What is cold email? Definition, legality, and why it isn't spam (when done right)

Cold email is a personal, one-to-one email sent for a business reason to someone who hasn’t interacted with you before. A founder writing to twenty carefully chosen operations leads about a problem those specific people have — that’s cold email. The same message blasted to two million scraped addresses is something else, and the difference isn’t cosmetic: it’s legal, technical and economic all at once.

Cold email vs. spam — the actual line

	Cold email	Spam
List	Researched, relevant, small	Anyone with an inbox
Message	Personal, about the reader	Identical, about the sender
Identity	Real name, company, address	Hidden or forged
Opt-out	One click, honored instantly	None, or a trap
Economics	Wins by relevance	Wins by volume

The receiving networks enforce this line mechanically. Since the Gmail and Yahoo sender rules took effect in 2024, bulk senders must authenticate (SPF, DKIM, DMARC), offer one-click unsubscribe, and stay under a 0.3% spam-complaint rate — with 0.1% as the working target. Cross the line and you’re treated as the left column regardless of your intentions. The full rules are in Gmail & Outlook sender requirements.

Is cold email legal?

In the US — yes. CAN-SPAM explicitly permits unsolicited commercial email as long as you don’t use deceptive headers or subjects, you identify the message as commercial, include a physical address, and honor opt-outs promptly. We wrote up what CAN-SPAM actually requires — it’s shorter than its reputation.

In the EU — regulated, not banned. GDPR and the ePrivacy rules generally require either consent or a defensible legitimate-interest basis for B2B outreach, with member states differing in strictness. B2B email to corporate addresses about genuinely relevant business matters is commonly practiced under legitimate interest — but if your list is heavily EU, read up specifically and keep your relevance argument written down.

Everywhere — the practical bar is higher than the legal one. A legal email that annoys 1 in 300 recipients enough to hit “report spam” still kills your domain. The economics force you to be better than compliant.

The four pillars of doing it right

1 · A list that deserves the email. Define who has the problem, source contacts accordingly, and verify every address before sending — over 2% bounces and providers start rejecting you. The process: how to build a lead list that doesn’t bounce.

2 · Infrastructure that can carry it. A secondary domain, authentication that passes in one check, mailboxes warmed for 2–4 weeks, and volume under ~40/day per mailbox.

3 · A message about the reader. Under 100 words, a first line that proves homework, one ask. Templates help with structure — the research minute is what makes them work.

4 · Follow-up with manners. Three to five sends over 2–3 weeks earns 42% of all replies; a working unsubscribe and a genuine “no problem” on rejection keep complaint rates at rounding-error levels.

What results look like

Honest benchmarks, from large published studies rather than tool marketing: 95–98% delivered, 3–8% replies on competent campaigns, with top-decile personalization reaching 17–18%. Reported “open rates” of 40–60% are mostly robots and proxies — judge campaigns on replies. The full numbers with sources: cold email benchmarks, and the working math from list to meetings: 1,000 sends, end to end.

Where to start

The pre-send checklist compresses all of the above into four gates you can run in an afternoon. And if you’d rather the infrastructure part just be handled — warmup free and automatic, verification on every import, pacing and reputation guards built in, only human opens counted — that’s the product this blog pays the rent for.