This page is not legal advice: how to read a cold-email rule.

Start from the official text, not from a blog summary. This is not legal advice.

Start from the official text, not from a blog summary. This is not legal advice. For the UK, use the ICO's guidance on electronic mail and PECR, and the UK GDPR where personal data is involved. For the United States, the FTC publishes the CAN-SPAM rule. If you cannot point at why this person may be contacted, do not send.

Read the rule, then the record

This is not legal advice. For the UK, the ICO's guidance on electronic mail and PECR is the place to start, and the UK GDPR text where personal data is involved. For the United States, the FTC publishes the CAN-SPAM rule. Those pages are the source.

Before a send, you want a record of why this person can be mailed, and a way to stop. If you cannot point at that record, do not send and sort the argument out afterwards.

What the file should hold

A spreadsheet of email addresses is not this record. These are the lines that make a later question answerable.

This is not legal advice. It is the minimum the file needs so a later question has an answer you can point at.

• The date the address was added, and the source.
• The consent, or the legitimate-interest note you are relying on.
• The suppression, the date, and who actioned it, when someone says stop.
• A working way to refuse the next message, in the message itself.

What to keep

Keep the date, the list source, the consent or the legitimate-interest note you are relying on, and the suppression when someone says stop. A spreadsheet that only has email addresses is not that record.

Unsubscribe and complaint handling are part of the send, not a footer you add once the campaign is already out. A message that cannot be refused will be marked as spam, and the mailbox provider will treat the next one the same way.

The record comes before the send

This is not legal advice. The ICO's guidance on electronic mail and PECR, the UK GDPR where personal data is involved, and the FTC's CAN-SPAM rule are the pages to read. A summary on a blog is not those pages.

Before a send, you want a note of why this person may be contacted, where the address came from, and a way for them to stop. If you cannot point at that note, do not send and settle the argument afterwards.

If the record is missing, the send waits

This is not legal advice. The official pages are the source, and a blog summary is not a substitute for reading them. What you can do today is refuse to send when you cannot point at why this person may be contacted, or at how they stop.

Write the suppression the day they ask. A stop that lives in someone's inbox, and not on the list, is how the same address gets the next campaign.