OutreachSheet
UK cold email rules

Is cold email legal in the UK?

In the UK, you can send marketing emails to companies (and LLPs and government bodies) without prior consent, as long as you say who you are and give a working way to opt out. Emailing individuals, including sole traders and some partnerships, needs their consent unless the narrow “soft opt-in” applies. The rules come from PECR and are enforced by the ICO.

This is a plain summary of the ICO’s published guidance, checked on 17 October 2026, not legal advice. The ICO says this guidance is under review following the Data (Use and Access) Act. If your situation is not clear-cut, take advice.

Who you can email cold in the UK (ICO guidance on PECR)
RecipientCold marketing email allowed?
Company, LLP, Scottish partnership, government bodyYes, if you identify yourself and offer an opt-out
Individual, sole trader or some partnershipsOnly with specific consent, or under the soft opt-in
Someone who asked you to stopNo. Keep a do-not-email list and screen against it

What every marketing email must do

  • Not disguise or conceal who is sending it.
  • Give a valid contact address so the person can opt out or unsubscribe.
  • Act on opt-outs promptly, and keep a list of anyone who objected so you never email them again.

The soft opt-in, and its limits

The soft opt-in lets you email an existing customer who bought, or negotiated to buy, a similar product or service from you, provided you offered a simple opt-out when you collected their details and in every message. It does not cover new prospects or bought-in lists.

Emailing people at companies

PECR allows marketing to corporate subscribers, but the ICO notes that a named employee’s work address can still be personal data, so data protection law (UK GDPR) also applies. In practice: have a genuine reason to contact that person about their work, tell them where you got their details if asked, and honour objections.

Outside the UK

Rules differ by country. EU countries apply their own versions of the ePrivacy rules alongside the GDPR, and some are stricter about business email. Check the regulator in the recipient’s country.

How OutreachSheet helps, and what stays your job

OutreachSheet detects opt-out replies in sixteen languages, adds the person to a permanent Do Not Contact list, and never emails anyone on it again. It cannot decide whether you had grounds to contact someone in the first place: that decision is yours.

Sources

Related reading