Is Cold Email Legal in the UK? PECR Rules for B2B and Sole Traders (2026)
Is cold email legal in the UK, in short: yes to companies, no to sole traders without consent. Under PECR you may email employees of limited companies, LLPs and public bodies without prior consent if you identify yourself and offer an opt-out. Sole traders and most partnerships count as individuals and need consent. UK GDPR still applies to named people, and PECR fines now reach £17.5 million or 4% of turnover.
More on this topic: Cold email and deliverability, every guide in one place.
The UK sits between the US and much of the EU. Its rules split recipients into “corporate subscribers” and “individual subscribers”, and a cold email that is lawful to a director of a limited company can be unlawful to a self-employed consultant doing the same job. This guide covers that split, the UK GDPR layer on top, what every email must contain and the penalties.
Key takeaways
- Corporate subscribers (limited companies, LLPs, Scottish partnerships, public bodies): no prior consent needed under PECR.
- Individual subscribers (consumers, sole traders, most partnerships in England, Wales and Northern Ireland): consent or the soft opt-in needed.
- Every email: say who you are and give a valid address for opting out.
- UK GDPR still applies to named work addresses: a lawful basis, privacy information, and the right to object.
- Objections: anyone, including an employee at a company, can tell you to stop; you must.
- Fines: the Data (Use and Access) Act 2025 raised the PECR maximum from £500,000 to £17.5 million or 4% of global turnover.
Is cold emailing legal in the UK?
Cold emailing is legal in the UK when it goes to corporate subscribers — people at limited companies, LLPs, Scottish partnerships and public bodies — and you identify yourself and offer an opt-out. Unsolicited marketing email to individuals, including sole traders, needs their consent or the soft opt-in.
Two laws apply together. PECR decides whether you may send the email. UK GDPR decides whether you may use the person's data, because a named address such as jane@company.co.uk is personal data. Pass both tests, and the email is lawful.
What is a corporate subscriber under PECR?
A corporate subscriber is an organisation that is a separate legal entity: a limited company, an LLP, a Scottish partnership or a government body. PECR's consent rule for marketing email does not apply to them, so B2B cold email to their staff is allowed with an opt-out.
| Recipient | PECR treats them as | Cold email without consent? |
|---|---|---|
| Employee at a limited company (Ltd, plc) | Corporate subscriber | Yes, with identification and opt-out |
| Member or employee of an LLP | Corporate subscriber | Yes, with identification and opt-out |
| Scottish partnership | Corporate subscriber | Yes, with identification and opt-out |
| Government body, school, NHS trust | Corporate subscriber | Yes, with identification and opt-out |
| Sole trader | Individual subscriber | No — consent or soft opt-in |
| Partnership in England, Wales or Northern Ireland | Individual subscriber | No — consent or soft opt-in |
| Consumer, personal address | Individual subscriber | No — consent or soft opt-in |
The practical problem is that you cannot always tell from an email address. A plumber at smithplumbing.co.uk may be a sole trader or a limited company. Check Companies House before adding small businesses to a cold list, and leave out anyone you cannot confirm is incorporated.
Many lists marketed as “B2B” are full of sole traders, freelancers and small partnerships. Under PECR they are individuals, and emailing them without consent is a breach, however business-like the message. Small-business lists are where most UK cold email risk sits.
What is the soft opt-in?
The soft opt-in lets you email individuals without explicit consent if you got their details during a sale or negotiation of a sale, you are marketing your own similar products, and you gave them a chance to refuse when you collected the details and in every message since. It covers existing customers and serious enquirers, not cold prospects.
So for a genuinely cold email to a sole trader, the soft opt-in does not help; you need consent first. A common route is to reach them another way — content, events, referrals — and invite them to opt in.
Want to see what your own numbers look like? Start a workspace and price it against the table above.
Start free14-day free trial · No credit card required
Does UK GDPR apply to B2B cold email?
Yes, whenever the address identifies a person. You need a lawful basis — usually legitimate interests, backed by a written assessment — you must tell the person where you got their data within a month or at the first email, and you must stop if they object.
- Legitimate interests assessment: your purpose, why the data is necessary, and why a person in that role would expect your email.
- Privacy information: who you are, what you hold, the source, how long you keep it, and their rights — a short line and a link in the first email.
- Right to object: absolute for direct marketing. An employee at a corporate subscriber can opt out personally even though PECR does not require their consent.
- Data minimisation: name, role, company and work email; nothing personal.
The EU version of this layer, and how other countries treat B2B email, is in GDPR and cold email.
What must every UK cold email include?
Every UK marketing email must identify the sender and give a valid address where the recipient can ask you to stop; that applies to corporate subscribers too. UK GDPR adds the privacy information on first contact.
| Element | Required by | In practice |
|---|---|---|
| Your identity | PECR | Real name and company; no disguised sender |
| A valid opt-out address | PECR | An unsubscribe link or a reply that is honoured |
| Privacy information at first contact | UK GDPR (Article 14) | Source of the data and a privacy-notice link |
| Honouring objections | UK GDPR (Article 21) | Stop, and keep a suppression list |
| Honest subject and content | Consumer and advertising rules | No fake replies or misleading claims |
What are the fines for breaking PECR?
The Data (Use and Access) Act 2025 raised the maximum fine for breaching PECR's marketing rules from £500,000 to £17.5 million or 4% of annual global turnover, whichever is higher, in line with UK GDPR. Commentators date the change to early 2026; the ICO's own guidance pages may still show the old figure.
The regulator historically acts on complaints and on volume senders, and many of its published penalties for marketing email involve messages sent to individuals without valid consent. For a small B2B sender the realistic risks are complaints, an enforcement notice, and spam reports that damage your domain.
How do you run compliant cold email in the UK?
You run compliant UK cold email by sending only to confirmed corporate subscribers, documenting your legitimate interest, telling people where you got their data and making opting out easy. Here is the routine.
- Check legal form: Ltd, plc or LLP on Companies House; drop unconfirmed small businesses.
- Target roles, not people at random: your offer must fit the job.
- Write the assessment once per campaign type.
- Include identity, opt-out and a privacy line in every first email.
- Suppress across all campaigns the moment someone objects.
- Keep sequences short — three or four touches.
For the US and Canada rules, see CAN-SPAM and CASL; for sending volumes, how many cold emails per day per inbox.
In Scalry, which publishes this guide, every cold email carries your business name, postal address and an unsubscribe link, sends are refused until a postal address is set, and an unsubscribe suppresses the contact across all campaigns. Checking whether a UK contact is a corporate subscriber is still your job.
Summarised from the Privacy and Electronic Communications Regulations (PECR), UK GDPR, the ICO's published direct marketing guidance and commentary on the Data (Use and Access) Act 2025, checked on 25 October 2026. This is a plain-English summary, not legal advice.
Frequently asked questions
Is cold emailing legal in the UK?
Yes, to corporate subscribers such as limited companies, LLPs and public bodies, if you identify yourself and offer an opt-out. Sole traders and most partnerships count as individuals and need consent.
Can I cold email a sole trader in the UK?
Not without consent or the soft opt-in. PECR treats sole traders and non-LLP partnerships in England, Wales and Northern Ireland as individual subscribers.
Does GDPR apply to B2B emails in the UK?
Yes. UK GDPR applies to named work addresses, so you need a lawful basis such as legitimate interests, must provide privacy information, and must stop when someone objects.
What is the PECR fine for spam emails?
The Data (Use and Access) Act 2025 raised the maximum PECR fine from £500,000 to £17.5 million or 4% of annual global turnover, whichever is higher.
Do I need an unsubscribe link in UK B2B emails?
PECR requires a valid address for opting out in every marketing email, including to corporate subscribers. An unsubscribe link is the simplest way to provide it.
Can someone at a company opt out if PECR does not need their consent?
Yes. Under UK GDPR anyone can object to direct marketing, and you must stop emailing them.
How Scalry adds identification, unsubscribe links and suppression to every send is described on the cold email page.
Check the legal form of every UK small business on your list before the next send. You can rebuild one real campaign inside Scalry before moving anything else.
Start your free trialSee pricing14-day free trial · No credit card required
Build a workspace, import a real list, and run one campaign end to end before you decide anything.
14-day free trial · No credit card required
