Home › Compliance
Email Compliance by Country — 2026
Quick answer
Cold email legality for all 74 tracked markets: each country page states the governing law, the B2B consent basis, the sender checklist, and how the regime correlates with campaign benchmarks. Framework deep-dives: GDPR, CAN-SPAM, CASL, PECR, LGPD, Singapore PDPA. General information, not legal advice.
No major jurisdiction bans B2B cold email outright — regimes differ on consent basis and mechanics, from the US's opt-out CAN-SPAM model to consent-first regimes like CASL and South Korea's Network Act, per B2B Data Index (2026).
#Framework deep-dives
| Framework | Scope | Guide |
|---|---|---|
| GDPR | All processing of EU residents' personal data | GDPR explained |
| CAN-SPAM | All commercial email to US recipients, B2B and B2C alike | CAN-SPAM explained |
| CASL | Commercial electronic messages sent to or from Canada | CASL explained |
| PECR | Electronic marketing to UK recipients, alongside UK GDPR | PECR explained |
| LGPD | Processing of personal data in Brazil or of Brazilian residents | LGPD explained |
| PDPA (Singapore) | Personal data processing and bulk commercial messaging in Singapore | PDPA (Singapore) explained |
All 74 countries
Permissive tier (17)
| Country | Governing law | B2B basis | Guide |
|---|---|---|---|
| United States | CAN-SPAM Act | Opt-out | United States guide |
| India | DPDP Act 2023 | No dedicated spam statute; data-protection duties apply | India guide |
| Singapore | PDPA + Spam Control Act | Opt-out for business contact information | Singapore guide |
| UAE | Federal Data Protection Law (2021) | Consent-oriented with business practice accommodations | UAE guide |
| Nigeria | NDPA 2023 | Legal basis with legitimate interest | Nigeria guide |
| Indonesia | PDP Law 2022 | Consent-oriented, implementing | Indonesia guide |
| Egypt | PDPL 2020 | Consent-oriented, implementing | Egypt guide |
| Kuwait | DPPR (CITRA) | Regulatory framework via CITRA | Kuwait guide |
| Vietnam | Decree 13/2023 (PDPD) | Consent-centric | Vietnam guide |
| Pakistan | PECA + draft PDPB | Limited dedicated enforcement | Pakistan guide |
| Bangladesh | Draft/limited framework | No dedicated regime enforced | Bangladesh guide |
| Bahrain | PDPL 2018 | GDPR-influenced | Bahrain guide |
| Oman | PDPL 2022 | Consent-oriented | Oman guide |
| Lebanon | E-transactions Law 81/2018 | Basic framework | Lebanon guide |
| Ghana | Data Protection Act 2012 | Registration + opt-out oriented | Ghana guide |
| Sri Lanka | PDPA 2022 | GDPR-pattern, phasing in | Sri Lanka guide |
| Togo | General data-protection framework | Tier-based practice | Togo guide |
Moderate tier (32)
| Country | Governing law | B2B basis | Guide |
|---|---|---|---|
| Australia | Spam Act 2003 | Express or inferred consent | Australia guide |
| Israel | Communications Law Amendment 40 | Opt-in with B2B accommodations | Israel guide |
| Brazil | LGPD | Legal basis required (legitimate interest available) | Brazil guide |
| Mexico | LFPDPPP | Notice and opt-out oriented | Mexico guide |
| Switzerland | FADP (revised) + UCA | Consent or established relationship; strict on bulk | Switzerland guide |
| Saudi Arabia | PDPL | Consent-oriented with business accommodations | Saudi Arabia guide |
| South Africa | POPIA | Opt-in for direct marketing with one-approach allowance | South Africa guide |
| Turkey | KVKK + Electronic Commerce Law | Opt-in via IYS registry | Turkey guide |
| Poland | GDPR + national ePrivacy implementation | Legitimate interest for B2B (varies by national transposition) | Poland guide |
| Hong Kong | PDPO + UEMO | Opt-out with mandatory unsubscribe | Hong Kong guide |
| New Zealand | Unsolicited Electronic Messages Act 2007 | Express, inferred, or deemed consent | New Zealand guide |
| Malaysia | PDPA 2010 | Notice-based with opt-out | Malaysia guide |
| Philippines | Data Privacy Act 2012 | Legal basis with legitimate interest | Philippines guide |
| Thailand | PDPA 2019 | Legal basis with legitimate interest | Thailand guide |
| Argentina | PDPA Law 25.326 | Opt-out with registry | Argentina guide |
| Czech Republic | GDPR + national ePrivacy implementation | Legitimate interest for B2B (varies by national transposition) | Czech Republic guide |
| Qatar | PDPPL | Consent-oriented | Qatar guide |
| Chile | Law 21.719 (2024 reform) | Modernized GDPR-pattern | Chile guide |
| Peru | Law 29733 | Consent-oriented | Peru guide |
| Greece | GDPR + national ePrivacy implementation | Legitimate interest for B2B (varies by national transposition) | Greece guide |
| Romania | GDPR + national ePrivacy implementation | Legitimate interest for B2B (varies by national transposition) | Romania guide |
| Hungary | GDPR + national ePrivacy implementation | Legitimate interest for B2B (varies by national transposition) | Hungary guide |
| Morocco | Law 09-08 | Notice and consent oriented | Morocco guide |
| Croatia | GDPR + national ePrivacy implementation | Legitimate interest for B2B (varies by national transposition) | Croatia guide |
| Cyprus | GDPR + national ePrivacy implementation | Legitimate interest for B2B (varies by national transposition) | Cyprus guide |
| Serbia | Data Protection Law (GDPR-modeled) | GDPR-pattern | Serbia guide |
| Ukraine | Data protection law (EU-aligned reform) | Consent-oriented, evolving | Ukraine guide |
| Malta | GDPR + national ePrivacy implementation | Legitimate interest for B2B (varies by national transposition) | Malta guide |
| Slovenia | GDPR + national ePrivacy implementation | Legitimate interest for B2B (varies by national transposition) | Slovenia guide |
| Montenegro | Data protection law (EU-accession alignment) | GDPR-pattern | Montenegro guide |
| Bulgaria | GDPR + national ePrivacy implementation | Legitimate interest for B2B (varies by national transposition) | Bulgaria guide |
| Belarus | Personal Data Law (2021) | Consent-centric | Belarus guide |
Strict tier (25)
| Country | Governing law | B2B basis | Guide |
|---|---|---|---|
| United Kingdom | PECR + UK GDPR | Opt-out for corporate subscribers | United Kingdom guide |
| Germany | GDPR + national ePrivacy implementation | Legitimate interest for B2B (varies by national transposition) | Germany guide |
| France | GDPR + national ePrivacy implementation | Legitimate interest for B2B (varies by national transposition) | France guide |
| Canada | CASL | Express or implied consent | Canada guide |
| Japan | Act on Specified Commercial Transactions / Anti-Spam Law | Opt-in with B2B accommodations | Japan guide |
| Netherlands | GDPR + national ePrivacy implementation | Legitimate interest for B2B (varies by national transposition) | Netherlands guide |
| Sweden | GDPR + national ePrivacy implementation | Legitimate interest for B2B (varies by national transposition) | Sweden guide |
| South Korea | Network Act | Opt-in, strictly enforced | South Korea guide |
| Ireland | GDPR + national ePrivacy implementation | Legitimate interest for B2B (varies by national transposition) | Ireland guide |
| China | PIPL + email measures | Opt-in, strict | China guide |
| Denmark | GDPR + national ePrivacy implementation | Legitimate interest for B2B (varies by national transposition) | Denmark guide |
| Norway | Marketing Control Act | Opt-in for individuals; B2B role addresses workable | Norway guide |
| Finland | GDPR + national ePrivacy implementation | Legitimate interest for B2B (varies by national transposition) | Finland guide |
| Spain | GDPR + national ePrivacy implementation | Legitimate interest for B2B (varies by national transposition) | Spain guide |
| Italy | GDPR + national ePrivacy implementation | Legitimate interest for B2B (varies by national transposition) | Italy guide |
| Belgium | GDPR + national ePrivacy implementation | Legitimate interest for B2B (varies by national transposition) | Belgium guide |
| Austria | GDPR + national ePrivacy implementation | Legitimate interest for B2B (varies by national transposition) | Austria guide |
| Portugal | GDPR + national ePrivacy implementation | Legitimate interest for B2B (varies by national transposition) | Portugal guide |
| Colombia | Law 1581/2012 | Consent-oriented with SIC enforcement | Colombia guide |
| Russia | Federal Law on Personal Data + Advertising Law | Consent required | Russia guide |
| Estonia | GDPR + national ePrivacy implementation | Legitimate interest for B2B (varies by national transposition) | Estonia guide |
| Latvia | GDPR + national ePrivacy implementation | Legitimate interest for B2B (varies by national transposition) | Latvia guide |
| Lithuania | GDPR + national ePrivacy implementation | Legitimate interest for B2B (varies by national transposition) | Lithuania guide |
| Luxembourg | GDPR + national ePrivacy implementation | Legitimate interest for B2B (varies by national transposition) | Luxembourg guide |
| Iceland | EEA implementation | GDPR-aligned via EEA | Iceland guide |
The layer no country page covers
Since 2024, Google and Yahoo require bulk senders to authenticate with SPF, DKIM, and DMARC and to keep spam-report rates below 0.3%. These technical requirements attach to the receiving inboxes regardless of sender or recipient country — the deliverability guides are the companion to every page above.
Country-specific verified data
LeadsBlue lists 281 ready-made email databases across 122 country business lists, 63 consumer lists, and 96 targeted segments, sold as one-time purchases with no subscription.
Browse by country on LeadsBlueFrequently asked questions
Is it legal to buy email lists?
Purchasing contact data is legal in virtually every jurisdiction; the regulated act is the outreach. Each country page states the governing law and consent basis; the universal duties — identification, honored opt-outs, documented basis — apply everywhere.
Which countries are strictest for cold email?
The strict tier (United Kingdom, Germany, France, Canada, Japan, Netherlands and others) applies consent-first or competition-law standards. Strict markets consistently pair lower raw metrics with lower competition — the trade disciplined senders exploit.
Is this legal advice?
No — general information summarizing publicly known frameworks. Laws change and application is fact-specific; use qualified local counsel for decisions, especially at volume.
Cite this page
APA
B2B Data Index Research Team. (2026). Email Marketing Laws by Country (2026): Cold Email Compliance for 74 Markets. B2B Data Index. https://b2bdataindex.com/compliance/
Markdown
[Email Marketing Laws by Country (2026): Cold Email Compliance for 74 Markets](https://b2bdataindex.com/compliance/) — B2B Data Index, 2026