Is cold email legal in the UK? B2B rules for 2026

Yes, for most B2B email. Under the Privacy and Electronic Communications Regulations (PECR), you can send marketing email to a company, including a named employee at a limited company, without consent, as long as you do not hide who you are and you give a valid address to opt out. Sole traders and ordinary partnerships count as "individual subscribers", so they need consent or a soft opt-in. LinkedIn is not named in the guidance, but direct messages on social media count as electronic mail, so we treat a cold LinkedIn pitch like email to an individual.

Checked on 15 October 2026 against the law text and the regulator's guidance. This is not legal advice.

Two 2026 changes: since 30 September the regulator is the Information Commission, successor to the Information Commissioner's Office (ICO), whose website ico.org.uk still says ICO; and email marketing breaches from 5 February 2026 risk up to £17.5 million or 4% of worldwide turnover. The UK is far looser than Germany. All countries: cold email laws by country.

The UK at a glance

What PECR says

The rules sit in the Privacy and Electronic Communications (EC Directive) Regulations 2003, as amended by the Data (Use and Access) Act 2025. Regulation 22 limits the consent rule to individuals:

"(1) This regulation applies to the transmission of unsolicited communications by means of electronic mail to individual subscribers."

For them, marketing email needs prior consent unless a soft opt-in applies (regulation 22(3), or 22(3A) for charities). Regulation 23 covers every recipient, companies included: no marketing email "where the identity of the person on whose behalf the communication has been sent has been disguised or concealed" or without "a valid address to which the recipient of the communication may send a request that such communications cease". Sources: regulation 22, regulation 23 and regulation 2, all showing "no known outstanding effects".

What the regulator says

The ICO's electronic mail guidance, updated 28 April 2026:

"You can send unsolicited electronic mail marketing to corporate subscribers without consent or a soft opt-in. You must not disguise or hide your identity in messages to either type of subscriber. You must provide a valid contact address for recipients to opt out or unsubscribe."

The rules "apply even if you only hold a generic or role-based address", and although PECR does not expressly require it, "you should comply with a corporate subscriber’s opt-out request." Sources: electronic mail guidance and business-to-business marketing; the B2B page is marked as under review after the Data (Use and Access) Act.

Corporate or individual subscriber

A company, LLP, Scottish partnership or other body corporate is a corporate subscriber, and so is an employee's work address, "because the ‘subscriber’ is their employer". But:

"Some are actually classed as individual subscribers. This includes: sole traders; certain types of partnerships (eg non-limited liability partnerships or other types of English, Welsh and Northern Irish partnerships); and other unincorporated bodies of individuals."

When unsure, "you should treat the details as belonging to an individual subscriber". A public address is not consent: "Just because someone’s contact details are publicly available, it doesn’t mean they’ve consented to your direct marketing."

LinkedIn and social media messages

The ICO does not name LinkedIn, and we found no ruling. But its guidance says electronic mail includes "direct messaging on social media (ie private messages)", and on professional networks:

"If an individual is using such a platform in their personal, albeit professional, capacity then sending them direct marketing messages is not considered B2B marketing."

Read together (our interpretation), a cold sales DM on LinkedIn should be treated as electronic mail to an individual subscriber: consent or soft opt-in, plus UK GDPR. How "subscriber" applies to a social media account is unclear.

UK GDPR and legitimate interests

If you don't know the name of the person you write to at a business, "the UK GDPR does not apply to your marketing." If you do: "If PECR does not require consent, in many cases it is likely that legitimate interests will be the appropriate lawful basis", subject to the ICO's three-part test. Since 5 February 2026, UK GDPR article 6(11) names direct marketing as an example of a legitimate interest, but not as a "recognised legitimate interest" (article 6(1)(ea)), so the balancing test still applies. Give privacy information "no later than one month from the date of collection" when the data came from elsewhere, and stop when someone objects: "You must stop using someone’s information for direct marketing if they object to you doing so." (ICO, legitimate interests; UK GDPR article 6)

Fines and real cases

For breaches of regulations 21, 22 and 23 on or after 5 February 2026, the cap is the "higher maximum amount" in section 157 of the Data Protection Act 2018: £17.5 million or 4% of total annual worldwide turnover, whichever is higher. Earlier breaches are handled under PECR as it stood, capped at £500,000 (SI 2026/82, regulation 11; section 157). The sources disagree: the regulator's own What are PECR? page, marked as under review, still says "a fine of up to £500,000". We found no decision under the new cap.

Our example is not B2B: on 11 December 2025 the ICO fined ZMLUK Limited £105,000 for a serious contravention of regulation 22, over unsolicited emails promoting energy saving products (ICO). We found no ICO fine for B2B email.

Checklist for B2B email to the UK

1. Sort leads by subscriber type. Company or LLP: no consent needed. Sole trader, ordinary partnership, personal address or unsure: consent or soft opt-in.
2. Identify yourself and include a valid opt-out address in every message.
3. Honour company opt-outs too, through one suppression list.
4. Use the soft opt-in only for contacts you collected yourself, never a bought list.
5. Document a legitimate interests assessment and send privacy information within one month.
6. Before cold calls, screen numbers against the TPS and CTPS.

How Leo handles the UK

Leo, the buying-signal agent Revexa builds, blocks only Germany automatically. For leads in the UK you read and approve every draft in review mode, so you decide whether a lead is a corporate or individual subscriber. Leo writes to each lead in the lead's own language when your website exists in that language, and in English otherwise.

Common questions

Is B2B cold email legal in the UK?

Yes, to corporate subscribers such as limited companies and LLPs, including named employees at work addresses, if you identify yourself and give a valid opt-out address. Sole traders and ordinary partnerships need consent or a soft opt-in.

Can I cold email a sole trader in the UK?

Not without consent or a soft opt-in. PECR treats sole traders and ordinary partnerships as individual subscribers, and the ICO says to treat an address as an individual's when unsure.

What is the maximum fine for breaking PECR in 2026?

For email marketing breaches from 5 February 2026, £17.5 million or 4% of worldwide turnover, whichever is higher. Earlier breaches fall under the old £500,000 cap, which the regulator's PECR overview still quotes.

Who regulates cold email in the UK now?

The Information Commission, which took over from the Information Commissioner's Office on 30 September 2026 with the same role, responsibilities and powers, according to the government.

Do the PECR rules apply to LinkedIn messages?

The ICO counts social media DMs as electronic mail and says marketing on professional networks is often not B2B. LinkedIn is not named, but we treat a cold sales DM as needing consent or a soft opt-in.