What is cold email? Definition, legality, and why it isn't spam (when done right)

Cold email is a personal, one-to-one email sent for a business reason to someone who hasn’t interacted with you before. A founder writing to twenty carefully chosen operations leads about a problem those specific people have — that’s cold email. The same message blasted to two million scraped addresses is something else, and the difference isn’t cosmetic: it’s legal, technical and economic all at once.

Cold email vs. spam — the actual line

	Cold email	Spam
List	Researched, relevant, small	Anyone with an inbox
Message	Personal, about the reader	Identical, about the sender
Identity	Real name, company, address	Hidden or forged
Opt-out	One click, honored instantly	None, or a trap
Economics	Wins by relevance	Wins by volume

The receiving networks enforce this line mechanically. Since the Gmail and Yahoo sender rules took effect in 2024, bulk senders must authenticate (SPF, DKIM, DMARC), offer one-click unsubscribe, and stay under a 0.3% spam-complaint rate — with 0.1% as the working target. Cross the line and you’re treated as the left column regardless of your intentions. The full rules are in Gmail & Outlook sender requirements.

Is cold email legal?

In the US — yes. CAN-SPAM explicitly permits unsolicited commercial email as long as you don’t use deceptive headers or subjects, you identify the message as commercial, include a physical address, and honor opt-outs promptly. We wrote up what CAN-SPAM actually requires — it’s shorter than its reputation.

In the EU — regulated, not banned. GDPR and the ePrivacy rules generally require either consent or a defensible legitimate-interest basis for B2B outreach, with member states differing in strictness. B2B email to corporate addresses about genuinely relevant business matters is commonly practiced under legitimate interest — but if your list is heavily EU, read up specifically and keep your relevance argument written down.

Everywhere — the practical bar is higher than the legal one. A legal email that annoys 1 in 300 recipients enough to hit “report spam” still kills your domain. The economics force you to be better than compliant.

The four pillars of doing it right

1 · A list that deserves the email. Define who has the problem, source contacts accordingly, and verify every address before sending — over 2% bounces and providers start rejecting you. Skipping the qualifying step doesn’t get fixed by volume: a bigger list of people without the problem just produces more first sentences that don’t land, not more replies. The process: how to build a lead list that doesn’t bounce.

2 · Infrastructure that can carry it. A secondary domain, authentication that passes in one check, mailboxes warmed for 2–4 weeks, and volume under ~40/day per mailbox.

3 · A message about the reader. Under 100 words, a first line that proves homework, one ask. Templates help with structure — the research minute is what makes them work.

4 · Follow-up with manners. Three to five sends over 2–3 weeks earns 42% of all replies; a working unsubscribe and a genuine “no problem” on rejection keep complaint rates at rounding-error levels.

A short before-and-after

The difference between the two columns in the table above is easiest to see side by side. A spam-shaped opener reads like: “Hi, I hope this finds you well! We help companies like yours increase revenue with our all-in-one platform.” It says nothing specific enough to prove the sender did any homework, and it would read identically in ten thousand other inboxes. A cold-email-shaped opener on the same topic reads more like: “Saw your team posted three ops roles in the last month — usually means onboarding is the bottleneck, not headcount.” Same length, same ask coming a sentence later, but only one of them signals that the sender looked at this specific company before writing. That signal is most of what separates the two columns above — not tone, not length, but whether the first sentence could only have been written about this one recipient.

Common questions

Is cold email the same as email marketing?+

No. Email marketing sends one message to a list of people who already opted in — subscribers, existing customers, newsletter signups. Cold email sends a personalized message to specific people who haven't interacted with you, chosen because they individually have the problem the message addresses. The list-building process, the personalization expected, and the regulations that apply are all different, even though both travel over the same protocol.

How is cold email different from cold calling?+

Both reach someone who hasn't asked to hear from you, but the mechanics diverge sharply. A cold call interrupts in real time and demands an immediate answer; a cold email lets the recipient read it, ignore it, or reply on their own schedule, which is a large part of why it scales further with less perceived intrusion. Cold email also leaves a paper trail — the message, the unsubscribe link, the reply thread — that a phone call doesn't, which is part of why the compliance rules around it are so specific about identity and opt-out.

Do I need special software to send cold email, or will my normal inbox work?+

A normal inbox works fine for a handful of emails a day. Past roughly a dozen a day from one address, you run into the same volume and authentication limits that make providers flag bulk-looking mail regardless of intent — which is where dedicated sending infrastructure, like a warmed secondary domain, proper authentication, and pacing across mailboxes, starts to matter more than which email client you happen to be typing in.

What results look like

Honest benchmarks, from large published studies rather than tool marketing: 95–98% delivered, 3–8% replies on competent campaigns, with top-decile personalization reaching 17–18%. Reported “open rates” of 40–60% are mostly robots and proxies — judge campaigns on replies. The full numbers with sources: cold email benchmarks, and the working math from list to meetings: 1,000 sends, end to end.

Where to start

The pre-send checklist compresses all of the above into four gates you can run in an afternoon. And if you’d rather the infrastructure part just be handled — warmup free and automatic, verification on every import, pacing and reputation guards built in, only human opens counted — that’s the product this blog pays the rent for.