Can You Email Business Contacts Without Consent? The Rules in the US, EU, UK and Canada

You met someone at a trade show, exchanged business cards, or did a job for a company last year. Can you put them on your newsletter? The honest answer is "it depends on where they are," and the differences between the United States, the European Union, the United Kingdom and Canada are bigger than most people expect. This article explains the rules for business-to-business email in plain language, and what to record so you can show you followed them.

This is general information, not legal advice. For an edge case, or if you send at scale, ask a lawyer in the relevant country.

The short version

Where the recipient is	Can you email a business contact without an explicit opt-in?	What you must do
United States (CAN-SPAM)	Yes. No prior consent is required for commercial email.	Honest header and subject, a physical postal address, a working unsubscribe, and honor opt-outs within 10 business days.
European Union (GDPR + ePrivacy)	Sometimes. Existing customers can be emailed about similar products under the "soft opt-in," and many member states allow B2B email on a legitimate-interest basis. Rules vary by country.	A documented lawful basis, a clear opt-out in every email, and a privacy notice. Check the national rule for the recipient's country.
United Kingdom (PECR + UK GDPR)	Often yes for corporate addresses. PECR's consent rule applies to "individual subscribers" (personal addresses, sole traders, partnerships), not to limited companies.	Identify yourself, provide an opt-out, and for named individuals at companies, a legitimate-interest assessment under UK GDPR.
Canada (CASL)	Only with consent, but consent can be implied: an existing business relationship (purchase in the last two years, inquiry in the last six months) or a conspicuously published address or a business card given without a "no marketing" note.	Keep a record of why consent is implied and when it expires. Identify the sender, and provide an unsubscribe that works within 10 business days.

United States: CAN-SPAM

The CAN-SPAM Act does not require consent before sending commercial email, to businesses or to consumers. What it does require, for every commercial message:

• No false or misleading header information or subject line.
• Identification of the message as an advertisement, in a way that is clear and conspicuous (the law allows a lot of flexibility here).
• A valid physical postal address of the sender.
• A clear way to opt out, which must work for at least 30 days after the message is sent, and opt-outs must be honored within 10 business days.
• No selling or transferring the addresses of people who opted out.

Note that CAN-SPAM is a floor. Mailbox providers such as Gmail and Yahoo have their own requirements for bulk senders (authentication, a one-click unsubscribe header, and a low spam complaint rate), and those apply regardless of the law.

Source: FTC, CAN-SPAM Act: A Compliance Guide for Business

European Union: GDPR and the ePrivacy Directive

Two layers apply in the EU. The ePrivacy Directive (Article 13) covers unsolicited electronic marketing, and the GDPR covers the processing of personal data, which includes a named person's business email address. The ePrivacy Directive is implemented by each member state, so the details differ by country.

What is generally true across the EU:

• Existing customers (the "soft opt-in"): if you obtained the address in the course of a sale, you may email that customer about your own similar products or services, as long as you offered an opt-out when you collected the address and in every message since.
• Corporate (non-personal) addresses: many member states apply the consent rule only to natural persons. A generic address such as info@company.com is often treated differently from firstname.lastname@company.com, but not everywhere.
• Legitimate interest: under the GDPR, direct marketing "may be regarded as carried out for a legitimate interest" (Recital 47). This is a lawful basis for the data processing, but it does not override a national ePrivacy rule that requires consent for the sending itself.
• Always: a clear opt-out in every email, your identity, and a privacy notice that explains where you got the address and how the person can object.

Because the rules differ, record the recipient's country along with the reason you are emailing them (customer since when, met at which event). If you send to several EU countries, the safest common denominator is to email only existing customers and people who asked to hear from you.

Sources: Directive 2002/58/EC (ePrivacy), Article 13 and GDPR Recital 47

United Kingdom: PECR and UK GDPR

The UK's Privacy and Electronic Communications Regulations (PECR) require consent for marketing email to individual subscribers, which the ICO interprets as personal email accounts, sole traders and some partnerships. Corporate subscribers, such as limited companies and limited liability partnerships, are not covered by the consent rule. You can email a named employee at a limited company without consent under PECR, as long as you identify yourself and give a way to opt out.

Two things still apply:

• The soft opt-in exists in the UK too, so existing customers can be emailed about similar products.
• The named employee's address is personal data under the UK GDPR, so you need a lawful basis, usually legitimate interests, and you should be able to show you considered the person's reasonable expectations.

Source: ICO, Direct marketing and electronic mail

Canada: CASL and implied consent

Canada's Anti-Spam Legislation is the strictest of the four. A commercial electronic message needs the recipient's consent, which can be express or implied. For B2B, the implied-consent routes matter most:

• Existing business relationship: a purchase or contract within the last two years, or an inquiry or application within the last six months.
• Existing non-business relationship: for example a donation or membership within the last two years.
• Conspicuous publication: the recipient published their address (on a website, for example) without a statement that they do not want unsolicited messages, and your message is relevant to their role.
• Business card or disclosure: the recipient gave you their address, without a no-marketing statement, and the message is relevant to their business.

Implied consent expires. Express consent does not, but you must be able to prove it. Every message needs the sender's identification and contact information and an unsubscribe mechanism that is processed within 10 business days. Penalties are high, so keep records of the relationship and its dates.

Source: Government of Canada, Canada's Anti-Spam Legislation

What to record, wherever you are

The practical thread through all four regimes is being able to show why you are emailing this person. For each contact, keep:

1. The basis: customer (date of last purchase), inquiry (date), business card or event (name and date), published address, or explicit consent (date and wording).
2. The recipient's country, so you can apply the right rule.
3. Every opt-out, with the date, honored within 10 business days or sooner.

Newsletter Ready stores a consent basis and note for each subscriber, keeps an append-only log of consents and unsubscribes, and inserts the sender identification and one-click unsubscribe automatically in every issue. Choose the region in your settings and the footer wording follows the local rule.

Sources

• FTC: CAN-SPAM Act: A Compliance Guide for Business
• EUR-Lex: Directive 2002/58/EC, Article 13
• GDPR Recital 47: Overriding legitimate interest
• ICO: Electronic mail marketing (PECR guide)
• Government of Canada: Canada's Anti-Spam Legislation (CASL)