What CAN-SPAM and GDPR Actually Require From Cold Emailers in 2026

Last updated: October 28, 2026

Understanding the CAN-SPAM GDPR cold email requirements that actually apply to you in 2026 is the difference between a defensible outbound program and an expensive mistake, and here they are in plain language, without pretending this is a substitute for real legal advice from someone licensed in your jurisdiction.

What CAN-SPAM Actually Requires

CAN-SPAM is an opt-out law, not an opt-in one, which is why cold email to US recipients is legal without prior consent. But “legal” comes with strict formatting rules. Your header information, the From, To, and Reply-To fields, has to accurately identify you; spoofed domains or misleading sender names are a violation on their own. Subject lines can’t misrepresent what’s inside the email. Every commercial message needs a valid physical postal address, a street address, a registered P.O. box, or a private mailbox from a commercial mail service all count. And you need a working, one-click unsubscribe mechanism that stays functional for at least 30 days after the send.

The part senders get wrong most often is the opt-out timeline. Requests to stop emailing have to be honored within 10 business days, not calendar days, and you can’t charge a fee, require a login, or ask for more information than an email address to process the request. The FTC’s 2026 inflation adjustment pushed the maximum civil penalty to $53,088 per individual email, and because each message in a campaign counts as a separate violation, a single bad send to a few thousand contacts carries real financial exposure, even though enforcement in practice tends to focus on egregious, high-volume abuse rather than isolated mistakes.

What GDPR Actually Requires for B2B

GDPR doesn’t ban cold email to EU contacts, but it requires a documented lawful basis for processing their data, and for B2B outreach that basis is almost always “legitimate interest” under Article 6(1)(f) rather than consent. Relying on legitimate interest means passing a three-part test: your purpose has to be a genuine business objective, email has to be a necessary and proportionate way to pursue it, and critically, the recipient’s privacy interests can’t outweigh your business interest. That last part is where generic, high-volume blasts fail. The more your outreach looks like mass spam rather than a relevant, targeted pitch to someone whose role matches your offer, the harder that balancing test is to justify if you’re ever challenged.

In practice, that means pulling contact data from professional sources like LinkedIn or a company’s own website rather than personal data brokers, keeping a written record of your legitimate interest assessment, and making the unsubscribe or “right to object” mechanism frictionless, no login, no reply chain required, just an immediate opt-out that propagates across your systems. Your privacy policy also needs to actually disclose that you process contact data under legitimate interest for outreach purposes, not just mention GDPR in passing.

Country-Specific Wrinkles Inside the EU

GDPR sets the floor, but member states layer their own rules on top through national implementations of the ePrivacy Directive, and the gaps between them catch a lot of senders off guard. Germany’s enforcement is among the strictest, requiring something close to a presumed, pre-existing interest and real personalization before a cold email is defensible. France’s CNIL is comparatively business-friendly, allowing B2B outreach without consent when it’s clearly relevant to the recipient’s professional role, as long as unsubscribe is available. Poland tightened its stance in late 2024 to require prior consent in more cases than the general GDPR default, which trips up teams that assume one EU-wide standard applies everywhere. Italy and Spain follow the general GDPR approach but enforce the right to object aggressively, meaning a single complaint after an unsubscribe request can escalate quickly. The safest approach for anyone sending broadly across the EU is to build for the strictest jurisdiction you’re targeting rather than the loosest one.

The CAN-SPAM GDPR Cold Email Requirements Checklist

Strip away the legal language and the practical checklist looks like this: accurate sender identification and subject lines, a real physical address in every email, a one-click unsubscribe that works instantly and stays live, documented reasoning for why you’re allowed to contact each recipient, and a suppression list that’s honored the moment someone opts out, not days later after a batch job runs. If you’re sending more than roughly 5,000 emails a day, mailbox providers like Gmail also expect SPF, DKIM, and DMARC authentication in place, which isn’t strictly a legal requirement but functions like one, since providers will throttle or block unauthenticated senders regardless of what the law says. A tool that handles list cleaning before you send also reduces your bounce and complaint rate, which keeps you under the roughly 0.1% spam-complaint threshold that most mailbox providers use as a de facto compliance signal of their own.

Common Mistakes That Create Real Risk

The most frequent error is treating GDPR like an opt-in law for B2B the way CASL is in Canada, when in reality the lawful basis approach is different and opt-out based outreach is often defensible if it’s genuinely relevant and well-documented. The second is confusing “10 days” with “10 business days” on the CAN-SPAM opt-out clock, which can turn a compliant program into a technical violation. The third is assuming a single compliance policy covers every EU country equally, when Poland, Germany, and France each interpret the same directive differently enough to matter. And the fourth, increasingly common as outreach gets more automated, is writing cold email that reads like it was written by AI at scale with no personalization at all, which doesn’t just hurt reply rates, it actively undermines the “necessity and proportionality” argument GDPR’s legitimate interest test depends on.

None of this is a substitute for legal counsel, especially if you’re sending at real volume across multiple jurisdictions. But treating compliance as a checklist you run once and forget is how most outbound teams end up exposed. The rules didn’t get dramatically stricter in 2026, they just got more expensive to ignore, and enforcement bodies on both sides of the Atlantic are paying closer attention to email as a channel than they were even two years ago.

Frequently asked questions

Is cold email legal under CAN-SPAM?

Yes. CAN-SPAM is an opt-out law rather than an opt-in one, so cold email to US recipients is legal without prior consent, provided you follow its strict formatting rules.

Does GDPR ban cold emailing?

No. GDPR does not ban cold email to EU contacts, but it requires a documented lawful basis for processing their data, which for B2B outreach is almost always legitimate interest.

Do EU countries have different cold email rules?

Yes. GDPR sets the floor, and member states layer their own rules on top through national implementations of the ePrivacy Directive, which catches many senders off guard.

What does a basic cold email compliance checklist include?

It starts with accurate sender identification and accurate subject lines. The post has a full checklist and a section on common mistakes that create real risk.