You can legally cold email most UK businesses without their consent, as long as you follow a few clear rules. Get it wrong and the fines rose sharply in 2026. Here's what's allowed, what changed, and what the latest data says actually gets replies. This is general information, not legal advice.

Yes, with conditions. The key rules come from the Privacy and Electronic Communications Regulations (PECR) and UK GDPR. The ICO's business-to-business marketing guidance is the best place to start.

Companies vs sole traders: the key difference

  • Limited companies, LLPs and other "corporate subscribers": PECR's consent rule for marketing emails doesn't apply. You can email them without prior consent.
  • Sole traders and some partnerships count as individuals. You need their specific consent, unless the "soft opt-in" applies (they gave you their details while buying or negotiating with you, you're marketing similar products, and you offered an opt-out then and in every email).

The ICO's advice is simple: if you're not sure which type of business someone is, treat them as an individual.

UK GDPR and legitimate interests

A named work email like jane.smith@company.co.uk is still personal data, so UK GDPR applies even when PECR doesn't. Most B2B marketers rely on "legitimate interests" as their lawful basis. That means doing a three-part check: is there a genuine purpose, is emailing necessary for it, and does it outweigh the person's rights? Following the Data (Use and Access) Act, the ICO updated its guidance in 2026 to say that in most cases direct marketing is likely to be a legitimate interest, as reported by the DMA. The balancing test still applies.

If your contacts come from somewhere other than the person themselves, you must give them privacy information within a reasonable time, and no later than your first message to them.

What every cold email must include

  • Who you are. Never hide or disguise your identity.
  • A valid way to opt out, such as "reply STOP" or an unsubscribe link, and honour it promptly.
  • A suppression list. The ICO recommends keeping a "do not email" list and checking every new list against it. People can always object to direct marketing.
  • Relevance. Email people about things genuinely connected to their role and business.

What changed in 2026

The Data (Use and Access) Act 2025 came into force for PECR on 5 February 2026. The biggest change is enforcement: the maximum PECR fine rose from £500,000 to £17.5 million or 4% of global turnover, whichever is higher. Charities can now also use the soft opt-in. The ICO continues to fine senders of unwanted marketing, such as a £300,000 penalty in May 2026 over millions of unsolicited texts.

Deliverability: Gmail, Yahoo and Outlook rules

Even legal emails fail if they land in spam. The big inbox providers now require bulk senders to authenticate their email:

Small B2B campaigns rarely hit those volumes, but setting up SPF, DKIM and DMARC on your domain is good practice for everyone.

What actually gets replies

Two large datasets give a useful benchmark:

  • Instantly's 2026 benchmark report found an average reply rate of 3.43%, with the top quarter of senders above 5.5% and the top 10% above 10.7%. The best performers kept first emails under 80 words, and 42% of replies came from follow-ups.
  • Hunter's analysis of 11 million emails found an average reply rate of 4.1%. Campaigns to 50 or fewer people averaged 5.8%, against 2.1% for lists over 1,000.

The pattern is clear: small, well-targeted lists and short, personal emails win.

A compliant cold email checklist

  1. Email limited companies and LLPs only, unless you have consent.
  2. Use work addresses relevant to the person's role.
  3. Do a short legitimate interests assessment and keep it on file.
  4. Write a short, specific first email with one clear ask.
  5. Say who you are and include a simple opt-out.
  6. Follow up two or three times, adding something new each time.
  7. Keep and check a suppression list.
  8. Set up SPF, DKIM and DMARC, and send in small daily volumes.

Our lead generation service follows these rules: business contacts only, a personalised first email for every lead and a clear opt-out in every message.

Frequently asked questions

Is cold emailing legal in the UK?

Yes, to limited companies and LLPs without prior consent under PECR. You must say who you are, offer an opt-out and have a lawful basis under UK GDPR for named contacts.

Can I cold email a sole trader?

Not without their specific consent, unless the soft opt-in applies. Sole traders and some partnerships are treated like individuals.

What's the maximum fine for breaking the rules?

Since 5 February 2026, PECR fines can reach £17.5 million or 4% of global turnover, whichever is higher.

What's a good cold email reply rate?

Recent large datasets put the average at around 3–4%, with the best senders achieving 5–10% or more.

Free 15-minute call

Want this done for you?

Tell us about your business and we'll give you an honest recommendation, with no obligation.

Book a free call See our lead generation service
Sources (11)

Figures were checked against these sources on 3 November 2026. Prices and rules change, so check the latest before acting. This article is general information, not legal or financial advice.