What it costs, not just what is allowed

Writing to someone who asked for nothing has a name — prospecting — and a legal frame. This guide says what is allowed, what is not, and something you rarely read from an email tool: why this use is not ours, and what it costs whoever tries it with the wrong tool.

In the EU: consent first

Under the GDPR, commercial prospecting by email to a private individual in the European Union requires their prior agreement. No agreement, no send — there is no tolerated 'first contact'. This covers any sender, anywhere in the world, whose recipients live in the EU.

One exception exists for existing customers: you may contact them about similar products or services to what they already bought, without fresh consent. Creating an online account is not enough: there must have been a real purchase.

To work addresses, prospecting may rest on legitimate interest: the message must relate to the person's profession, they must have been informed of that use, and they must be able to object easily. Keep, for every address, where it came from and when.

In the US: opt-out model (CAN-SPAM)

CAN-SPAM takes the opposite approach: you may send commercial email to any address until the recipient opts out, provided you meet four requirements: identify yourself (no false headers), include a valid postal address, give a clear way to unsubscribe, and honour opt-out requests within ten business days.

There is no prior-consent requirement for B2C prospecting under US federal law — but many states and sectoral laws add conditions, and inbox providers apply their own reputation rules regardless of what the law permits.

The practical result is the same: bulk cold mail to strangers produces complaints, and complaints destroy your sending reputation. The legal frame differs; the technical cost does not.