Cold email to your first clients: what works, and the rules to follow

A cold email works when it is short, written for one person, and asks for one small thing. The rules depend on where the reader lives and on whether you write to a company or to an individual. Below are the rules for the United States, the United Kingdom, Sweden and Canada, as the official pages state them when read on 3 October 2026. This is information, not legal advice.

Updated 3 October 2026

What makes a cold email work?

Think of it as a letter to one person, not a mailing. These habits help, and none of them needs a tool.

• Write to someone who has the problem. Use the list you made in how to get your first 10 customers.
• Say why you chose them, in one line that only fits this person.
• Describe an outcome, not your product's parts.
• Ask for one small step, such as a ten-minute call, or a reply with a yes or a no.
• Keep it short, so that it can be read in one go on a phone.
• Make leaving easy. Say how to stop getting your emails, and do it at once when asked.

For example, someone who builds a booking tool for dog walkers in Malmö could write to a walker whose website shows a paper diary: two lines about what they noticed, one line about what the tool does for walkers, and a question about a short call. This is an example, not a real message or result.

What are the rules in the United States?

The US Federal Trade Commission (FTC) publishes a guide to the CAN-SPAM Act. It says: "The law makes no exception for business-to-business email." So the rules apply to cold email to companies too. The guide gives these rules, and each line below is quoted from it:

• "Your 'From,' 'To,' 'Reply-To,' and routing information … must be accurate and identify the person or business who initiated the message."
• "The subject line must accurately reflect the content of the message."
• "You must disclose clearly and conspicuously that your message is an advertisement."
• "Your message must include your valid physical postal address."
• "Your message must include a clear and conspicuous explanation of how the recipient can opt out of getting marketing email from you in the future."
• "You must honor a recipient's opt-out request within 10 business days."

The guide adds that any opt-out mechanism must be able to process requests for at least 30 days after you send your message. It also says that if you hire another company to handle your email marketing, you can't contract away your legal responsibility to comply with the law. On penalties it says: "Each separate email in violation of the law is subject to penalties of up to $53,088".

What are the rules in the United Kingdom?

In the UK, the rules depend on who the reader is. The Information Commissioner's Office (ICO) says: "The main difference is that the rule on marketing by electronic mail (eg email or text message) doesn't apply to corporate subscribers." You can email a company on that basis. But the ICO also says that "Sole traders and some partnerships are treated as individuals". It says you must not send marketing email to individuals unless they have "specifically consented to electronic mail from you", or unless they are an existing customer who bought a similar product or service from you in the past.

Data protection law still applies to the person behind the address. The ICO says: "If you are processing personal data for direct marketing purposes, even in a business context, the UK GDPR applies." It adds that "in many cases it is likely that legitimate interests will be the appropriate lawful basis", and: "If an individual withdraws their consent or objects, you must stop processing their personal data for B2B marketing purposes." On identity it says: "You must not disguise or conceal your identity, and you must provide a valid contact address so they can opt out or unsubscribe."

On fines, the ICO wrote on 23 June 2026 that the Data (Use and Access) Act gives it the power to issue fines of up to £17.5 million or 4% of global turnover under PECR.

What are the rules in Sweden and the EU?

Sweden's Marketing Act (Marknadsföringslag 2008:486), as shown on the Riksdag's website, covers email in two sections. Section 19 says a business may use email in marketing to a natural person only if that person has consented beforehand: "bara om den fysiska personen har samtyckt till det på förhand". There is an exception: if the business got the person's email address when selling a product to that person, the consent rule does not apply to marketing its own similar products, as long as the person can object free of charge and easily when the address is collected and in each later message. Section 20 says a marketing email must always contain a valid address to which the recipient can send a request that the marketing stop. Section 19 speaks of natural persons. How it applies to a company address that carries a person's name is a question for the Swedish authorities or a lawyer.

The European Commission has a related page on contact lists that come from another organisation. It says the organisation "must also inform individuals, at the latest at the time of the first communication with them, that it has collected their personal data". It adds that individuals have a right to object, and that no data can be sent about an individual who objected.

What are the rules in Canada?

The Government of Canada's page on getting consent was last modified on 1 April 2019, as it shows. It describes express consent as when "someone has agreed (verbally or in writing) to receive a commercial electronic message from you". A message must give "your business name and the name of anyone on whose behalf you're sending the message", and "a current mailing address and either a phone number, email or website address". It also says "every unsubscribe request must be actioned within 10 business days or less and at no cost to the recipient".

The Act (S.C. 2010, c. 23) has an implied-consent rule that can cover a business address. Section 10(9)(b) applies when the person "has conspicuously published, or has caused to be conspicuously published, the electronic address to which the message is sent" and the publication "is not accompanied by a statement that the person does not wish to receive unsolicited commercial electronic messages at the electronic address". It also requires that the message is relevant to the person's business, role, functions or duties in a business or official capacity. Section 20(4) says: "The maximum penalty for a violation is $1,000,000 in the case of an individual, and $10,000,000 in the case of any other person."

Do email providers have rules too?

Yes. Google says that since 1 February 2024 all senders who email Gmail accounts must set up SPF or DKIM authentication for their sending domains, and must keep spam rates reported in Postmaster Tools below 0.30%. Marketing messages from senders of more than 5,000 messages a day must also support one-click unsubscribe. Cold email that many people mark as spam can damage your sending, even when it is legal.

What is a quick checklist?

• I know where the reader lives, and whether the address belongs to a company or to a person.
• My message names me truthfully and does not hide who I am.
• My subject line says what the email is about.
• My email has my postal address and an easy way to opt out.
• I stop writing to anyone who asks, within days and not weeks.
• I keep a list of people who opted out, and I check it before each send.
• I asked for one small step, and nothing else.

Read how to build a waiting list for a way to get people to ask for your email instead. The free idea check shows whether you can name and reach the people to write to.

Can Easeable help with this?

Easeable helps you structure an idea and take it into execution, including your first messages. Describe your idea in the box at the end of this page.

Sources

1. U.S. Federal Trade Commission: CAN-SPAM Act compliance guide for business (read 3 October 2026)
2. UK Information Commissioner's Office: Business-to-business marketing (read 3 October 2026)
3. UK Information Commissioner's Office: Electronic mail marketing (read 3 October 2026)
4. UK Information Commissioner's Office: One year on, the Data (Use and Access) Act (23 June 2026) (read 3 October 2026)
5. Sveriges riksdag: Marknadsföringslag (2008:486) (read 3 October 2026)
6. European Commission: Can data received from a third party be used for marketing? (read 3 October 2026)
7. Government of Canada, Innovation, Science and Economic Development: Getting consent to send email (read 3 October 2026)
8. Justice Laws Website, Canada: Canada's anti-spam Act (S.C. 2010, c. 23), section 10 (read 3 October 2026)
9. Justice Laws Website, Canada: Canada's anti-spam Act, section 20 (read 3 October 2026)
10. Google: Email sender guidelines (Gmail Help) (read 3 October 2026)