Cold Email Laws by Country: The 28-Country Comparison Table (2026)

September 27, 2026. Cold email to a business contact needs prior consent in 12 of the 28 countries covered in this table, is allowed on the strength of a conspicuously published business address in 4, is allowed to businesses without prior consent in 7 provided the sender is identified and opt-outs are honoured, and sits under general data protection or consumer law rather than an anti-spam statute in the remaining 5. Those four groups, not "GDPR or not", are the split that decides whether a sequence is lawful. Every row below links to the full country guide, which quotes the statute, the regulator's own guidance and the published cases.

The table: 28 countries, one row each

Each country name links to its full guide. Read the third column first. "No" means a prior, provable consent is required before the first email to a business contact, and the guide explains the narrow exceptions. "Yes" means the law permits the send to a business without prior consent, and the fourth and fifth columns tell you who enforces it and what a breach costs on paper. Penalties are quoted as the law writes them, in the local currency, and the linked guide records what regulators have actually imposed.

The rows were compiled from our 28 country guides. The ten guides published in March 2026 (Australia, Canada, France, Germany, India, Singapore, Sweden, the UAE, the United Kingdom and the United States) were re-checked for this table against the statute or regulator page on 26 and 27 September 2026, and the penalty figures above are the current ones, not the ones in those older guides.

Group A: prior consent, no business exception (12 countries)

Austria, Belgium, Denmark, Germany, Italy, Netherlands, Spain, Switzerland, South Africa, South Korea, Qatar, Saudi Arabia. In every one of these, a published info@ or firstname.lastname@ address is not consent, an unsubscribe link does not cure an unsolicited email, and the sender carries the burden of proof. Three details from the guides matter more than the headline rule. Belgium and Denmark both treat an email that asks for marketing consent as marketing in itself, so you cannot email to obtain permission. Austria and Denmark both count fines per email or per sender identity, which prices the standard three-step sequence across rotating domains rather than the campaign as a whole. Italy is the outlier that lets you use the phone first: a live operator call to a number in a public directory, not on the opposition register, may be used to ask for email consent.

Group B: consent, but a published business address can supply it (4 countries)

Australia, Canada, New Zealand, Japan. All four statutes contain the same three-part test in slightly different words: the address was conspicuously published by that person in a business or official capacity, the publication does not say the holder refuses unsolicited messages, and the message is relevant to that person's role, business, functions or duties. A scraped list fails the test whenever any of the three parts is missing, and a purchased list fails it by default because you cannot show where each address was published. Japan adds a record-keeping duty: the basis for each send has to be stored in the form the ordinance prescribes.

Group C: allowed to businesses with identification and opt-out duties (7 countries)

United States, United Kingdom, Ireland, Sweden, France, Hong Kong, Singapore. These are the markets most outbound teams treat as "open", and the duties are real. The United States wants truthful headers, a postal address and an unsubscribe honoured within ten business days. Singapore wants the literal label "<ADV>" in the subject line of bulk unsolicited commercial email and an unsubscribe facility honoured within ten business days. Hong Kong gives ten working days, New Zealand in Group B gives five, Qatar's mainland spam regulation gives two. The United Kingdom, Ireland and Sweden draw the line at the recipient's legal form rather than at the address: a company can be emailed, a sole trader or an individual cannot without consent. France allows business prospecting on legitimate interest only where the offer relates to the person's profession, and the CNIL page that says so was last updated on 10 June 2026.

Group D: no email-specific anti-spam statute (5 countries)

India, United Arab Emirates, Mexico, Brazil, Philippines. The absence of a spam law is not the absence of rules. Mexico's consumer law requires the email itself to carry the provider's details and PROFECO's own contact details, and treats a company buying for its own use as a consumer. Brazil and the Philippines both accept legitimate interest and both punished the list, not the email, in their first enforcement actions. India's Digital Personal Data Protection Act takes full effect on 13 May 2027 under the Rules notified on 13 November 2025, so a sequence built today should already keep a consent or legitimate-interest record per contact. The UAE regulates calls and SMS through the TDRA and Cabinet Decision 56/2024 and leaves email to the general right to object under the PDPL, with separate regimes inside the DIFC and ADGM.

What every sequence needs regardless of country

Four duties appear in almost every statute in the table, so a sequence that skips any of them is unlawful somewhere in the list before you even reach the consent question: a sender who is identified by name and a working reply address; a free, one-step way to stop, honoured within the shortest deadline in your target list; suppression that is applied per address and per sender domain, because Denmark and Austria count each sending identity separately; and a record per contact of the basis you rely on, which Japan and the Netherlands require in terms and the ACM says you must be able to produce five years later. Those duties are technical as much as legal. Domains, mailboxes, one-click unsubscribe headers and suppression lists are set up once in the sending layer, which is the part of the stack our cold email infrastructure setup builds before any copy is written.

The four mistakes the guides keep finding

First, treating "GDPR" as one rule. The GDPR governs the address as personal data; the email itself is governed by national ePrivacy law, and Spain, Italy and the Netherlands have all held that a legitimate-interest assessment does not unlock the send. Second, treating an unsubscribe link as a licence. It is a duty in Group C and D countries and no defence at all in Group A. Third, buying a list and inheriting its consent. Austria fined a director who argued that buying directory data implied consent, and the Philippines makes the buyer answerable for how the seller built the file. Fourth, assuming the law stops at the border. Austria, Denmark, Japan, New Zealand, Brazil and Hong Kong all reach a foreign sender through the recipient, the mailbox location or the domain, and New Zealand does it with nothing more than a .nz address.

What it means for operators

Segment the list by country before the sequence is written, not after the first complaint. Group C countries can run a standard sequence with a compliant footer and a five-day unsubscribe service level. Group B countries need the published-address test documented per contact, which in practice means enrichment that records the source page, not a CSV from a vendor. Group A countries are phone-first, referral-first or event-first markets where the email is the second touch, and where a consent request by email is itself a breach in at least two of them. Group D countries run on legitimate interest with a written balancing test and a record per contact. If a single sequence has to cover more than one group, build it to the strictest rule in the list, because the sending domain is the same for all of them and so is the fine.