Is Cold Emailing Illegal If the Address Came Off a Local Business's Website? A Country-by-Country Test
“B2B is fine” was written for sales teams emailing staff at companies. The address a freelancer actually finds belongs to a local business, often not a company at all, that published it for customers. Whether that publication counts depends on the country. This is the test, country by country, with the clause each answer comes from.
You found a plumber on Google Maps, opened the website, copied the address from the footer, and now you are sitting on a draft wondering whether sending it is a problem. Search “is cold emailing illegal” and every page says the same thing: no, as long as you follow the rules, and B2B is fine. That answer was written for sales teams emailing staff at companies. It is not quite the answer for the address a freelancer actually finds, which belongs to a local business that is usually not a company at all, and whose owner published it so customers could reach them. Whether that publication counts for anything depends on the country, and so does whether a one-person business is “B2B” in the first place. This article is the test, country by country, with the clause each answer comes from. It is general information, not legal advice; if real money or a regulator is involved, ask a lawyer in the recipient’s country.
Is cold email legal? It depends on whether the law regulates the list or the message
Anti-spam laws come in three shapes, and the question “they published it, so can I use it?” gets a different answer under each.
The first shape regulates the message and ignores how you got the address. The United States is the example. Publication is irrelevant, consent is irrelevant; what matters is what the email contains. The second shape regulates consent, and lets a published address create it under conditions. Canada and Australia both work this way, and both write the conditions into the statute. The third shape regulates consent and says publication never creates it. The United Kingdom and most of the European Union work this way, so the only question left is who the recipient is, and a sole trader counts as a person rather than a business.
The pages that rank for this question compress all three shapes into one checklist, which is why they all read as “add an unsubscribe line and you are fine”. Take them one at a time.
Is it illegal to send unsolicited emails in the United States? No. The published address is neither permission nor a problem; the email is
The CAN-SPAM Act does not ask where you got the address and does not require consent. The FTC’s own compliance guide says two things the cold-email guides tend to skip: “The law makes no exception for business-to-business email,” and “Despite its name, the CAN-SPAM Act doesn’t apply just to bulk email. It covers all commercial messages.” One email you typed by hand to one plumber is covered exactly as a blast of ten thousand is.
What the law wants is in the message. The header information must be accurate and the subject line honest. The email must identify itself as an advertisement or solicitation, carry a valid physical postal address, and tell the reader they can decline further email, with a mechanism that keeps working for at least thirty days. An opt-out has to be honoured within ten business days, and you cannot charge for it or ask for anything beyond an email address. The address can be “your current street address, a post office box you’ve registered with the U.S. Postal Service, or a private mailbox you’ve registered with a commercial mail receiving agency”, which matters if your office is your kitchen. Each email that breaks the rules carries a penalty of up to $53,088.
The one place the statute mentions where addresses come from is 15 U.S.C. § 7704(b), and it is worth reading precisely because the ranking pages paraphrase it as “harvesting is illegal”. It is narrower than that. The clause applies when a message is already unlawful under the content rules above, and the address was obtained “using an automated means” from a website that carried, at the time, a notice that the operator “will not give, sell, or otherwise transfer addresses” for email. That combination is an aggravated violation, and a court can treble the damages for it. Opening a plumber’s site and copying the footer address is not an automated means. Running a scraper across a thousand sites is, and if one of them carried that notice, every content slip in your email just became worse.
So for a US business the website question is a non-question. The pitch itself is the whole test, and the freelancer’s version of that test (what to use as the address when you work from home, what an opt-out looks like when you are sending by hand from Gmail) deserves its own article.
Is cold email legal in Canada? Yes, when the address was conspicuously published and your pitch fits their role
Canada’s Anti-Spam Legislation requires consent, express or implied, before a commercial electronic message is sent. Section 10(9)(b) says when a published address implies it. Consent is implied if the person “has conspicuously published, or has caused to be conspicuously published, the electronic address to which the message is sent”, the publication “is not accompanied by a statement that the person does not wish to receive unsolicited commercial electronic messages at the electronic address”, and “the message is relevant to the person’s business, role, functions or duties in a business or official capacity”.
All three conditions are checkable from the page you copied the address from. Conspicuous: a contact page or footer qualifies; an address buried in a PDF or guessed from a naming pattern does not. No statement: read the lines around the address, because “no solicitations” or “please do not contact us about marketing services” switches the exemption off. Relevant: a website redesign pitched to the owner of the business whose website it is sits squarely inside their business role; the same pitch to a staff address at a dental practice is weaker. The clause says “person”, so a sole proprietor’s published address works the same way as a corporation’s. The message itself still has to identify you, give contact details and carry an unsubscribe, as every CASL message must.
Australia: the Spam Act names the self-employed individual
Page 1 for this question includes a LinkedIn post that says cold email is simply illegal in Australia, and Google’s AI Overview repeats it. The Spam Act 2003 says something more specific. Schedule 2, clause 4(1) starts by agreeing with the post: consent “may not be inferred from the mere fact that the relevant electronic address has been published”. Then 4(2) carves the exception that covers a local business. If the address lets the public reach “a particular employee”, “a particular partner in a partnership” or “a particular self-employed individual”, and the address “has been conspicuously published”, and “it would be reasonable to assume that the publication occurred with the agreement of” that person, and the publication is not accompanied by “a statement to the effect that the relevant electronic account-holder does not want to receive unsolicited commercial electronic messages”, then the account holder “is taken ... to have consented”, so long as the messages are “relevant to the work-related business, functions or duties” of that person.
The statute spelling out “self-employed individual” is the detail that matters for a freelancer. The one-person landscaping business with an address on its own site is the case the clause was written for, provided the pitch is about that business. The message still has to identify you accurately, carry working contact details and an unsubscribe that works for thirty days, and the regulator says an unsubscribe must be honoured within five working days.
Cold email GDPR and PECR: publication is never consent, and a sole trader is a person
Here the “B2B is fine” line fails, and it fails on the recipient most freelancers pitch.
In the United Kingdom the rule is in PECR, and the ICO’s guidance draws the line between individuals and corporate bodies. “You must not send marketing emails or texts to individuals without specific consent,” and the soft opt-in only covers existing customers, not prospects. Then the sentence that decides most local pitches: “Sole traders and some partnerships are treated as individuals.” A corporate body (a company, a limited liability partnership, a Scottish partnership) can be emailed without consent, though you must not conceal who you are, you must give a valid contact address, and you should keep a list of businesses that have asked you to stop.
So the UK test is the legal form, not the email domain. Look at the footer of the site you took the address from. A registered company number or “Ltd” after the name means a corporate body, and the cold email is allowed with your identity and contact address in it. A trading name with no company behind it means a sole trader, which means an individual, which means no cold marketing email, whatever the address looks like. A plumber running a limited company from a gmail.com address is a corporate subscriber; a plumber trading under his own name from info@ on a custom domain is not. Nothing on page 1 puts those two cases side by side, and they are the two cases a local-business list is made of.
In the European Union the ePrivacy Directive, Article 13(1), allows marketing email only to “subscribers or users who have given their prior consent”, and Article 13(5) leaves marketing to legal persons for each member state to decide. A self-employed person is a natural person, so the consent rule reaches them directly; a company’s address depends on the country. Germany is the strict end: section 7(2) of its unfair competition law treats advertising by email “without the addressee’s prior express consent” as an unacceptable nuisance, with no carve-out for business addressees. Where a member state does allow email to a company’s address, GDPR still applies to any address that identifies a person, and Article 14 applies because you did not get the data from them: you must tell them “from which source the personal data originate, and if applicable, whether it came from publicly accessible sources”, and when the data is used to contact them, “at the latest at the time of the first communication”. In practice that is one honest sentence in the pitch saying where you found the address.
What to read on the page before you send
Every column of the test can be answered from the same place you found the address.
First, the country, because it picks the column. Second, the legal form in the footer: a company number, “Ltd”, “Pty Ltd”, “GmbH”, “Inc.” or an incorporated name moves the business into the corporate rules; a bare trading name leaves it with the individual ones. Third, the lines around the address, since one “no solicitations” sentence turns off the Canadian and Australian exemptions and is a notice worth respecting everywhere. Fourth, who the address reaches: a role address such as info@ or office@ on a company site is the easiest case in every country, a named employee’s address needs the relevance test in Canada and Australia and the Article 14 sentence in the EU, and a personal-looking address proves nothing on its own, because the classification runs on the legal form, not the domain.
A Maps listing usually gives you a phone number and a website, not an email, so the website is where the address comes from and the page whose notices count. LeadReef attaches the contacts it finds on a business’s site to each lead; which of them you may email is still this test, applied to that business’s country and legal form.
Where the test says no, it is saying no to cold email, not to the prospect. A sole trader in Manchester can still be phoned, visited, or sent a letter, none of which PECR’s email rule touches, and a reply to any of those creates the relationship that makes a later email ordinary correspondence.
People also ask
Is cold emailing illegal?
Not as a category, in any of the five jurisdictions above. What is illegal is a cold email that breaks that country's rule: deceptive or incomplete content in the US, a message without consent in Canada and Australia when the published-address conditions are not met, and marketing email to an individual, including a sole trader, in the UK and EU.
Is it illegal to send unsolicited emails?
In the US, no; the law regulates what the email says, not whether it was asked for. In Canada and Australia an unsolicited email is lawful when consent can be implied or inferred, and a conspicuously published work address with no opt-out statement is the main way that happens. In the UK and EU it is lawful to a corporate body in most countries and unlawful to an individual.
What are the legal regulations for cold email?
The CAN-SPAM Act in the US, CASL in Canada, the Spam Act 2003 in Australia, PECR with UK GDPR in the UK, and the ePrivacy Directive as transposed by each member state together with GDPR in the EU. The recipient's country decides which applies, not yours.
What emails are prohibited by the CAN-SPAM Act?
Commercial email with false header information or a deceptive subject line, email that fails to identify itself as an advertisement, omits a valid physical postal address or a way to opt out, or keeps arriving more than ten business days after an opt-out. Sending to addresses scraped by automated means from a site with a no-transfer notice makes any of those violations an aggravated one.
Do cold emails still work in 2026?
For a freelancer pitching local businesses, yes, at reply rates in the low single digits per person emailed; the arithmetic of how many people that means per paid client is in our cold-email article. The legal test above costs you some names from the list, mainly UK and EU sole traders, and those are the ones to phone or visit instead.
Build the list, then run the test
The test only costs time when you are applying it by hand to one business at a time. The slower step is the one before it: finding the businesses whose website is losing them customers and getting the contact details together. LeadReef does that part: it scans a city, flags the sites with visible problems, attaches the contacts it finds and drafts the pitch. The first 10 leads are free, from any of 10 business types in any of 10 locations, at leadreef.ai/find. Run the test on each one before you press send.