Cold email is outbound email sent to someone with no prior relationship or opt-in, aimed at starting a business conversation, as distinct from marketing email sent to a list that already subscribed.
Cold email has no engagement history behind it. That's the practical difference from marketing email, more than any legal distinction. A marketing list opted in and has months or years of opens and replies backing its reputation. A cold email goes to someone who's never heard from the sender, on a domain that mailbox providers have no reason yet to trust.
Under US CAN-SPAM, cold B2B email is generally permitted. The law is opt-out based, not opt-in based, provided the sender uses accurate identification, avoids deceptive subject lines, includes a physical address, and honors opt-out requests promptly. Under GDPR and adjacent EU frameworks, the picture depends more on jurisdiction. Legitimate interest can cover some B2B outreach, but the specifics vary by member state and by whether the recipient is being contacted in a business role. None of this is one-size-fits-all, and it isn't legal advice, this is a question for counsel once a program runs beyond plain US B2B outbound.
Because it carries no engagement history, cold email also carries more infrastructure risk than a marketing send: bounces from unverified addresses, occasional spam complaints, and the volume patterns that trip filters while a domain is still unproven. That's the entire reason cold email gets sent from a separate domain, never a company's main one, so a bad week in outbound never touches the mail a business actually depends on.
A cold email program starts on infrastructure built for the job: a separate sending domain, its own SPF, DKIM, and DMARC records, and a warmup period before real volume. None of that is specific to cold email as a format. It's specific to sending mail with zero engagement history behind it, which cold email always is by definition.
People assume cold email sits in a legal gray area or is inherently spam. In most US B2B contexts it's neither, CAN-SPAM explicitly permits opt-out based outreach done properly. The actual risk isn't legal, it's operational: a brand-new domain with no reputation gets judged more harshly for the same volume and behavior a warmed, opted-in list would get away with.
Tell us how your motion runs today. We'll show you what we'd engineer.
Contact us