Is B2B cold email legal in the UK? PECR, GDPR and the sole-trader rule
UK B2B cold email law: PECR's corporate vs sole-trader rule, identification, opt-out, legitimate interests and Art. 14, plus six other countries.
By Mussie HailePublished
General information, not legal advice. This is a plain-English summary of the rules as we read them in November 2026 (last checked 2 November 2026). Laws and guidance change, and how they apply depends on your facts. Take advice from a qualified lawyer on your own situation before you rely on any of it. ClearIntro's own footer and privacy notice are with a lawyer for review.
The short answer: generally yes. B2B cold email is generally lawful in the UK when you write to a company, such as a limited company or an LLP. You must say who you are and give a working way to opt out. Sole traders and most partnerships count as individuals, so they need consent first. UK GDPR still applies to the named person you write to.
Key takeaways
- PECR's consent rule for marketing email applies to individual subscribers. Companies, LLPs and Scottish partnerships are corporate subscribers.
- Sole traders and unincorporated partnerships in England, Wales and Northern Ireland are individuals. Email them only with consent.
- Every marketing email must identify the sender and give a valid opt-out address (PECR regulation 23).
- UK GDPR now lists direct marketing as an example of a legitimate interest. You still owe the person a privacy notice by your first email.
- Germany and the Netherlands are stricter. The US, Canada and Australia each have their own conditions.
Two laws apply to every UK cold email
A B2B cold email in the UK sits under two sets of rules at once.
- PECR, the Privacy and Electronic Communications Regulations 2003, decides whether you may send marketing email to someone without consent.
- UK GDPR decides how you may use a person's data, such as their name and work address.
Passing PECR does not mean you pass UK GDPR. You need both.
PECR: corporate subscribers vs individual subscribers
The key rule is PECR regulation 22. It bans unsolicited direct marketing email without prior consent. But paragraph (1) limits it to "individual subscribers".
Regulation 2 defines the two groups:
| Group | Who is in it (PECR reg. 2) | Cold email without consent? |
|---|---|---|
| Corporate subscriber | Companies, companies under royal charter, Scottish partnerships, corporations sole, and "any other body corporate or entity which is a legal person distinct from its members" | Yes under PECR, with identification and opt-out (UK GDPR still applies) |
| Individual subscriber | "A living individual", including "an unincorporated body of such individuals" | No, unless they consented or the soft opt-in applies |
Three cases trip people up.
- LLPs are corporate. An LLP "is a body corporate (with legal personality separate from that of its members)", under the Limited Liability Partnerships Act 2000.
- Ordinary partnerships in England, Wales and Northern Ireland are individuals. They are unincorporated bodies of individuals. Scottish partnerships are listed as corporate.
- Sole traders are individuals. A one-person design studio trading under its own name needs consent, even at a business address.
The soft opt-in in regulation 22(3) won't help with cold email. It covers people whose details you got during a sale or sale negotiations. It applies only to similar products, and they must have had a chance to refuse.
How to tell which one you're writing to
Look the business up on Companies House and check the company type, not just that it is listed. A limited company or LLP will be there with a company number. A sole trader or ordinary partnership usually won't be. Limited partnerships are on the register too, but outside Scotland they are not legal persons separate from their partners, so treat them as individuals.
If you can't tell, treat the person as an individual and don't send. An email address alone doesn't tell you what kind of business sits behind it.
The ICO, the UK regulator, explains these rules in its guidance on business-to-business marketing. The Data (Use and Access) Act 2025 changed parts of the law, so check that you are reading the ICO's current version.
Identification and opt-out: what every email needs
PECR regulation 23 applies to all marketing email, corporate recipients included. You must not send a message where:
- the sender's identity "has been disguised or concealed", or
- there is no valid address where the recipient can ask for the messages to "cease".
In practice, that means:
- Send from a real person's name at your real company domain.
- Put your company name and a way to reach you in the email.
- Add one plain line, such as "Reply 'no' and I won't write again."
- Keep a do-not-contact list, and check it before every send.
Regulation 23 requires the address. It doesn't set a deadline for acting on it. Act on an opt-out at once anyway. Writing again after "no" is how complaints start.
UK GDPR: legitimate interests and the Article 14 notice
A work address such as [email protected] identifies a person. So UK GDPR applies, even in B2B.
Your lawful basis: legitimate interests
Cold email can't rely on consent, because you don't have it. The usual basis is legitimate interests, under Article 6(1)(f) UK GDPR. It covers processing "necessary for the purposes of the legitimate interests pursued by the controller".
The Data (Use and Access) Act 2025 added paragraph 11 to Article 6. It lists examples of processing that may be a legitimate interest. The first is "processing that is necessary for the purposes of direct marketing". The paragraph has been fully in force since 5 February 2026.
That is an example, not a free pass. Article 6(1)(f) still fails where the person's interests or rights override yours. Write to people whose role makes your email relevant. Write to few of them, and stop when asked. Record that reasoning in a short legitimate interests assessment.
The Article 14 notice: tell them where you got their details
When you collect data from somewhere other than the person, Article 14 applies. You must tell them who you are, why you hold their data, your legitimate interest and their rights. You must also say "from which source the personal data originate". You must also say whether the source was publicly accessible.
Timing matters. If you use the data to contact the person, the notice is due "at the latest at the time of the first communication". For cold email, that means the first email.
The right to object
Article 21 gives people "the right to object at any time" to direct marketing. After they object, their data "shall no longer be processed for such purposes". The right must be "explicitly brought to the attention" of the person by the first communication.
A short footer, with a link to a full privacy notice, can carry the key points of both articles. The privacy notice holds the rest of the Article 14 list. For example:
I found your name on the Companies House register, as a director of [company]. I'm writing because of [reason]. If you'd rather not hear from me, reply "no" and I'll delete your details. Privacy notice: [link].
Recipients outside the UK
Each country protects the people who receive email there, so check the recipient's country too. Here is how six common markets compare for a B2B cold email.
| Recipient country | B2B cold email without consent? | Main conditions | Source |
|---|---|---|---|
| United States | Yes | Accurate header, honest subject line, say it's an ad, physical postal address, opt-out honoured within 10 business days. The FTC says the law "makes no exception for business-to-business email". | FTC CAN-SPAM guide |
| Ireland | Yes, to business addresses | For a person, the consent rule doesn't cover an address used mainly for their commercial or official activity, if the email relates solely to that activity. Companies may be emailed unless they have refused. Identity and a valid opt-out address are required. | S.I. 336/2011, reg. 13 |
| Germany | No | Advertising by email without the addressee's "vorherige ausdrückliche Einwilligung" (prior express consent) is an unreasonable nuisance. Unlike the phone rule, there is no business exception. | § 7(2) Nr. 2 UWG |
| Netherlands | No, with a narrow exception | Prior consent is required. For businesses, the exception covers only addresses they published for receiving such messages, used for those purposes. | Telecommunicatiewet art. 11.7 |
| Canada | Only for conspicuously published addresses | Implied consent applies where the address was "conspicuously published", with no statement refusing messages, and the email is relevant to the person's business role. Sender details and an unsubscribe mechanism are required. | CASL s. 10(9)(b) and s. 6 |
| Australia | Only for conspicuously published addresses | Consent can't be inferred from "the mere fact" an address was published. The exception covers addresses conspicuously published for a person or role, with no refusal statement, for messages relevant to their work. Accurate sender information and a working unsubscribe facility are also required (ss. 17 and 18). | Spam Act 2003, Sch. 2 cl. 4 |
Notes on the table. The Irish link is the regulations as made in 2011, and the Australian link is the Act as made in 2003. Check for later amendments before you rely on either. The table is a starting point, not a full statement of any country's law. Take local advice before you email recipients there.
US penalties are high. The FTC says each separate email in breach can cost up to $53,088. That is an inflation-adjusted maximum, so it can change.
A checklist before you send
Run through this for every new person on your list.
- Is the recipient a corporate subscriber? Check Companies House, including the company type. If in doubt, don't send.
- Is the recipient in the UK? If not, apply that country's rule from the table.
- Is the email relevant to their role? A reason tied to their job makes your legitimate interest easier to defend.
- Does it say who you are? Real name, company and contact details.
- Does it say where you found them? Name the source, such as Companies House or a contract notice.
- Can they opt out in one step? A reply works. Honour it straight away.
- Is a privacy notice linked? It should cover your legitimate interest, their rights and how to complain.
How ClearIntro does this
ClearIntro proposes at most 10 new people a day per client, and nobody is written to twice. Every email is approved by the client before it goes out. Opt-outs and "do not contact" are honoured in code, not left to a model. Each person on the list comes with a dated, public reason to write, such as a contract award or a Companies House filing.
Read how to find companies to write to from UK contract awards, see how it works for agencies, or see the pricing.