Outreach rules compared
Cold email laws in Australia, the UK and the US
The three regimes disagree about the most basic question there is, which is whether you need permission before you send. Australia says yes, and lets you infer it for business contacts. The United Kingdom says it depends on whether the recipient is a company or a sole trader. The United States says no, and asks you to honour an opt-out afterwards. None of them has the business-to-business exemption people think they have.
General information, not legal advice. Each column checked against its own regulator on 22 September 2026: ACMA, the ICO and the FTC.
The whole thing on one screen
Three regimes, side by side
Read the first row first. Everything else follows from it, and it is the row most guidance gets wrong about at least one of the three.
| Australia | United Kingdom | United States | |
|---|---|---|---|
| Permission before sending? | Yes. Consent, which for B2B can often be inferred. | To a company, no. To a sole trader, yes. | No. Opt-out afterwards. |
| The governing rules | Spam Act 2003 | PECR, plus UK GDPR on top | CAN-SPAM Act |
| Is there a B2B exemption? | No. Inferred consent is a route to consent, not an exemption. | No. The exemption is for corporate subscribers, which excludes sole traders. | No. The FTC says the law makes no exception for B2B. |
| What makes contact lawful | A conspicuously published work address, and a message relevant to that role. | The recipient being a corporate subscriber, plus a lawful basis under UK GDPR. | Nothing in advance. The message itself has to comply. |
| Identify yourself? | Yes, and details stay accurate 30 days. | Yes, and you may not disguise your identity. | Yes, no false headers or deceptive subject lines. |
| Opt-out required? | Yes, working at least 30 days. | Yes, a valid address to opt out. | Yes, processed for at least 30 days. |
| Deadline to honour it | Five working days. | No fixed deadline, but the UK GDPR right to object is absolute. | Ten business days. |
| Anything else in the message | Nothing further required. | Nothing further required. | Identify it as an ad, and give a valid physical postal address. |
| Regulator | ACMA | ICO | FTC |
The assumption that costs money
None of the three has a B2B exemption
All three are routinely described as having one. They do not, and the three reasons are different enough that knowing one market does not help you in another.
- Australia. You may often infer consent from a work address that was conspicuously published, if your message is relevant to that person's role. That is a way of obtaining consent, not a way of going without it, and four conditions have to hold at once.
- United Kingdom. The exemption belongs to corporate subscribers, not to businesses. Sole traders and unincorporated partnerships are individual subscribers and need consent or a narrow soft opt-in, and nothing about their email address tells you which you are looking at.
- United States. No inference and no ambiguity. The FTC's own guide states that the law makes no exception for business-to-business email. The message still has to identify itself as an advertisement and carry a physical postal address.
What travels
Three obligations that hold everywhere
If you are running one programme across several markets, build to these and then add the local rule on top, rather than the reverse.
- Say honestly who you are. No false or misleading sender information in any of the three, and the United States extends that to the subject line.
- Give a working way out. All three require it, and all three require it to keep working for a period after you send.
- Act on it quickly. Five working days in Australia, ten business days in the United States, and in the UK an absolute right to object with no balancing test at all.
- Know the market you are writing into. The rules follow the recipient, not your head office. Sending from Melbourne into London puts you under PECR.
Go deeper
One page per market
This page is the summary. Each of these goes through the detail, with the primary sources linked and the date each was checked.
- Is cold email legal in Australia, covering the Spam Act and the four conditions for inferred consent.
- Is cold email legal in the UK, covering PECR, UK GDPR and the corporate subscriber rule.
- Cold calling rules in Australia, covering the Do Not Call Register and the permitted calling hours.
- UK cold calling rules, covering the TPS, the CTPS and why there are no statutory hours.
- Building a B2B prospect list in Australia, on what the ABN register can and cannot do.
- Building a B2B prospect list in the UK, on Companies House and the corporate subscriber test.
What it costs to be wrong
The penalties are per message
Which is the detail that turns a compliance question into a commercial one, because outbound is a volume activity by definition.
In the United States the FTC's compliance guide puts it at up to $53,088 for each separate email in violation, a figure the guide itself notes is adjusted for inflation, so treat it as the order of magnitude rather than a constant. That was the published figure when this page was checked on 22 September 2026.
Australia and the UK both run civil penalty regimes of their own through ACMA and the ICO. The Australian enforcement record is covered on the Spam Act page, sourced to ACMA's published infringement notices rather than to press summaries. The general shape is the same in all three: the exposure scales with the size of the send, which means the cheapest moment to get this right is before the first campaign rather than after it.
Questions people actually ask
Cold email law, answered
Do cold email laws differ by country?
Fundamentally, yes. Australia requires consent before you send, though for business-to-business it can often be inferred from a conspicuously published work address. The United Kingdom requires no consent to email a company but full consent to email a sole trader, because PECR divides recipients into corporate and individual subscribers. The United States requires no consent at all and instead requires you to honour an opt-out afterwards. Advice written for one of these is actively wrong in the other two.
Is there a B2B exemption for cold email?
No, in all three markets, for three different reasons. Australia lets you infer consent for business contacts, which is a route to consent rather than an exemption from it. The UK exempts corporate subscribers, which is narrower than businesses, because sole traders and unincorporated partnerships are individual subscribers. And the FTC states plainly that the CAN-SPAM Act makes no exception for business-to-business email. "It is B2B so it is fine" is the single most expensive assumption in outbound. The FTC on B2B.
Which country has the strictest cold email rules?
It depends who you are writing to, which is why the question is usually asked the wrong way round. For a limited company, the UK is the most permissive of the three, since no consent is required at all. For a sole trader, the UK is the strictest, since full consent or a narrow soft opt-in is required. Australia sits in between for everyone. The United States is the most permissive on sending and the most specific about what the message itself must contain.
What does every one of the three regimes require?
Three things. Identify yourself honestly, which means no false or misleading sender information in any of them. Give a working way to opt out. And honour that opt-out. The deadlines differ, being five working days in Australia and ten business days in the United States, and the UK adds an absolute right to object under UK GDPR, but the obligation itself is universal.
Which law applies, the sender’s or the recipient’s?
In practice you have to work to the rules of the market you are writing into, not the one you are sitting in. An Australian company emailing a UK sole trader is in PECR territory, and an Australian company emailing a United States address is in CAN-SPAM territory, including its physical postal address requirement. Sending from Melbourne does not make the Spam Act the only law you have to satisfy. If you are unsure about a specific programme, take advice, because this page is general information rather than legal advice.
What about phone calls?
Different rules again, and they do not follow the email ones. Australia excludes business telephone numbers from the Do Not Call Register entirely and sets precise calling hours. The UK puts companies on the CTPS and sole traders on the TPS, requires you to screen both, and sets no statutory calling hours at all. So the country that is more permissive on email is the stricter one on the phone. The UK phone rules.
Question not answered here? Ask ANI and get a straight answer.
Show your working
Primary sources, one per market
Each column was checked against its own regulator on 22 September 2026. They are the authority; this page is a plain-English reading of them, and it is general information rather than legal advice.
- ACMA, avoid sending spam for the Australian consent, identification and unsubscribe rules.
- ICO, business-to-business marketing for the corporate and individual subscriber distinction and the UK GDPR layer.
- FTC, CAN-SPAM Act compliance guide for business for the opt-out deadline, the postal address requirement, the absence of a B2B exception and the per-message penalty.