Also called: opt out vs opt in · email consent laws for cold outbound · gdpr opt-in vs opt-out
Opt-in vs opt-out email consent is whether a sender needs permission before the first cold email (opt-in, the UK and EU default for individuals) or can send first and honor an unsubscribe (opt-out, the US CAN-SPAM model). Which one applies depends on jurisdiction and entity type.
Opt-in and opt-out are two answers to one question: does a sender need permission before the first cold email, or can permission wait until after. An opt-in model requires that permission upfront. An opt-out model allows the first message without it, provided the sender makes stopping easy and honors every request that follows.
US federal law runs on the opt-out model and draws no line between B2B and B2C. CAN-SPAM lets a commercial email go out without prior consent, as long as the header information is accurate, the subject line isn't deceptive, the message is identified as an ad, a valid physical address is included, and any opt-out request is honored within 10 business days.
UK PECR splits by entity type rather than by cold versus warm. Corporate subscribers, companies, LLPs, and similar incorporated bodies, can be emailed without consent at all. Sole traders and unincorporated partnerships count as individuals under PECR and need either consent or the soft opt-in: the sender collected their details during a sale or a sale negotiation, is marketing a similar product or service, and gave a clear opt-out both at collection and in every message since. That exception never covers a bought-in list or a brand-new contact.
GDPR sits underneath PECR and supplies the lawful basis PECR itself doesn't specify. Most B2B cold email in the EU runs on legitimate interests rather than consent, which turns GDPR compliance into a balancing test against the recipient's own rights rather than a flat opt-in requirement. PECR's consent and soft-opt-in rule still governs the email channel on top of whichever GDPR basis applies.
None of the three regimes defer to the others. A list built for US-only outbound can be fully opt-out compliant under CAN-SPAM and still break PECR the moment a UK sole trader is on it, or break GDPR's balancing test if the outreach doesn't hold up as a legitimate interest. Jurisdiction and entity type decide the model before anything about the message itself does.
FTC, CAN-SPAM Act compliance guide for business: https://www.ftc.gov/business-guidance/resources/can-spam-act-compliance-guide-business
ICO, business-to-business marketing under PECR: https://ico.org.uk/for-organisations/direct-marketing-and-privacy-and-electronic-communications/business-to-business-marketing/
ICO, electronic mail marketing guidance (soft opt-in): https://ico.org.uk/for-organisations/direct-marketing-and-privacy-and-electronic-communications/guide-to-pecr/electronic-and-telephone-marketing/electronic-mail-marketing/
GDPR Article 6, lawfulness of processing: https://gdpr-info.eu/art-6-gdpr/
A single outbound program can be workable in the US and questionable in the UK or EU purely because of who's on the list, not what the email says. Teams running outbound across US, UK, and EU lists should tag contacts by jurisdiction and by corporate vs individual or sole-trader status before applying one blanket send policy.
People search opt-in vs opt-out expecting one universal rule and usually mean can I cold email this person. The honest answer is that it depends on the regime and the entity type. Treating US opt-out norms as the default for a UK or EU list, or treating PECR's corporate-subscriber carve-out as covering every business contact, is how outbound programs end up out of step with where their contacts actually sit.
Tell us how your motion runs today. We'll show you what we'd engineer.
Contact us