Is It Legal to Cold Email Candidates? What the Rules Say, and Where We Refuse to Send

Most articles about cold email law are written for sales teams emailing other companies. A recruiter emailing a candidate is often in a different position, because the address is frequently a personal inbox, and almost every set of rules treats a personal inbox differently from a work one.

So the short answer is: it depends on where the person is, and whose address you are using. This post goes through the five places our users ask about most, with the primary source for each, and then shows the rules we built into PlacementFlow so that a recruiter cannot get this wrong by accident.

Written in September 2026. This is how we read the rules and what we decided, not legal advice. Email-marketing law changes, and how it applies to a job approach is not settled everywhere. Check with your own counsel before you email a new country.

The short version

Where the candidate is	Personal inbox	Work address
United States	Allowed with CAN-SPAM's rules (we apply them either way)	Allowed with CAN-SPAM's rules
United Kingdom	Needs specific consent	Allowed to a company address, with an opt-out
EU	Depends on the country; many require prior consent	Depends on the country
Canada	Needs consent; enriched addresses cannot meet it	Needs consent; enriched addresses cannot meet it
Australia	Needs consent	Needs consent

The rest of this post is the reasoning behind each row.

United States: CAN-SPAM

CAN-SPAM covers a commercial message, which the law defines as "any electronic mail message the primary purpose of which is the commercial advertisement or promotion of a commercial product or service" (FTC compliance guide). The FTC's own answer to "does it cover my email?" is: "What matters is the "primary purpose" of the message."

Is an email offering a candidate a confidential conversation about their next role a commercial message? Reasonable people disagree, and an agency email that also sells the agency's service leans further that way. We do not bet on the answer. Every cold email we send follows CAN-SPAM's rules as if it applies:

• Honour opt-outs fast. "You must honor a recipient's opt-out request within 10 business days."
• Do not assume a business exemption. "The law makes no exception for business-to-business email."
• The cost of getting it wrong is per email. "Each separate email in violation of the CAN-SPAM Act is subject to penalties of up to $53,088".

The US is also the one place in this list where the rule is opt-out whatever the address type. That is why it is the only country where PlacementFlow emails a candidate's personal inbox.

United Kingdom: PECR

The UK rules are in PECR, and the ICO's guidance draws the line cleanly: "You must not send marketing emails or texts to individuals without specific consent." On the other side of the line: "You can email or text any corporate body (a company, Scottish partnership, limited liability partnership or government body)." (ICO guide to electronic mail marketing).

A candidate's personal Gmail is an individual. Their address at their current employer belongs to a corporate body. Contractors need care too: "Sole traders and some partnerships are treated as individuals".

EU: GDPR plus national rules

GDPR itself leaves a door open. Recital 47 says "The processing of personal data for direct marketing purposes may be regarded as carried out for a legitimate interest." (Recital 47). But two things narrow it for recruiters:

• You owe the candidate a notice, early. Where you did not collect the data from the person, Article 14 says the information is due, "if the personal data are to be used for communication with the data subject, at the latest at the time of the first communication to that data subject" (GDPR Art. 14). For a cold approach, that means the first email.
• Email marketing rules are national. GDPR sits beside each country's own rules on electronic marketing, and several EU countries require prior consent even for business email. Our own country-by-country review classed Germany, Austria, Italy and the Netherlands as consent-first, along with Switzerland outside the EU, and we block all of them.

Canada and Australia: consent first

Canada's anti-spam law lists, among the things it treats as spam, "the harvesting of addresses (collecting and/or using email or other electronic addresses without permission)" (Government of Canada). Australia's regulator is blunter: "If you plan to send marketing messages or emails, you must first have consent from the person who will receive them." (ACMA).

In both countries the route to consent without asking depends, in limited cases, on the person having published the address themselves. The addresses a sourcing tool finds are usually enriched or inferred, never published by the candidate, so that route is not open to that kind of list. We block both countries for cold email.

What we built into PlacementFlow

We did not want a recruiter to have to remember any of the above at 6pm on a Friday, so the rules are enforced by the product, not by a policy document.

1. Personal inboxes: United States only, hard-coded. A candidate sourcing campaign cannot target another country. There is no setting to change it.
2. Work addresses: a short, verified list. Business development campaigns, which email decision-makers at their company address, are limited to countries whose rules have a work-address route. The current list is in Sourcing Compliance: Geography and Confidentiality.
3. One opt-out stops everyone. An unsubscribe or a spam complaint suppresses that address across the whole platform, not just for the agency that sent the email.
4. The first email asks for nothing but a reply. No links and no phone number. If the candidate replies with interest, the next message sends a private link to a few screening questions. The email names PlacementFlow, so the sender can be checked. The agency running the search is described, not named, until the recruiter approves the candidate: a confidential search under a neutral platform identity, the way executive search has long handled confidential roles.
5. The recruiter takes over the real conversation. Once a candidate is approved, the recruiter takes over the conversation personally. How that works is in How Sourcing Campaigns Work and Reviewing Warm Replies and Handoff.

Why personal inboxes are US only: outside the US, almost every route to emailing someone without asking first is written for work addresses, a company or a person in their business role. A personal inbox never gets that route. So rather than stretch a work-address exception to cover someone's private email, we email candidates' personal inboxes in the US only, and keep the other countries for business development, where the address really is a work address.

Candidates do ask where we got their address, usually in one line sent from a phone. This is what we answer: "From your public professional profile, plus a contact-data provider we buy from. Ask and I'll tell you exactly where this address came from. If you'd rather not hear from us, say so and nobody on PlacementFlow will email you again." It is the same answer that sits on our page for candidates, and the last sentence is literal: a stop request suppresses the address across the whole platform.

A checklist before you email a candidate

• Know where they are. Location decides the rulebook, not where your agency is.
• Know whose address it is. A personal inbox and a work address are different cases almost everywhere outside the US.
• Name yourself. The sender should be checkable from the email itself.
• Make the opt-out real. One click or one reply, honoured across every campaign you run, within days, not weeks.
• Tell them where you got their details. In the EU and UK this is a legal duty from the first message; everywhere else it is the question they will ask anyway.
• Keep a list of countries you do not email, and enforce it in the tool. A rule that lives in a document gets forgotten on a busy day.

No regulator, client or email platform has complained to us so far. What we do get is stop requests, which the platform honours at once, and the occasional "where did you get my email", which is why the answer above is written down.

If you run an agency and want to email candidates in Canada or Germany anyway, I can only tell you what we do: we don't, and our tool will not let a campaign target them. Germany is off the list entirely. Canada and Australia stay blocked until an address comes with proof the person published it themselves, and a lawyer has looked at it. If you want to go further than we do, talk to that lawyer first.