Cold email rules: CAN-SPAM, GDPR and PECR basics

Map the jurisdictions before choosing a rule

This article is general information, not legal advice, and it does not establish that a particular campaign is lawful. Identify where your organization operates, where recipients are located, what data you process and which communication method you intend to use.

A Pakistan-based agency contacting businesses in the US, UK or UAE cannot assume that one policy covers every recipient. EU member states also have national electronic-marketing rules, and UK guidance should not be treated as a complete statement of EU, UAE or Pakistan law.

Understand the US CAN-SPAM baseline

The FTC explains that CAN-SPAM covers commercial email, including business-to-business messages, and requires accurate headers and non-deceptive subject lines. Its checklist also addresses advertising identification, a valid physical postal address and a clear opt-out mechanism.

The FTC says opt-out requests must be honored within ten business days and explains that hiring another company does not remove responsibility. Do not read these requirements as a universal permission to send: other laws, provider policies and the facts of the campaign still matter.

• Identify the sender accurately.
• Use an honest subject line.
• Review advertising-disclosure requirements.
• Include a valid physical postal address.
• Provide and test the opt-out method.
• Monitor vendors acting on your behalf.

Separate UK PECR rules from data protection rules

The ICO distinguishes corporate subscribers from individual subscribers, including sole traders and certain partnerships, when explaining electronic-mail marketing rules. The corporate-subscriber distinction is not a blanket exemption from all marketing or privacy obligations.

Where you process identifiable business contacts' personal data, UK GDPR obligations can still apply, including a lawful basis, transparency and handling objections. Legitimate interests is not automatic permission and cannot override a PECR consent requirement where one applies.

Build a documented approval and suppression process

Record the recipient classification, contact source, intended purpose, applicable requirements and approved notice or consent approach before launch. Assign a person to handle access requests, objections and questions about how contact details were obtained.

Keep a minimal suppression record so an objecting person is not accidentally re-imported, while reviewing retention and security requirements. Recheck current official guidance before campaigns because rules and regulator guidance change; seek qualified advice where the classification or cross-border position is uncertain.