Cold email rules for agencies: CAN-SPAM, GDPR and good practice

This is a general overview to help you ask the right questions. It is not legal advice; rules differ by country and change over time, so check with a lawyer for your situation.

Cold email to businesses is legal in many places, but only if you do it a certain way. The good news is that the rules mostly line up with what also keeps your emails out of spam folders: be honest about who you are, make it easy to say no, and don't use data you shouldn't have.

The basics almost every regime expects

Say who you are. Use your real name and company, a working reply address, and a subject line that matches the content. No fake "Re:" threads.

Include a physical address. The US CAN-SPAM Act requires a valid postal address in commercial email. Put it in your signature.

Make opting out easy, and honor it. Every email should offer a simple way to stop further emails: a reply, a link, or both. Honor requests promptly (CAN-SPAM sets a 10-business-day limit) and keep a do-not-contact list so the same person is never emailed again, even from a different campaign.

Don't hide behind bulk. Small, relevant volume from a real mailbox is both kinder to recipients and better for deliverability than blasting thousands of messages.

Personal data: where GDPR and similar laws come in

In the EU and UK, GDPR (and, for email marketing, the ePrivacy rules such as PECR in the UK) apply to personal data, and a named person's email address is personal data. In practice for B2B prospecting:

• Prefer generic business addresses a company publishes for inquiries (hello@, info@, sales@). Rules for contacting businesses at such addresses are generally less strict than for individuals, though details vary by country.
• Have a legitimate reason to contact the business, tied to what they do. A relevant, specific offer to a store about its own storefront is very different from a blast to a purchased list.
• Collect as little as you need and don't keep data longer than necessary.
• Tell people where you got their address if they ask, and stop on request.
• Be careful with sole traders. Many small online stores are run by one person, so "business" contact data can still identify an individual. Some countries treat that as personal data with stricter rules.

Canada (CASL) and Australia (Spam Act) are stricter than the US about consent; some forms of implied consent apply to addresses a business publishes, but only when the message is relevant to their business role. If you target those countries, read the specific rules.

What not to do

• Don't buy or scrape lists of personal email addresses.
• Don't send to people who said no, or who unsubscribed from any of your campaigns.
• Don't make claims you can't back up.
• Don't keep sending after bounces. They're a signal the address is wrong, and repeated bounces damage your domain.

Deliverability habits that also keep you compliant

• Send from a separate domain or mailbox for outreach, warmed up gradually.
• Keep daily volume modest and spread across business hours.
• Use one follow-up, not five.
• Add one-click unsubscribe headers so mail apps can show an unsubscribe button.

How MAALI is built around this

MAALI only uses the business contact address a store publishes on its own site, follows robots.txt, and gives store owners a public opt-out that applies to every MAALI user. Every email includes your signature with a postal address, an unsubscribe link and one-click unsubscribe headers. "No" replies, unsubscribes and bounces go on your do-not-contact list automatically, and you approve every first email before it's sent.