B2B data compliance: GDPR, CCPA and cold outreach

Yes, cold email is legal in the US, the UK and most of Europe, as long as you follow the rules where your recipient is. In the US, CAN-SPAM lets you email any business contact without consent if the email is honest, carries your postal address and honors opt-outs within 10 business days. In the UK you can email people at limited companies without consent, but sole traders count as individuals. EU rules for business email vary by country, and Germany requires prior consent even for business addresses.

Data protection law sits on top of the email rules. The moment you hold a named person's work email, GDPR (EU and UK) or the CCPA (California) applies, B2B or not.

Is cold email legal in the US?

Yes. The CAN-SPAM Act doesn't ask for consent. It asks for honesty and a way out. The FTC's CAN-SPAM compliance guide is blunt: "The law makes no exception for business-to-business email." Every commercial email you send must:

• use accurate From, To and routing information that identifies who sent it
• have a subject line that reflects what's in the email
• disclose clearly that the message is an ad
• include your valid physical postal address
• explain how to opt out, and honor opt-outs within 10 business days

Two rules catch people out. You can't sell or transfer the addresses of people who opted out. And you can't hand the risk to an agency: the FTC says you "can't contract away your legal responsibility" when someone else sends on your behalf. Each email in violation can cost up to $53,088.

Cold email under GDPR and UK PECR

In Europe, two sets of rules apply at once. The electronic marketing rules (PECR in the UK, the ePrivacy Directive and national laws in the EU) decide whether you can send the email at all. GDPR decides how you can collect and use the person's data.

UK: corporate subscribers vs individuals

The ICO's business-to-business marketing guidance says the PECR email rule "does not apply to corporate subscribers." So you don't need consent to email someone at a limited company, an LLP or a Scottish partnership. You do need to say who you are and give a valid address to opt out.

Sole traders and other partnerships are "individual subscribers", so you need their consent (or an existing customer relationship) to email them. You can't always tell from the address, so when in doubt, treat the contact as an individual.

The UK GDPR still applies to the named person: the ICO says data that identifies an individual is personal data "even if they are acting in their business capacity." Since the Data (Use and Access) Act took effect, the ICO can fine up to £17.5 million or 4% of global turnover for PECR breaches (ICO, February 2026).

EU: each country sets its own B2B email rules

The ePrivacy Directive requires prior consent for email marketing to natural persons. For businesses, it only tells member states to make sure the "legitimate interests of subscribers other than natural persons" are "sufficiently protected" (Directive 2002/58/EC, Article 13). That's why B2B email rules differ from country to country.

Germany sits at the strict end. Its unfair competition law treats email advertising sent without the recipient's prior express consent as an unreasonable nuisance, with no carve-out for business addresses (UWG §7). Before you email into an EU country, check that country's rules as well as GDPR.

Legitimate interest under GDPR

Even where you're allowed to send the email, GDPR needs a lawful basis for using the person's data. For cold B2B outreach that's almost always legitimate interest under Article 6(1)(f): processing that's necessary for your legitimate interests, "except where such interests are overridden" by the person's rights. Recital 47 says processing for direct marketing "may be regarded as carried out for a legitimate interest." May, not is.

How to run a legitimate interest assessment

The ICO splits legitimate interest into a three-part test and says you must pass all three before you start using the data:

1. Purpose test. Do you have a legitimate interest? Selling a relevant product to businesses usually counts.
2. Necessity test. Do you need this person's data for it? Emailing a head of finance about finance software, yes. Emailing every employee at the company, probably not.
3. Balancing test. Would the person reasonably expect this, and could it harm them? A short email to a work address about their job passes far more easily than repeated sends to a personal inbox.

Write your answers down. That record is your legitimate interest assessment (LIA), and it's the first thing a regulator will ask to see.

Two duties that change your first email

Say where you got their details. Under Article 14, when the data didn't come from the person, you must tell them, including the source, "at the latest at the time of the first communication."

Tell them they can object. Under Article 21, anyone can object to direct marketing at any time, and then "the personal data shall no longer be processed for such purposes." You must point that right out by your first communication, clearly and separately from everything else.

In practice that's two lines under your signature: the source of their details, how to opt out ("reply 'no' and I'll take you off my list") and a link to your privacy notice.

CCPA vs GDPR for B2B data

Plenty of US teams still assume California privacy law skips B2B contacts. It did, until the exemptions for business-to-business and employee information "expired on December 31, 2022" (California Attorney General). A VP at a California company now has the same CCPA rights over their work data as any consumer.

GDPR fines go up to €20 million or 4% of worldwide annual turnover (Article 83).

A business that sells personal information about people it has no direct relationship with is a data broker and must register with the California Privacy Protection Agency. Since August 1, 2026, data brokers must check the state's deletion platform at least once every 45 days and process the deletion requests in it (CPPA). If you buy data that covers Californians, ask your vendor whether they're registered.

Is it legal to buy an email list?

In the US, CAN-SPAM doesn't ban it, but every send is your responsibility, including honoring opt-outs. In the UK, the ICO says you can only use a bought list for marketing emails to individuals if "all the people on the list specifically consented to receive that type of message from you," and that "generic consent covering any third party will not be enough" (ICO, using marketing lists). Corporate subscribers aren't covered by that consent rule, but UK GDPR is. What to check before you pay for a list is in B2B lead lists: build vs buy.

Is cold calling legal?

In the US, mostly yes for B2B. The FTC says "most phone calls to a business made with the intent to solicit sales from that business are exempt" from the Telemarketing Sales Rule's Do Not Call provisions (FTC).

The catch is mobile numbers. FCC rules ban calls to a mobile using an autodialer or a prerecorded voice without prior express consent, and telemarketing calls of that kind need prior express written consent (47 CFR 64.1200). If your list includes mobiles, dial by hand or ask counsel whether your dialer counts as an autodialer.

In the UK, live B2B calls are allowed, but the ICO says you must screen numbers against both the Corporate Telephone Preference Service and the TPS first. In Germany, phone advertising to a business needs at least presumed consent. The phone side of outbound is covered in outbound to in-market accounts.

Running ads to business contacts

Uploading a contact list to LinkedIn or Meta to show those people ads is processing personal data too. The EDPB's guidelines on targeting social media users treat list-based targeting as a shared job: you and the platform are joint controllers for uploading the list, matching it, targeting and showing the ad.

Whether legitimate interest covers it depends on what people would expect. In the EDPB's own examples, a bank that told customers their email might be used for ads on social media could rely on legitimate interest. A bank that reused the email of someone who'd decided not to become a customer couldn't.

Two habits keep you on the right side. Run ads that relate to the person's job, and keep one suppression list: when someone opts out of your emails, remove them from your ad audiences too. LinkedIn ads for B2B covers how ads to your list work.

How AdsGTM and Contactlevel handle compliance

AdsGTM is the done-for-you services team at Contactlevel, and every list is built from Contactlevel's own data.

• Contactlevel's privacy policy commits to complying with GDPR, CCPA and other regional data protection laws. It covers the people in Contactlevel's identity graph as well as platform users.
• Anyone can ask to have their data removed, free, at contactlevel.com/privacy-request. The privacy team searches the identity graph, deletes matching records and confirms by email, always within 45 days.
• The policy lists the rights to access, delete and correct data, and to opt out of sales, targeted advertising and marketing.
• Contactlevel encrypts data in transit (TLS 1.3) and at rest (AES-256).
• Contactlevel's SOC 2 Type II audit is in progress and tracked publicly in its Trust Center, which also lists sub-processors and offers the latest penetration test report on request.
• If you run ads to the list through Contactlevel, exclusions (customers, competitors or anyone else you add, such as opt-outs) sync across every connected ad platform.

Your side stays yours. When you email, call or advertise to the list, you decide the purpose and the message, so the legitimate interest assessment, privacy notice, opt-out handling and country checks are your job. GDPR also expects personal data to be kept accurate, one more reason data accuracy matters beyond bounce rates.

A checklist before your next campaign

• Check the email rules for every country on your list.
• Write a legitimate interest assessment for EU and UK contacts.
• Put your postal address, the data source, an opt-out and a privacy notice link in your first email.
• Keep one suppression list across email, phone and ads, and act on opt-outs the same day.
• Screen UK numbers against TPS and CTPS, and don't autodial US mobiles without consent.