Guide
Is B2B cold email legal in the UK?
Yes. Under PECR you can email limited companies and LLPs without their prior consent, but sole traders and most partnerships need consent. UK GDPR still covers the named person you write to, so you need a lawful basis, honest sender details and an opt-out you honour.
Two laws, two questions
Two sets of rules apply to a B2B cold email sent in the UK. They answer different questions, and you need to pass both.
- PECR (the Privacy and Electronic Communications Regulations) decides whether you may send the message at all. For email, the rule is regulation 22.
- UK GDPR and the Data Protection Act 2018 decide how you may use the personal data behind it, such as a person’s name and work email address.
Most confusion comes from mixing the two. PECR can allow the email while UK GDPR still asks you to justify it, keep records and respect objections.
Corporate and individual subscribers
PECR sorts recipients into two kinds of subscriber. The consent rule for marketing email only protects individual subscribers. So the first thing to check is what kind of business you are writing to.
| Who you are emailing | Type under PECR | Can you send without consent? |
|---|---|---|
| Limited company or PLC | Corporate subscriber | Yes, if you identify yourself and give an opt-out address |
| Limited liability partnership (LLP) | Corporate subscriber | Yes, on the same terms |
| Scottish partnership | Corporate subscriber | Yes, on the same terms |
| Some government bodies | Corporate subscriber | Yes, on the same terms |
| Sole trader | Individual subscriber | No. You need consent or the soft opt-in |
| Other partnerships, for example an ordinary partnership in England | Individual subscriber | No. You need consent or the soft opt-in |
The test is whether the business is a corporate body with its own legal status. It is not about the size of the firm or whether the address looks like a work address. A sole trader using hello@theirbrand.co.uk
is still an individual subscriber.
If you cannot tell which kind of subscriber you are dealing with, the ICO’s advice is to treat the address as belonging to an individual subscriber. In practice that means you do not cold email them.
The soft opt-in will not rescue a cold prospect. It only applies when you got the person’s details during a sale or negotiation of a sale, you are marketing similar products or services, and you offered a way to opt out both at the time and in every message since.
What PECR asks of every email
Whichever type of subscriber you write to, two rules always apply:
- Do not disguise or conceal who you are. The email should come from a real person at your firm, and it should be obvious who is writing.
- Give a valid address to opt out. A working reply address or an unsubscribe link both do the job, as long as someone acts on them.
Strictly, PECR does not say you must honour a corporate subscriber’s opt-out. The ICO says you should anyway, and once personal data is involved the right to object under UK GDPR makes it compulsory. Keep a suppression list and check every new contact against it before you send.
What UK GDPR adds
A named work address such as sarah.jones@company.co.uk
is personal data. So even when PECR allows the email, UK GDPR asks four things of you.
- A lawful basis. For B2B cold email this is usually legitimate interests. The Data (Use and Access) Act 2025 now names direct marketing as an example of processing that can be a legitimate interest. You still have to weigh your interest against the person’s, so write a short legitimate interests assessment and keep it.
- Relevance. The message should relate to the person’s job. Emailing a head of finance about a fractional CFO service is easy to justify. Emailing the same person about your web design service is harder.
- Transparency. When you did not get the data from the person directly, Article 14 of UK GDPR says you must tell them about it by the time of your first message at the latest. A short line with a link to your privacy notice covers it. Say where you found their details.
- The right to object. The ICO describes this as absolute for direct marketing. If someone asks you to stop, you stop, and you keep only what you need to make sure they are not contacted again.
Does a public post change anything?
Not the rules. The ICO is explicit that publicly available contact details do not amount to consent to direct marketing. A post on LinkedIn or Reddit does not turn a sole trader into a corporate subscriber, and it does not remove the need for a lawful basis.
What it can do is make your legitimate interests case stronger. If someone has written we are looking for a paid search agency
, an email from a paid search agency about that request is clearly relevant and expected. That is a very different position from emailing a list of strangers. If you work this way, our guide on how to find clients on LinkedIn and Reddit covers the finding, and how to reply to “can anyone recommend” posts covers the message.
One more point catches people out. The ICO says the electronic mail rules also apply to marketing sent by direct message on social media. A LinkedIn message is held to the same standard as an email.
Bought lists
Buying a list does not move the legal risk to the seller. The ICO notes that an organisation buying B2B data would breach PECR if it emailed addresses that belong to individual subscribers, because consent has to be given to the sender. Most bought lists do not tell you which entries are sole traders or partnerships.
There is a UK GDPR problem too. You still owe each person the Article 14 information and a lawful basis, and you are relying on someone else’s account of where the data came from. This is one reason intent-based outbound starts from a person’s own public request rather than a list.
What changed in 2026
The Data (Use and Access) Act 2025 received Royal Assent on 19 June 2025. Most of its data protection and PECR changes came into force on 5 February 2026. For B2B cold email, three points matter.
- Higher fines. The maximum fine for breaking PECR’s marketing rules rose from £500,000 to £17.5 million or 4% of annual worldwide turnover, whichever is higher. That is the same ceiling as UK GDPR.
- Direct marketing named as a legitimate interest. This confirms what most B2B senders already relied on. It does not remove the balancing test.
- The corporate subscriber rule did not change. You can still email limited companies and LLPs without prior consent.
A short checklist
- Check the business type. Limited company, LLP or Scottish partnership is fine. Sole trader, other partnership or unknown is a no without consent.
- Use a work address. Do not email personal webmail addresses found online.
- Make it relevant to the person’s role. If you cannot say in one sentence why this person, the email should not go.
- Write down your legitimate interests assessment. One page is enough for most service firms.
- Send as a real, named person. Include your company name and a way to reach you.
- Include the privacy information. Where you found their details and a link to your privacy notice.
- Offer an opt-out in every email and honour it quickly. Add the address to a suppression list and check that list before every send.
- Keep data only as long as you need it. Set a retention period and stick to it.
Common questions
Do I need consent to cold email a limited company in the UK?
No. Limited companies, LLPs, Scottish partnerships and some government bodies are corporate subscribers, so PECR’s consent rule does not apply. You must still identify yourself, give an opt-out address and have a lawful basis under UK GDPR for the named person’s data.
Can I cold email a sole trader?
Not without consent or the soft opt-in. PECR treats sole traders and some partnerships as individual subscribers, and the soft opt-in only covers people whose details you got during a sale or negotiation.
Do the same rules apply to LinkedIn messages?
Yes. The ICO says the electronic mail marketing rules apply to marketing sent by direct message on social media.
Do these rules apply when I email a company outside the UK?
Other countries have their own rules, and some are stricter about B2B email. Check the rules where the recipient is before you send.
If you want this done for you, Buyerflare runs intent-based outbound as a managed service. It only uses business addresses, includes an opt-out in every message and honours exclusion lists. A person reviews every first email before it is sent, in your name, from separate, warmed inboxes. Replies go straight to you.