B2B Email Compliance Landscape 2026: A 44-Country Framework Analysis

Executive Summary

B2B email compliance in 2026 is more navigable than commonly perceived, but the consequences of non-compliance are materially higher than five years ago. Key findings: (1) 31 of 44 measured jurisdictions permit B2B cold email to corporate addresses on an opt-out basis — prior consent is not required; (2) 8 jurisdictions require opt-in for all commercial email (CASL Canada, SPAM Act Australia under some interpretations, several APAC markets); (3) GDPR enforcement has shifted from consumer data breaches to B2B marketing practices, with four major B2B marketing enforcement actions in 2024 to 2025; (4) The distinction between corporate addresses (B2B, lower regulatory burden) and individual/personal addresses (B2C equivalent, higher regulatory burden) is now clearly established in GDPR guidance; (5) A documented Legitimate Interest Assessment (LIA) provides a defensible compliance position in all 27 EU member states and the UK.

Tier 1: Opt-Out Frameworks (Permissive for B2B)

The United States operates under CAN-SPAM, which requires no prior consent for B2B cold email to business addresses. The obligations are: valid physical address, honest subject line, functional opt-out link, and honour opt-outs within 10 business days. California CCPA adds data handling obligations but does not change the consent requirements for cold email. The European Union operates under GDPR Article 6(1)(f) legitimate interest for B2B email to professional corporate addresses. The ePrivacy Directive (implemented as national laws across member states) permits cold email to corporate addresses on opt-out basis. PECR in the United Kingdom provides the same framework: B2B cold email to corporate addresses permitted on opt-out basis. Singapore PDPA exempts business contact information from consent requirements for B2B commercial purposes. UAE has no comprehensive data protection law as of Q3 2026, with the DIFC Data Protection Law applying only within the DIFC free zone.

Tier 2: Mixed Frameworks Requiring Assessment

Germany: GDPR applies (legitimate interest available) plus the Telecommunications Act (UWG §7) which imposes stricter requirements. Legitimate interest is available for B2B email but requires specific documentation for German DPA scrutiny. The German DPA (BfDI) has been the most active GDPR enforcer for B2B marketing. France: GDPR applies; CNIL has published B2B email guidance confirming legitimate interest is available for professional email addresses but not personal addresses. The CNIL requires that the email subject matter is related to the professional function of the recipient. Brazil LGPD: legitimate interest is available as a lawful basis, modelled on GDPR. Enforcement is handled by the ANPD; no major B2B marketing enforcement actions have been concluded as of Q3 2026. India DPDP Act: enacted but implementation regulations still pending as of Q3 2026. The current framework is not yet comprehensively enforced; monitoring for regulatory guidance is recommended.

Tier 3: Opt-In Required Frameworks

Canada (CASL): express or implied consent required for all commercial electronic messages. Implied consent exists where (a) an existing business relationship is present within the previous 24 months, or (b) the recipient conspicuously published their email in a business context and the message is relevant to that role. CASL has the highest per-violation penalty potential of any B2B email law globally ($10 million CAD maximum per violation). Australia Spam Act: inferred consent available for B2B where the email address is conspicuously published and the message is relevant to the function associated with the address. The Australian Communications and Media Authority (ACMA) has actively enforced Spam Act violations. Download the complete 44-country compliance dataset at /api/v1/compliance.json.