint risk and the chance of landing in spam.

At ArgonOut we set up every campaign around the target market's rules, adjusting the channel mix accordingly: email-led in the UK, LinkedIn and phone-led in Germany. We describe how we run each channel on our cold email outreach, LinkedIn outreach and cold calling pages.

Frequently asked questions

Can I email UK companies without consent?

You can send marketing emails without prior consent to incorporated companies such as limited companies and LLPs (corporate subscribers under PECR). You must still identify yourself clearly, offer an easy way to opt out in every email and stop emailing anyone who opts out. Sole traders and unincorporated partnerships count as individual subscribers, and different rules apply to them.

Is B2B cold email allowed in Germany?

Under Germany's unfair competition act (UWG), promotional emails generally require prior express consent, even when the recipient is a business. There is a narrow exception for existing customers. That is why outbound in Germany leans on LinkedIn and on phone calls, which are permitted under certain conditions.

Is cold email legal in the US?

Yes. The US CAN-SPAM Act does not require prior consent for commercial email, but it does require non-deceptive headers and subject lines, a valid postal address, a clear opt-out and honouring opt-out requests within 10 business days.

Do these rules apply to LinkedIn messages too?

The legal position of LinkedIn messages is less clear than email and varies by country. LinkedIn's own terms also restrict bulk and automated messaging. The safe approach is to send personal, relevant, low-pressure messages and not to write again to anyone who says they're not interested.

Related guides

• B2B sales in the UK: a market entry guide for software companies
• B2B sales in Germany and DACH: culture, channels and legal rules
• What is outbound sales? How it differs from inbound and how it works in B2B

This guide is for general information. If you'd like to talk through a plan for your target market, book a free 30-minute strategy call.