Does CASL apply if my company is outside Canada?

Yes, when a computer system in Canada is used to send or access the email. Section 12 of the act ties the email rule to where the system is, not where the sender is, so a US team emailing someone who reads their mail in Toronto is covered.

Can I send a cold email asking for permission to email someone in Canada?

Not without consent. CASL counts a message that asks for consent to send commercial messages as a commercial message itself, so the request needs the same consent as the pitch it asks about.

Can I email someone in Canada who gave me their business card?

Usually, yes. CASL implies consent when the person gave you the address themselves, on a business card or in an email to you, without saying they do not want such messages, and your email is relevant to their business role.

Are some messages exempt from CASL's consent rule?

Yes, a few. The act and its regulations take some messages out of the consent rule, such as a quote someone asked for, or a message to someone you have a personal or family relationship with. A first cold email is rarely one of them.

Is cold email legal in Canada? The CASL rules

CanadaOpt-inB2B exception: partly

Law

Canada's Anti-Spam Legislation (CASL), S.C. 2010, c. 23, ss. 6, 10(9), 11, 20(4); Electronic Commerce Protection Regulations (CRTC), SOR/2012-36, ss. 2, 3

Consent basis

Opt-in: consent before the first email

A commercial electronic message may only be sent if the recipient has consented, expressly or impliedly. Consent is implied when the person has conspicuously published the address without a statement refusing unsolicited commercial messages, and the message is relevant to their business, role, functions or duties in a business or official capacity.

B2B exception

Partly

There is no general exemption for business recipients, but a business address that was conspicuously published, with no 'no unsolicited messages' statement, gives implied consent for messages relevant to the person's role.

Footer checklist

Who is sending (sender identity): required
The sender's postal address or contact details: required
A working unsubscribe: required

The message must name the sender (and the person on whose behalf it is sent) and give the mailing address plus a phone number, email address or web address, set out clearly and prominently. It must contain an unsubscribe mechanism that can be readily performed, and unsubscribes must take effect within 10 business days.

Penalties

Administrative monetary penalties of up to CAD 1,000,000 per violation for an individual and CAD 10,000,000 for any other person.

Regulator

CRTC (Canadian Radio-television and Telecommunications Commission)

Source: laws-lois.justice.gc.ca (opens in a new tab), laws-lois.justice.gc.ca (2) (opens in a new tab), laws-lois.justice.gc.ca (3) (opens in a new tab), laws-lois.justice.gc.ca (4) (opens in a new tab). Checked Nov 9, 2026. Not reviewed by a lawyer. Not legal advice.

United StatesOpt-outB2B exception: no

Law

CAN-SPAM Act of 2003, 15 U.S.C. 7701 et seq., and 16 CFR Part 316, as explained in the FTC's CAN-SPAM Act: A Compliance Guide for Business

Consent basis

Opt-out: may email first, must honour an unsubscribe

The law sets rules for commercial email and gives recipients the right to have you stop emailing them; the FTC guide does not list prior consent as a requirement for a commercial message. You must honour an opt-out request within 10 business days, and your opt-out mechanism must work for at least 30 days after you send.

B2B exception

No

The FTC states that the law makes no exception for business-to-business email. It covers all commercial messages, not just bulk email.

Footer checklist

Who is sending (sender identity): required
The sender's postal address or contact details: required
A working unsubscribe: required

Header information must be accurate and identify the person or business who sent the message, the subject line must match the content, and the message must clearly disclose that it is an advertisement. It must include your valid physical postal address and a clear and conspicuous explanation of how to opt out.

Penalties

Up to USD 53,088 for each separate email in violation, per the FTC guide.

Regulator

FTC (Federal Trade Commission)

Source: ftc.gov (opens in a new tab). Checked Nov 9, 2026. Not reviewed by a lawyer. Not legal advice.

United KingdomOpt-outB2B exception: yes

Law

Privacy and Electronic Communications (EC Directive) Regulations 2003 (PECR), regs. 2, 22, 23 and Sch. 1 para. 18; Data Protection Act 2018, s. 157; UK GDPR, art. 21(2) to (3)

Consent basis

Opt-out: may email first, must honour an unsubscribe

Marketing email to individual subscribers needs their prior consent, except for a seller's own similar products marketed to people whose details it got in a sale or sale negotiation, with a free refusal offered at collection and in every message. Corporate subscribers are outside that consent rule, so a first email to a company address may be sent without consent, but UK GDPR still gives a named person the right to object to direct marketing.

B2B exception

Yes

The consent rule in regulation 22 applies only to individual subscribers; companies, Scottish partnerships, LLPs and other legal persons are corporate subscribers and are not covered by it. Sole traders and other unincorporated bodies of individuals count as individuals, so the consent rule still applies to them.

Footer checklist

Who is sending (sender identity): required
The sender's postal address or contact details: not named in the law
A working unsubscribe: required

Every direct marketing email, to any subscriber, must not disguise or conceal the identity of the person it is sent for, and must give a valid address where the recipient can ask for the messages to stop. A postal address is not named in regulation 23.

Penalties

A breach of regulation 22 or 23 can draw a penalty notice up to the higher maximum amount: GBP 17,500,000 or 4% of total annual worldwide turnover for an undertaking, whichever is higher.

Regulator

Information Commission (PECR reg. 2 and reg. 31)

Source: legislation.gov.uk (opens in a new tab), legislation.gov.uk (2) (opens in a new tab), legislation.gov.uk (3) (opens in a new tab), legislation.gov.uk (4) (opens in a new tab), legislation.gov.uk (5) (opens in a new tab), legislation.gov.uk (6) (opens in a new tab), legislation.gov.uk (7) (opens in a new tab). Checked Nov 9, 2026. Not reviewed by a lawyer. Not legal advice.

European Union (baseline)Soft opt-inB2B exception: partly

Law

Directive 2002/58/EC (ePrivacy Directive), art. 13 and art. 15a; Regulation (EU) 2016/679 (GDPR), art. 21(2) to (3) and art. 83(5)

Consent basis

Soft opt-in: consent first, except existing customers

Marketing email to subscribers who are natural persons needs their prior consent. The one exception is a seller emailing its own customers about its own similar products, if they can object free of charge when the address is collected and in every message. Under the GDPR anyone whose personal data is used for direct marketing may object at any time, and the data must then no longer be used for it.

B2B exception

Partly

The consent rule applies to subscribers who are natural persons; for legal persons each member state only has to make sure their legitimate interests are sufficiently protected, so national law decides. A named employee is still a data subject with the GDPR right to object.

Footer checklist

Who is sending (sender identity): required
The sender's postal address or contact details: not named in the law
A working unsubscribe: required

Marketing email must not disguise or conceal the identity of the sender on whose behalf it is sent, and must carry a valid address where the recipient can ask for the messages to stop. A postal address is not named in article 13.

Penalties

The directive leaves penalties to member states, which must be effective, proportionate and dissuasive; breaching the GDPR right to object can draw fines up to EUR 20 million or 4% of worldwide annual turnover, whichever is higher.

Regulator

No single EU regulator; each member state names a competent national authority (Directive 2002/58/EC, art. 15a)

Source: eur-lex.europa.eu (opens in a new tab), eur-lex.europa.eu (2) (opens in a new tab). Checked Nov 9, 2026. Not reviewed by a lawyer. Not legal advice.

GermanySoft opt-inB2B exception: no

Law

Gesetz gegen den unlauteren Wettbewerb (UWG), sections 7, 8 and 20; Digitale-Dienste-Gesetz (DDG), sections 6 and 33

Consent basis

Soft opt-in: consent first, except existing customers

Advertising by email without the addressee's prior express consent is always an unreasonable nuisance and is not allowed, whether the addressee is a consumer or a business. The only exception is a business that got the customer's email address in connection with a sale, advertising its own similar goods or services, where the customer has not objected and is told at collection and in every use that they can object at any time.

B2B exception

No

For email the law draws no line between consumers and other market participants; only telephone advertising to non-consumers may rest on presumed consent. A cold email to a business person therefore needs prior express consent.

Footer checklist

Who is sending (sender identity): required
The sender's postal address or contact details: not named in the law
A working unsubscribe: required

An advertising message must not disguise or conceal the identity of the sender it is sent for, and must have a valid address where the recipient can ask for it to stop at no cost beyond basic transmission rates. The person on whose behalf a commercial communication is sent must be clearly identifiable, and the header and subject line must not hide the sender or the commercial nature.

Penalties

The source names no fine for unsolicited email under UWG section 7, which is enforced by civil claims to stop and remove (UWG section 8); DDG section 33 allows a fine up to EUR 300,000 for deliberately hiding the sender or commercial nature in the header or subject line.

Regulator

No public authority enforces UWG section 7 for email; claims to stop are brought in the civil courts by competitors, trade associations, consumer associations and chambers (UWG section 8)

Source: gesetze-im-internet.de (opens in a new tab), gesetze-im-internet.de (2) (opens in a new tab), gesetze-im-internet.de (3) (opens in a new tab), gesetze-im-internet.de (4) (opens in a new tab), gesetze-im-internet.de (5) (opens in a new tab). Checked Nov 9, 2026. Not reviewed by a lawyer. Not legal advice.

FranceOpt-outB2B exception: yes

Law

Code des postes et des communications électroniques (CPCE), article L34-5; CNIL guidance on commercial prospecting by email

Consent basis

Opt-out: may email first, must honour an unsubscribe

Direct marketing by email using the details of a natural person is banned unless that person gave prior consent, with an exception for existing customers about similar products from the same seller. The CNIL says prospecting professionals may rest on the sender's legitimate interest when the message relates to the person's profession, provided the person was informed and can object.

B2B exception

Yes

Per the CNIL, a business recipient must be informed and able to object rather than give prior consent, when the subject relates to their profession. Generic addresses of legal persons such as info@ or contact@ are outside these rules.

Footer checklist

Who is sending (sender identity): required
The sender's postal address or contact details: not named in the law
A working unsubscribe: required

Every marketing message must give valid contact details where the recipient can ask for the messages to stop at no cost beyond transmission, and must not conceal the identity of the person it is sent for. The CNIL adds that each message must let the person see the sender's identity and refuse further messages by a simple means.

Penalties

Breaches are punished by an administrative fine of up to EUR 75,000 for a natural person and EUR 375,000 for a legal person; the Conseil constitutionnel declared this paragraph unconstitutional on 25 June 2026, with repeal postponed to 31 October 2027.

Regulator

CNIL (Commission nationale de l'informatique et des libertés), and the administrative authority in charge of competition and consumer affairs for fines

Source: legifrance.gouv.fr (opens in a new tab), cnil.fr (opens in a new tab). Checked Nov 9, 2026. Not reviewed by a lawyer. Not legal advice.

NetherlandsSoft opt-inB2B exception: partly

Law

Telecommunicatiewet, article 11.7, article 15.1(3) and article 15.4(2) (version in force from 15 August 2026)

Consent basis

Soft opt-in: consent first, except existing customers

Sending unsolicited commercial email is banned unless the sender can show the end user gave prior consent, for businesses as well as consumers. A seller may email its own customers about its own similar products if it offered a free and easy objection at collection and in every message.

B2B exception

Partly

For a legal person or a natural person acting in their profession or business, consent is not needed only when the sender uses electronic contact details the end user designated and published for receiving such messages, used for the stated purposes, or when the recipient is established outside the EEA under that country's rules. Otherwise a cold B2B email needs prior consent.

Footer checklist

Who is sending (sender identity): required
The sender's postal address or contact details: not named in the law
A working unsubscribe: required

Every message must always state the real identity of the person on whose behalf it is sent and a valid postal address or number to which the recipient can send a request to stop. The ACM adds that every message must contain a quick, free way to unsubscribe.

Penalties

The ACM may impose an administrative fine up to EUR 900,000 or, if higher, 1% of the business's turnover, doubled for a repeat offence within five years.

Regulator

ACM (Autoriteit Consument en Markt)

Source: wetten.overheid.nl (opens in a new tab), acm.nl (opens in a new tab). Checked Nov 9, 2026. Not reviewed by a lawyer. Not legal advice.

SpainSoft opt-inB2B exception: no

Law

Ley 34/2002, de servicios de la sociedad de la información y de comercio electrónico (LSSI), arts. 20, 21, 22, 38, 39 and 43

Consent basis

Soft opt-in: consent first, except existing customers

Promotional email is banned unless the recipient asked for it or expressly authorised it beforehand. The only exception is a prior contractual relationship where the sender lawfully obtained the address and promotes its own products or services similar to those first contracted.

B2B exception

No

The law protects any recipient, defined as a natural or legal person using the service whether or not for professional reasons, so business addresses get the same protection.

Footer checklist

Who is sending (sender identity): required
The sender's postal address or contact details: not named in the law
A working unsubscribe: required

The message must be clearly identifiable as commercial and must clearly identify the person or company it is sent for. Each email must include an email or other valid electronic address where the recipient can object, and messages without it are prohibited.

Penalties

Fines up to EUR 30,000 for a minor infringement and EUR 30,001 to EUR 150,000 for a serious one (mass, insistent or systematic sending).

Regulator

AEPD (Agencia Española de Protección de Datos)

Source: boe.es (opens in a new tab). Checked Nov 9, 2026. Not reviewed by a lawyer. Not legal advice.

ItalySoft opt-inB2B exception: no

Law

Codice in materia di protezione dei dati personali, D.Lgs. 30 giugno 2003, n. 196, art. 130 (with art. 121 definitions and art. 166 sanctions)

Consent basis

Soft opt-in: consent first, except existing customers

Marketing email needs the prior consent of the subscriber or user. The only exception lets a sender email its own customers about similar products or services, using an address the customer gave during a sale, if the customer was informed and did not refuse. The Garante says an address being easy to find online, in public registers or on websites does not allow its use without consent.

B2B exception

No

The protected contracting party (contraente) expressly includes legal persons, bodies and associations, and the Garante treats a company address that identifies a person as a personal address. The Garante also says business PEC addresses from the public index may not be used for promotional email without prior consent.

Footer checklist

Who is sending (sender identity): required
The sender's postal address or contact details: required
A working unsubscribe: required

Promotional messages may not hide or disguise the sender's identity and must give a suitable contact (recapito) where the recipient can exercise the GDPR rights in articles 15 to 22, including objection. Messages sent under the customer exception must tell the recipient each time that they can object easily and free of charge.

Penalties

Breaches of article 130(1) to (5) are subject to the GDPR article 83(5) fine of up to EUR 20,000,000 or, for an undertaking, up to 4% of worldwide annual turnover if higher.

Regulator

Garante per la protezione dei dati personali

Source: normattiva.it (opens in a new tab), normattiva.it (2) (opens in a new tab), normattiva.it (3) (opens in a new tab), garanteprivacy.it (opens in a new tab), eur-lex.europa.eu (opens in a new tab). Checked Nov 9, 2026. Not reviewed by a lawyer. Not legal advice.

IrelandOpt-outB2B exception: yes

Law

European Communities (Electronic Communications Networks and Services) (Privacy and Electronic Communications) Regulations 2011, S.I. No. 336 of 2011, reg. 13 and reg. 26

Consent basis

Opt-out: may email first, must honour an unsubscribe

Marketing email to a natural person needs their prior consent, except to existing customers about the seller's own similar products, with an easy free objection offered each time and a sale no more than 12 months before. Email to an address that reasonably appears to be used mainly for the person's commercial or official activity, about that activity only, falls outside the consent rule. Legal persons may be emailed until they say they do not consent.

B2B exception

Yes

A work address that reasonably appears to be used mainly for business, with a message about that business only, does not need consent. For subscribers other than natural persons the rule is opt-out: do not email once they have said they do not consent.

Footer checklist

Who is sending (sender identity): required
The sender's postal address or contact details: required
A working unsubscribe: required

A marketing email must include a valid address at which the sender may be contacted, must not disguise or conceal the identity of the sender, and must have a valid address where the recipient can ask for the messages to stop.

Penalties

Each unsolicited email is a separate offence; on indictment the fine is up to EUR 250,000 for a body corporate or EUR 50,000 for a natural person, or a class A fine on summary conviction.

Regulator

Data Protection Commissioner (as named in S.I. No. 336 of 2011, reg. 26)

Source: irishstatutebook.ie (opens in a new tab). Checked Nov 9, 2026. Not reviewed by a lawyer. Not legal advice.

SwedenOpt-outB2B exception: yes

Law

Marknadsföringslag (2008:486), 19 § and 20 § (with 29 §, 31 § and 48 § on the market disruption fee)

Consent basis

Opt-out: may email first, must honour an unsubscribe

A trader may email marketing to a natural person only with that person's prior consent, except to its own customers about its own similar products where the customer has not objected and is offered a free, simple opt-out each time. The consent rule is written for natural persons only, so marketing email to a legal person needs no prior consent.

B2B exception

Yes

The consent rule in 19 § protects natural persons only; for marketing to a legal person the law only requires a valid opt-out address in each email. Sole traders are natural persons and stay protected.

Footer checklist

Who is sending (sender identity): not named in the law
The sender's postal address or contact details: not named in the law
A working unsubscribe: required

Every marketing email must contain a valid address to which the recipient can send a request that the marketing stop, and this also applies to marketing to a legal person.

Penalties

A market disruption fee of at least SEK 10,000 and at most 4% of the trader's annual turnover, or up to the SEK equivalent of EUR 2 million where turnover has to be estimated.

Regulator

Konsumentverket and the Konsumentombudsmannen (KO)

Source: riksdagen.se (opens in a new tab), konsumentverket.se (opens in a new tab). Checked Nov 9, 2026. Not reviewed by a lawyer. Not legal advice.

PolandOpt-inB2B exception: no

Law

Prawo komunikacji elektronicznej, ustawa z dnia 12 lipca 2024 r. (Dz.U. 2024 poz. 1221), art. 398 and art. 446 ust. 5; ustawa o świadczeniu usług drogą elektroniczną (tekst jednolity Dz.U. 2024 poz. 1513), art. 9

Consent basis

Opt-in: consent before the first email

Using terminal equipment such as email to send commercial information, including direct marketing, to a subscriber or end user is banned unless they consented in advance. Consent may be given by the person providing an electronic address that identifies them for the purpose of receiving commercial information. The provision contains no existing customer exception.

B2B exception

No

The rule protects any subscriber or end user, and an end user is defined as any entity (podmiot) using a publicly available electronic communications service, so companies are covered. The old rule in article 10 of the e-services act, which protected only natural persons, was repealed with effect from 10 November 2024.

Footer checklist

Who is sending (sender identity): required
The sender's postal address or contact details: required
A working unsubscribe: not named in the law

Commercial information must be clearly marked as such and must contain the designation of the entity on whose behalf it is distributed and that entity's electronic addresses.

Penalties

The President of UKE may fine a sender that fails to obtain the consent required by article 398 up to 3% of the previous year's revenue or up to PLN 1,000,000, whichever is higher.

Regulator

Prezes UKE (Urząd Komunikacji Elektronicznej)

Source: api.sejm.gov.pl (opens in a new tab), api.sejm.gov.pl (2) (opens in a new tab), eli.gov.pl (opens in a new tab). Checked Nov 9, 2026. Not reviewed by a lawyer. Not legal advice.

BelgiumSoft opt-inB2B exception: partly

Law

Code de droit économique / Wetboek van economisch recht, art. XII.13; Royal Decree of 4 April 2003 regulating advertising by electronic mail, arts. 1 and 2

Consent basis

Soft opt-in: consent first, except existing customers

Advertising by email is banned without the recipient's prior, free, specific and informed consent. A royal decree exempts email to a sender's own customers (natural or legal persons) about its own similar products where the address was obtained directly in a sale and an opt-out was offered at collection, and email to legal persons at impersonal addresses.

B2B exception

Partly

No consent is needed when the recipient is a legal person and the address used is impersonal, but the Data Protection Authority warns that a functional address can still be personal data. An address that names a person is not covered by this exemption.

Footer checklist

Who is sending (sender identity): not named in the law
The sender's postal address or contact details: not named in the law
A working unsubscribe: required

When sending advertising by email the provider must give clear information about the right to object to future advertising and offer a suitable electronic means to exercise it.

Regulator

Data Protection Authority (Gegevensbeschermingsautoriteit / Autorité de protection des données)

Source: gegevensbeschermingsautoriteit.be (opens in a new tab), gegevensbeschermingsautoriteit.be (2) (opens in a new tab), gegevensbeschermingsautoriteit.be (3) (opens in a new tab), dataprotectionauthority.be (opens in a new tab). Checked Nov 9, 2026. Not reviewed by a lawyer. Not legal advice.

DenmarkSoft opt-inB2B exception: no

Law

Markedsføringsloven, lovbekendtgørelse nr. 1420 af 2. december 2024, § 10 stk. 1 to 3, § 25 and § 37 stk. 3

Consent basis

Soft opt-in: consent first, except existing customers

A trader may not contact anyone by email for direct marketing without their prior consent, and consent must be easy and free to withdraw. The only exception lets a trader email a customer, who gave their address in connection with a sale, about its own similar products, with an easy free opt-out at collection and in each message.

B2B exception

No

The Consumer Ombudsman's guidance says the ban applies to all recipients, whether a consumer, a company or a public authority, and whether the email goes to a general mailbox such as info@ or to a named director or employee.

Footer checklist

Who is sending (sender identity): required
The sender's postal address or contact details: not named in the law
A working unsubscribe: required

The email must be clearly identifiable as marketing and show on whose behalf it is sent without hiding it, and must give an address the recipient can contact to stop such messages; the guidance says a link to opt out also meets this.

Penalties

Breaching the email consent rule is punishable by a fine (bøde); the statute sets no maximum amount and weighs the breach's gravity, the trader's turnover, and its duration or extent.

Regulator

Forbrugerombudsmanden (Danish Consumer Ombudsman)

Source: retsinformation.dk (opens in a new tab), retsinformation.dk (2) (opens in a new tab), retsinformation.dk (3) (opens in a new tab). Checked Nov 9, 2026. Not reviewed by a lawyer. Not legal advice.

SwitzerlandSoft opt-inB2B exception: no

Law

Federal Act against Unfair Competition (UWG / LCD / UCA), SR 241, art. 3 para. 1 let. o and art. 23

Consent basis

Soft opt-in: consent first, except existing customers

Sending mass advertising by telecommunication, such as email, without the customer's prior consent is unfair. A seller who got a customer's contact details in a sale and pointed out the option to refuse may send that customer mass advertising for its own similar goods or services without consent.

B2B exception

No

The provision speaks of customers and makes no separate rule for businesses or business addresses.

Footer checklist

Who is sending (sender identity): required
The sender's postal address or contact details: not named in the law
A working unsubscribe: required

The message must give the correct sender and point to a simple, free way to refuse further messages.

Penalties

Wilful unfair competition under art. 3 is punishable on complaint by a custodial sentence of up to three years or a monetary penalty.

Regulator

No dedicated email regulator: civil actions by affected customers and associations, and by the Confederation where the public interest calls for it (UWG art. 10); BAKOM (Federal Office of Communications) publishes guidance

Source: fedlex.admin.ch (opens in a new tab), fedlex.admin.ch (2) (opens in a new tab), fedlex.admin.ch (3) (opens in a new tab), bakom.admin.ch (opens in a new tab). Checked Nov 9, 2026. Not reviewed by a lawyer. Not legal advice.

AustraliaOpt-inB2B exception: partly

Law

Spam Act 2003 (Cth), ss. 16, 17, 18, 25 and Schedule 2, clauses 2 and 4 (Compilation No. 10, C2016C00614)

Consent basis

Opt-in: consent before the first email

A commercial electronic message with an Australian link may not be sent unless the account holder consented, expressly or in a way that can reasonably be inferred from conduct and relationships. Consent is not inferred from the mere publication of an address, except where a work address was conspicuously published with no statement refusing unsolicited messages and the message is relevant to the person's work-related business, functions or duties.

B2B exception

Partly

The consent rule applies to business addresses too, but a conspicuously published work address of an employee, officer, partner, office holder or self-employed person counts as consent for messages relevant to their work.

Footer checklist

Who is sending (sender identity): required
The sender's postal address or contact details: required
A working unsubscribe: required

The message must clearly and accurately identify who authorised it and include accurate information on how to readily contact them, valid for at least 30 days. It must contain a clear and conspicuous statement that the recipient may send an unsubscribe message to an electronic address in the message, which must work for at least 30 days.

Penalties

For breaching the consent rule, up to 2,000 penalty units per day for a company without a prior record and up to 10,000 penalty units per day with one; the Act does not state the dollar value of a penalty unit.

Regulator

ACMA (Australian Communications and Media Authority)

Source: legislation.gov.au (opens in a new tab), legislation.gov.au (2) (opens in a new tab). Checked Nov 9, 2026. Not reviewed by a lawyer. Not legal advice.

New ZealandOpt-inB2B exception: partly

Law

Unsolicited Electronic Messages Act 2007, ss. 4 (consent), 9 (consent), 10 (sender information), 11 (unsubscribe)

Consent basis

Opt-in: consent before the first email

A commercial electronic message may only be sent with express, inferred or deemed consent, and the sender must prove it. Consent is deemed when someone in a business or official capacity conspicuously publishes their address without a statement refusing unsolicited messages, and the message is relevant to their business, role, functions or duties.

B2B exception

Partly

Consent is still needed, but a conspicuously published business address gives deemed consent for messages relevant to the person's business role. DIA ties it to an address the person published in a business or official capacity, for example on a website, in a brochure or in a trade directory, with no refusal beside it.

Footer checklist

Who is sending (sender identity): required
The sender's postal address or contact details: required
A working unsubscribe: required

The message must clearly identify the business responsible and how it can be contacted, with contact details likely to stay accurate for 30 days. It must contain a free, clearly presented, functioning unsubscribe facility, and requests must be honoured within five working days.

Penalties

DIA states that failure to comply could mean a fine of up to NZD 500,000.

Regulator

Department of Internal Affairs (DIA)

Source: dia.govt.nz (opens in a new tab), dia.govt.nz (2) (opens in a new tab), dia.govt.nz (3) (opens in a new tab). Checked Nov 9, 2026. Not reviewed by a lawyer. Not legal advice.

JapanOpt-inB2B exception: partly

Law

Act on Regulation of Transmission of Specified Electronic Mail (Act No. 26 of 2002), Arts. 2, 3, 4, 7, 34, 37; Enforcement Regulations (MIC Ordinance No. 66 of 2002), Arts. 3, 9

Consent basis

Opt-in: consent before the first email

Advertising email from a business may only be sent to people who gave prior consent, gave the sender their address, have a business relationship with the advertiser, or are an organisation or business operator that publishes its own address on the internet. A published address does not count if it is published together with a statement refusing advertising email.

B2B exception

Partly

Organisations, and individuals who run a business, that publish their own email address on the internet may be sent advertising email without prior consent, unless the publication says they refuse it. Private individuals' published addresses are not covered.

Footer checklist

Who is sending (sender identity): required
The sender's postal address or contact details: required
A working unsubscribe: required

The email must show the name of the sender responsible, the email address or other means for sending an opt-out notice and a statement that it can be used, the sender's address, and a phone number or email address for complaints and enquiries. After an opt-out notice the sender may not send again.

Penalties

Breaking a ministerial order issued for non-compliance can bring up to 1 year of imprisonment or a fine of up to JPY 1,000,000, and a fine of up to JPY 30,000,000 for a company.

Regulator

Ministry of Internal Affairs and Communications (MIC) and Consumer Affairs Agency (CAA)

Source: laws.e-gov.go.jp (opens in a new tab), laws.e-gov.go.jp (2) (opens in a new tab), laws.e-gov.go.jp (3) (opens in a new tab), soumu.go.jp (opens in a new tab). Checked Nov 9, 2026. Not reviewed by a lawyer. Not legal advice.

BrazilNo single basisB2B exception: partly

Law

Lei Geral de Proteção de Dados Pessoais (LGPD), Lei nº 13.709/2018, arts. 5, 7, 9, 10, 18 and 52

Consent basis

No single basis stated in the sources

Brazil has no email-specific statute in the sources we read. The LGPD makes consent one of ten lawful bases and also allows processing for the legitimate interests of the controller, which may support the promotion of the controller's activities, with only strictly necessary data and transparency. The person may oppose processing done without consent, and the ANPD's guide uses an unsubscribe option in each email as a safeguard.

B2B exception

Partly

The LGPD protects only natural persons, so data about a company itself is outside it. A business person's own details still relate to an identified natural person and are covered with no separate business rule.

Footer checklist

Who is sending (sender identity): not named in the law
The sender's postal address or contact details: not named in the law
A working unsubscribe: not named in the law

The LGPD names no content a marketing email must carry. The person has a right to clear information on the controller's identity and contact details, and the ANPD's legitimate interest guide treats an unsubscribe option at the end of each email as a safeguard, not a stated legal requirement.

Penalties

A simple fine of up to 2% of the company's revenue in Brazil in its last financial year, capped at R$ 50,000,000 per infraction, plus warnings, daily fines, publication and blocking or deletion of the data.

Regulator

ANPD (Agência Nacional de Proteção de Dados)

Source: normas.leg.br (opens in a new tab), gov.br (opens in a new tab). Checked Nov 9, 2026. Not reviewed by a lawyer. Not legal advice.

South AfricaSoft opt-inB2B exception: no

Law

Protection of Personal Information Act 4 of 2013 (POPIA), s. 69 (direct marketing by unsolicited electronic communications), with ss. 1, 73, 103, 107 and 109

Consent basis

Soft opt-in: consent first, except existing customers

Direct marketing by email is prohibited unless the recipient has consented or is an existing customer whose details were obtained in a sale, for the sender's own similar products, with a chance to object. A sender may approach a person who has not refused before only once, to ask for consent, and the Information Regulator says the first message to a non-customer must be that consent request.

B2B exception

No

Section 69 protects data subjects, and the Act's personal information includes information about an identifiable, existing juristic person, so companies are protected as well as individuals.

Footer checklist

Who is sending (sender identity): required
The sender's postal address or contact details: required
A working unsubscribe: required

Every direct marketing message must give the identity of the sender or the person it was sent for, and an address or other contact details to which the recipient can send a request to stop.

Penalties

The Information Regulator can impose an administrative fine of up to R10 million, and failing to comply with its enforcement notice is an offence punishable by a fine or up to 10 years in prison.

Regulator

Information Regulator (South Africa)

Source: gov.za (opens in a new tab), inforegulator.org.za (opens in a new tab). Checked Nov 9, 2026. Not reviewed by a lawyer. Not legal advice.

Is cold email legal in Canada? What CASL asks

The published-address test

What to do next

Is cold email legal in Canada: common questions

Does CASL apply if my company is outside Canada?

Can I send a cold email asking for permission to email someone in Canada?

Can I email someone in Canada who gave me their business card?

Are some messages exempt from CASL's consent rule?

Keep going