What Is Cold Email? Meaning, Law and the Line to Spam

Cold email meaning, and where "cold" comes from

A cold email is the first message in a relationship that doesn't exist yet. Two things make it cold: the reader has never dealt with you, and they never requested the message. The anti-abuse industry now has a definition of its own. M3AAWG, the working group where mailbox providers, email platforms and anti-spam companies agree on good practice, wrote in November 2025 that cold email means unsolicited mail from an identifiable sender "that tries to create a business relationship, a sale, a business opportunity, or other professional benefit" from a recipient that has "no prior relationship, connection, or consent".

The word comes from sales. Merriam-Webster defines a cold call as a call "made directly to a potential customer without prior contact or without a lead"; warm and hot leads, in sales jargon, already show some interest. A cold email stays cold only until the person answers. From the first reply on, you are in a conversation, and the next message is simply email.

Five kinds of email are easy to confuse:

People send cold email wherever a stranger could help them: sales prospecting (contacting possible customers), partnerships, recruiting candidates, asking for a job or an internship, asking a professor for a place in a lab, pitching a journalist or a podcast host, pitching investors. Searches for it keep rising: in the US, Google searches for "cold email" over the 12 months to October 2026 ran at about five times their level four years earlier (Google Trends, five-year series, read on 27 October 2026).

Cold email vs spam: how the blocklists tell them apart

Neither a cold email nor spam has the reader's permission, so permission can't be what separates them. Spamhaus defines spam as email that is both unsolicited and bulk, where bulk means part of a batch of messages "all having substantively identical content". A message is spam "only if it is both". Its own examples of unsolicited email that is normal email are "first contact enquiries, job enquiries, sales enquiries".

Its technical definition gives a test you can run on any draft. An email is spam when "the recipient's personal identity and context are irrelevant because the message is equally applicable to many other potential recipients", and the recipient never agreed to receive it. So swap the name and the company in your draft for someone else's. A draft that still reads well was written for a list, and the merge tags (the fields a tool fills in, like ) only hide that.

The line is older than the word "spam" itself, which Usenet users began applying to junk postings in 1993 and 1994, according to Brad Templeton, who documented the term's history. The first test came in May 1978, when Gary Thuerk, a marketer at DEC, then a large computer maker, had the West Coast addresses from the printed directory of the ARPANET, the US defense research network that came before the internet, typed into one message inviting them to product demos. The mail program accepted only 320 addresses in its recipient field, so the rest ended up printed in the body of the message. Mark Crispin, writing from Stanford's artificial intelligence lab, replied that he "would not mind hearing from DEC about their new products" if the message had "considerably more technical content and considerably less of a sales pitch", and called its "bulk advertising" "a clear and flagrant abuse of the directory". That message is often called the first spam. It was also a cold email sent to a list.

Where the experts draw the line

The anti-abuse bodies and consultants who have written about cold email since 2025 agree that bulk cold outreach is spam, however personal it looks. They don't all stop there:

• Spamhaus draws the line at bulk. Its June 2025 post says that "the fact that an email is unsolicited doesn't automatically make it spam. There can be legitimate, one-to-one messages sent between two people with no previous connection", and that "the problem begins when 'cold emailing' becomes automated, scaled, and sent in bulk". It lists what it sees: bought or scraped addresses, AI-written variants of one message, throwaway domains that resemble the real one, warm-up services and fake engagement. Bulk cold outreach that reaches its spam traps (addresses that exist only to catch spammers) becomes a candidate for its blocklist.
• M3AAWG's position paper (November 2025) draws it at deceptive delivery: sending cold email in bulk with methods such as personalization that makes it "appear as one-to-one communications", random sending times or look-alike domains is an "abusive practice".
• M3AAWG's best-practice guide for commercial senders (August 2026) draws it at the category itself. It "defines cold email as an unsolicited email from an otherwise legitimate entity that tries to create a business relationship with a customer who has no prior relationship with the sender or business, and views such email as abusive". The definition makes no exception for a single, well-researched sales email.
• Laura Atkins, a deliverability consultant who has fought spam since the 1990s and no longer takes cold-email clients, wrote in June 2025: "B2B cold email is spam and should be blocked by spam filters." Her target is cold email "as it's currently being sent", in volume and to bought lists, which she says "is vulnerable to all the consequences of spam, including a Spamhaus listing".

This page uses Spamhaus' line because it is the one written as a definition: one person, chosen for a reason, is cold email; the same text sent to many is spam. A sales sender should know that part of the anti-abuse industry rejects even the one-to-one kind, and that the filters it advises decide where the email lands.

AI makes the disguise cheap, and readers notice. The novelist Robin Sloan, writing in 2026 about pitches generated by a prompt for 500 people: "Nobody wants to hear from your AI bot, least of all when it's pretending to be you." What passes Spamhaus' test is the narrow case: one person, chosen for a reason you can state, with a message that only makes sense for them.

A cold email, and the same offer as spam

Both emails below are fictional. Sam builds websites for restaurants and has noticed that a bistro's online menu is a scanned PDF that phones display badly.

Subject: Your autumn menu on phones

Hi Lena,

The autumn menu on your site is a scanned PDF. Phones open it at
full width, and the prices can't be read without zooming in.

I build websites for restaurants. I could turn that PDF into a
plain menu page that loads fast and stays legible on small
screens, and send you a working draft first, so you can judge it
before deciding anything.

Would a draft be useful this month?

Sam Ortega
Ortega Sites, web developer
[street address, city]

P.S. This is a sales email. If it isn't for you, reply "no" and
I won't write again.

The same offer, written the way most cold outreach arrives:

Subject: Quick question

Hi {first_name},

I've been following {company} and love what you're building.
We help restaurants like yours get found online and fill more
tables. Do you have 15 minutes for a call on Thursday?

Best,
The Growth Team

Run the swap test. The first email names something only Lena's site has; the second fits any restaurant, and nothing in it changes but two fields. The first comes from a named person with an address and a line that makes "no" free; the second comes from a team that wants a call. And the first can only be written one at a time, because someone had to look at the site. The second exists to be sent to a list.

The postscript and the address line are there for US law, explained below. A reader in Canada needs more. Canadian law asks for a mailing address plus a phone number, an email address or a website, and an unsubscribe that says where to send the request. It also needs consent, which for Lena would be implied only if her address appears openly, on the bistro's site for example, with no notice declining such mail. A signature that covers the rest:

Sam Ortega, Ortega Sites
[mailing address] · sam@ortegasites.example
To stop emails from me, reply "unsubscribe" or write to
sam@ortegasites.example. I act on it within 10 business days.

The rest of the email stays the same. Cold Email Format: 13 Named Parts, One Job Each takes an email like the first one apart line by line, and Cold Email Subject Lines by Situation, and the Evidence shows how "Quick question" does against other subject lines.

Is cold email legal? The US, the EU, the UK and Canada

No law regulates "cold email" by name. The laws cover advertising sent by email, and in Europe the handling of the personal data in an address, so the answer turns on what the email promotes and where the reader is. The rules below are as the statutes and regulators' pages stated them on 27 October 2026. They are a summary, not legal advice.

United States: CAN-SPAM covers one email as much as a million

The CAN-SPAM Act applies to "commercial" email, meaning email whose main purpose is to advertise something for sale, and the FTC is explicit that it "doesn't apply just to bulk email" and "makes no exception for business-to-business email". No permission is needed before the first message, but every commercial email must:

1. carry accurate sender and routing information;
2. have a subject that matches the content;
3. "disclose clearly and conspicuously that your message is an advertisement", in any wording you like;
4. include what the FTC calls a "valid physical postal address" (a street address, a registered PO box or a private mailbox);
5. explain how to unsubscribe, keep that working for at least 30 days, and act on each request within 10 business days.

The maximum penalty is $53,088 per email, a level the FTC kept for 2026. Sending to addresses that software collected from a website promising not to share them, or generated by combining names and letters, makes a violation "aggravated" (15 U.S.C. 7704(b)), which lets a court raise the damages.

The test of "primary purpose" also cuts the other way. The FTC sorts email content into three kinds: commercial; "transactional or relationship" content, which completes a purchase the reader agreed to or updates a customer about an account, a subscription or an order; and "other content – which is neither commercial nor transactional or relationship". A student asking a professor for a research place, or a job seeker writing to a hiring manager, advertises nothing for sale, so the commercial rules don't attach to it on its face. No FTC page addresses job emails directly.

Copying a template doesn't make a sales email compliant. The example cold emails in four guides that Google ranked for "what is cold email" on 27 October 2026, 29 in all and most of them sales emails, include no postal address, no unsubscribe option and no line saying they are ads.

European Union: one directive, a different rule in each country

The EU rule on marketing email is Article 13 of the ePrivacy Directive (2002/58/EC). It requires prior consent for email marketing to people, the "natural persons" of the text, with one exception for your existing customers and similar products. For companies it only asks each member state to ensure their interests are "sufficiently protected". The European Commission's own evaluation in 2017 found that this freedom "led to very different approaches across the EU", so that the protection of companies "widely diverges among Member States". In February 2025 the Commission announced it would withdraw its proposed ePrivacy Regulation, meant to replace the directive, so the national rules stay.

Three countries show the range:

• Germany: section 7 of the Act against Unfair Competition (UWG) treats advertising by email without the addressee's "prior express consent" as an unacceptable nuisance in every case. Unlike its rule for phone calls, it makes no exception for businesses.
• France: the CNIL, the data-protection regulator, allows emails to professionals without consent when the subject relates to their job (its example: presenting software to a company's IT director). Those conditions concern addresses that identify a person, such as firstname.lastname@company.fr. A generic address such as contact@ or info@ belongs to the company rather than to a person, so the CNIL says those conditions don't apply to it. One rule applies in every case: each message must say who sends it and let the reader refuse further messages easily.
• Spain: article 21 of the information-society law (LSSI) bans promotional email "que previamente no hubieran sido solicitadas o expresamente autorizadas", that the recipient did not request or expressly authorise beforehand, and the law's "recipients" include companies as well as people. The only exception is your existing customers, for similar products.

Italy's rule sits in article 130 of the privacy code (Codice privacy), enforced by the Garante, the data-protection authority. Elsewhere in the EU, check the national data-protection authority's guidance on direct marketing before writing.

The GDPR is often quoted as the EU answer. It covers the personal data, not the permission to send. Recital 47 says direct marketing "may be regarded as carried out for a legitimate interest", which can justify keeping and using a work address after a balancing test. Article 21 adds that when someone objects, their data "shall no longer be processed" for marketing, and that this right must be brought to their attention "at the latest at the time of the first communication". So a cold email to an EU address needs both: the national rule's permission and an opt-out line from the first message.

United Kingdom: companies yes, sole traders no

The UK's Privacy and Electronic Communications Regulations (PECR) require consent for marketing emails to "individual subscribers" (regulation 22). The ICO, the UK regulator, explains that employees at a company, a limited liability partnership or a Scottish partnership are "corporate subscribers", which the consent rule does not cover. Sole traders and other partnerships are individual subscribers, and PECR "treats them the same as individuals". Regulation 23 applies to everyone: the sender can't be disguised, and there must be a valid address for opting out. Since 5 February 2026, a breach can cost up to £17.5 million or 4% of worldwide annual turnover, whichever is higher.

Canada: consent, sometimes implied

Canada's Anti-Spam Legislation (CASL) requires consent for any commercial message, and it counts a message as commercial if encouraging a purchase is "one of its purposes". Consent can be express, when the person agreed, or implied. Section 10(9) gives three cases of implied consent:

• an existing business relationship, such as a purchase from you in the past two years;
• an address the person "conspicuously published", on their employer's site for example, without a statement that they don't want unsolicited messages, if the email "is relevant to the person's business, role, functions or duties";
• an address the person gave you without saying they didn't want such messages, again if the email concerns their work.

Every commercial message must also give the sender's name, a mailing address and a phone number, email address or website (CRTC regulations, section 2). Its unsubscribe must work by the same electronic means, a reply for instance, and name an email address or web page for the request (CASL section 11); it must be "readily performed", stay valid for 60 days and be acted on within 10 business days. The sender has to prove consent if it is challenged (section 13). The maximum penalty is C$10 million per violation for a company and C$1 million for an individual.

The rules no law writes: Gmail, Outlook and the blocklists

A legal email can still go to spam, because the mailbox provider decides where it lands. Google's sender guidelines ask every sender to keep the spam rate (the share of emails delivered to the inbox that readers then mark as spam) below 0.3%, and recommend staying below 0.1%. Senders of about 5,000 emails a day to Gmail addresses count as bulk senders: above 0.3%, or if they take more than 48 hours to honor unsubscribes, they lose Google's help with delivery problems.

Those rules cover personal Gmail accounts. Google's FAQ says the sender guidelines "don't apply to messages sent to Google Workspace accounts", the company mailboxes many businesses use, and Microsoft's 2025 requirements cover only its consumer service (outlook.com, hotmail.com, live.com). A company mailbox is protected by its own filter, which publishes no threshold. Laura Atkins points out that business senders also get no complaint reports back: "Complaints are zero because FBLs don't exist in the B2B space", FBLs being the feedback loops that tell senders who clicked "spam". The filters judge "recipient reactions", which the sender never sees.

Volume is what wakes them up. The finance professors Will Gornall (University of British Columbia) and Ilya Strebulaev (Stanford) sent 80,000 pitch emails for invented start-ups to investors in a 2018 field experiment. The reply rate fell from 9.0% on the first 4,000 emails to 5.3% on the last 4,000, and an inbox-placement test estimated that only a quarter of the later emails still reached inboxes, a quarter went to spam and half were refused by the receiving servers. Emails carrying tracking images were blocked more often, so the researchers switched to plain text.

Blocklists are closing in too. Laura Atkins reported in September 2026 that two of them now list domains used for cold outreach: Validity's new Heatwave list, which flags sending domains "used for cold-email reputation warming and unsolicited outreach", and SURBL, which appears to be extending some listings to the sender's main company domain. SURBL's main list works on the links in a message: mail is filtered or tagged for the domains it mentions, "regardless of sender IP addresses", and a separate SURBL list covers click-tracking domains used by senders who mail people without confirmed opt-in.

So if your company's own domain gets listed, everyday mail from your colleagues that links to your website can be filtered too, not only the cold emails. You can check any domain on SURBL's lookup page and on Validity's; both explain how removal works.

Does cold email still work? What the evidence says

It does when the request fits the reader. Three field experiments, all run with emails to strangers, give the range:

• Professors: Katherine Milkman (Wharton), Modupe Akinola (Columbia) and Dolly Chugh (NYU) emailed 6,548 professors at the top 260 US universities, each once, as fictional prospective doctoral students asking for a 10-minute meeting. Between 64% and 74% answered within a week, depending on the condition, and 36% to 48% agreed to meet. The study's main finding was bias: for meetings a week away, Caucasian male names got access 26% more often than women and minorities (Psychological Science, 2012).
• Investors: in the Gornall and Strebulaev experiment described above, 80,000 pitches written by graduate students and reviewed by investors went to 28,000 venture capitalists and angel investors in October and November 2018. 6.5% drew a reply typed by a human, 4.3% an interested one, and the best tenth of the pitches 14%.
• Executives: the writer Shane Snow and Jon Youshaei emailed 1,000 Fortune 500 and Inc 500 executives in 2014, in ten variations of one generic request for advice. 293 bounced and 12 of the remaining 707 replied (1.7%), too few for any variation to show a difference. Snow's own email to the organizational psychologist Adam Grant, which referred to a talk Grant had given the day before, got an answer and a lasting relationship.

The professors answered because the request sat inside their job, came once and was short. Investors receive pitches all day, and the executives got an email that fit anyone.

Vendor reports give lower numbers for sales campaigns, and each counts differently:

The same reports show what the strongest campaigns do differently. QuickMail's top tenth of campaigns passed 11%, and its hosts' own campaigns of about 200 prospects reached 25% to 30%; one of them, Jack Reamer of the agency SalesBread, says double digits are "so much harder" above a thousand prospects. Data from Gong, a sales-software company, presented on the 30 Minutes to President's Club podcast (85 million cold emails, 2025), shows personalized emails getting five times the replies of the rest. References to the company's news, or to the reader's earlier contact with the seller, beat personal details such as a university, and a meeting request cut replies by 44% (the hosts don't say against which baseline).

One piece of advice from Harvard Business Review doesn't hold up. Its 2016 guide says that writing "Thank you so much! I am really grateful" in a request "doubles response rates". The phrase comes from a 2010 experiment by Adam Grant, an organizational psychologist at Wharton, and Francesca Gino, then a professor at Harvard Business School: students who had given feedback on a cover letter, and were then thanked, were more likely to help a second student with his (66% against 32%, as reported by the Harvard Gazette). The thanks came after the help, not in the opening message.

The data deserve caution too. In 2023 the researchers behind the Data Colada blog published evidence of fabricated data in four other papers co-authored by Gino; Harvard's investigation found she had committed academic misconduct, and the university revoked her tenure in May 2025, a finding she contests. Grant says Gino ran the cover-letter experiments and that he "never had access to the raw data".

Cold emails outside sales: professors, recruiters, journalists, investors

Many cold emails sell nothing, or sell something other than a product: a student asking for a research place, a graduate asking about a job, a founder pitching a journalist or an investor. The same line to spam applies, and the people receiving them describe it from their side.

• Professors: Lace Padilla, a professor of computer science and psychology, says "probably 65%" of the emails she gets from prospective students are identical, the stock version now written by ChatGPT, and about ten a day in application season. What she wants is a specific paper read closely, a question about it, and the question students forget: is she taking students this year? Rahul Sreedasyam, now a PhD student, adds that recipients compare notes: when labmates find they got the same email, "we just send the email to the trash". Andy Stapleton, a former academic, tells applicants to request something that takes "under 30 seconds" to answer, and never to send in bulk: "it was the easiest thing to ignore".
• Recruiters: a graduate in Canada who sent 614 emails to recruiters at more than 40 large companies in 2024, many of them through a script, got six calls (about 1%) and one job offer; 3.58% of the recipients told him to apply on the website.
• Journalists: in Muck Rack's 2025 survey of 1,515 journalists, 54% said they seldom or never respond to PR pitches, and 86% ignore pitches outside their beat.
• Investors: Fred Wilson of Union Square Ventures wrote in 2013 that he received 50 to 100 unsolicited emails a day in his priority inbox, answered about 10 to 25 of them, and archived the rest "after three or four days".

A request for a job or a research place usually falls outside CAN-SPAM's commercial rules, and outside UK "direct marketing", which the law defines as "advertising or marketing material". A pitch for a product to a journalist, or for an investment to investors, can still count as promotion. One text sent to everyone on a list is spam in both cases. Cold Email Subject Lines by Situation has lines for a professor or a recruiter, and the Tim Ferriss cold email template one well-known outline.

Five checks before the first send

Run them in this order:

1. One person, and a reason only they fit. Their job post, their paper, the menu on their site. A reason that also fits the business next door isn't a reason yet.
2. Who you are, and how to say no. Your real name, what you do, how to reach you, and a line that makes "no" free and that you will honor at once.
3. The rules of the reader's country. US sales emails need the ad notice, the postal address and the unsubscribe option. Germany needs consent first, and the UK needs it for sole traders.
4. A list you chose yourself. A bought or scraped list fails the first check before you write a word, and Spamhaus lists buying addresses in bulk among the habits of spam operations.
5. A few by hand, from your own mailbox. Send ten, read the replies, then follow up once or twice with something new (Follow Up Cold Email: Wait 3 Days, Send Two, Then Stop covers the timing).

Then ask yourself, before the first one goes: why this person, and not the one next door? An answer that doesn't fit in one sentence means you haven't chosen a recipient yet; you are still writing to a list.