Rules and ethics
Part of Cold email deliverability in the UK: what B2B senders must know
Cold email deliverability in the UK: what B2B senders must know
Cold email in the UK: PECR and UK GDPR rules, pre-send checks, opt-outs, authentication and tools to monitor deliverability.
What to take away
- PECR regulation 22 requires consent before unsolicited marketing email reaches an individual subscriber, but limited companies count as corporate subscribers and fall outside that consent rule.
- UK GDPR still applies to any named work address, so a written legitimate interests assessment and a working opt-out are the practical floor.
- Authentication, complaint rates and sending patterns decide inbox placement at UK providers far more than the wording of your first message.
- The same rules apply to recipients in Scotland, Wales and Northern Ireland, so one process should cover the whole campaign.
- Record the source, company number and last contact date for every address you keep.
Where PECR draws the line
Regulation 22 of the Privacy and Electronic Communications Regulations 2003 bans unsolicited direct marketing by electronic mail to individual subscribers without consent.
Is consent needed for this address?
Is the recipient an incorporated body?
Outside the consent rule
Individual subscriber, consent needed
Subscriber type is the whole question. A corporate subscriber is an incorporated body such as a limited company, an LLP or a plc. Sole traders and ordinary partnerships are treated as individual subscribers.
So a message to a generic address at a limited company sits outside the consent rule, while the same message to a self-employed consultant does not. The ICO's direct marketing guidance explains how it reads these categories.
The soft opt-in is available when you collect an address during a sale or negotiations for a sale, and market your own similar products or services. You must offer an opt-out when collecting the address and in every marketing message. It does not cover a purchased list.
Confirm the recipient's status before you send
Run these checks over the list before the first send, not after a complaint.
- Search the organisation in the Companies House register to see whether it is an incorporated entity or an unregistered trading name.
Pre-send list checks
- Search the organisation on Companies House
- Match email domain to registered company
- Note company number, source and date
- Treat sole traders as individual subscribers
- Add a working opt-out to every message
- Confirm the subscriber typea limited company, LLP or plc is a corporate subscriber; a sole trader or ordinary partnership is an individual subscriber. Do not decide this from whether the address is generic or names a person.
- For an individual subscriber, check for valid consent or that every soft opt-in condition is met; otherwise, do not send. For a named contact at a corporate subscriber, record your UK GDPR lawful basis and assess whether the contact is appropriate.
- If relying on legitimate interests, document the purpose, why using the data is necessary, and the balancing test, including the person's reasonable expectations and safeguards. If you obtained the address indirectly, give the required privacy information by the first communication or within one month, whichever comes first.
- Check the address against your suppression list and make sure the message identifies your organisation and provides a working way to opt out.
Why authentication outranks the copy
SPF, DKIM and DMARC are what receiving systems check first. A cold domain with no DMARC record is filtered long before anyone reads your subject line.
Send outreach from a separate domain or subdomain so a cold campaign cannot damage the reputation of your transactional mail. Our walkthrough on SPF, DKIM and DMARC setup for UK domains covers the records in plain English.
Alignment matters as much as existence. A record set to monitor only, p=none, tells a provider nothing about how to treat a message that fails authentication.
Use named tools to check the setup: Google Postmaster Tools provides Gmail-specific sending and reputation data, MXToolbox SuperTool checks DNS records such as SPF, DKIM and DMARC, and Spamhaus Reputation Checker lets you check IP or domain reputation against Spamhaus data. These checks can help diagnose issues, but none guarantees inbox placement.
What UK filtering weighs
Providers do not score one signal on its own. A new domain sending 5,000 cold messages on day one fails on pattern alone, however clean the list.
| Signal | What providers weigh | What to fix |
|---|---|---|
| Authentication | SPF, DKIM and DMARC results on your sending domain | Publish all three, then move to quarantine or reject |
| Complaints | Spam reports counted against delivered messages | Remove non-engagers and cap volume per domain |
| Engagement | Opens, replies and deletions across a cohort | Send smaller, better-targeted batches |
| Sending pattern | Sudden volume changes from a young domain | Ramp over weeks, not days |
| Content | Link reputation, tracking domains, text-to-image balance | One clear call to action and a plain text version |
| Provenance | Whether the list was bought, scraped or built | Buy nothing and keep source records |
Complaints, volume and the ramp
Google's bulk sender guidelines, published in February 2024, ask bulk senders to keep spam complaint rates below 0.1%. If 200 of 2,000 recipients mark a message as spam, the problem is targeting rather than copy.
A complaint spike can push a sending domain into a slower queue for weeks, and newer domains suffer longest.
Start small, watch replies rather than opens, and grow volume only while complaints stay flat. Our article on why UK emails land in spam covers the checks that catch this earlier.
Suppression belongs in the same routine. Unsubscribes, hard bounces and complaint addresses should sit on a list applied to every campaign before send. Include a clearly labelled unsubscribe link in every marketing email; a reply-to address that accepts a message such as “unsubscribe” is another practical option. Do not conceal the sender's identity, and provide a valid address for recipients to request that marketing stops.
Keeping a record that stands up
Note your lawful basis, the source of each address and the date of the assessment. That record is your evidence if a complaint reaches the ICO.
There is no single fixed UK GDPR retention period for prospect addresses or consent evidence. Keep them only for as long as necessary for the stated purpose, review the records and delete stale data; retain the minimum suppression information needed to prevent someone who has opted out from being contacted again.
Controllers must pay the ICO data protection fee unless an exemption applies. Check the ICO's fee self-assessment and the Data Protection (Charges and Information) Regulations 2018 to establish whether the requirement applies to your organisation.
Common questions
Is cold B2B email legal in the UK?
It can be. Marketing email to a limited company or an LLP falls outside the PECR consent rule, but UK GDPR still applies to the person you name and you must offer a clear opt-out.
Do I need consent to email a work address?
It depends on the subscriber, not the address. For example, info@company.co.uk and firstname.lastname@company.co.uk at a limited company are both corporate subscriber addresses, although the named address is personal data under UK GDPR. The same address patterns at a sole trader are individual subscriber addresses.
What damages cold email deliverability fastest?
Bought lists, a sudden jump in volume from a new domain, and missing DMARC records. All three are visible to providers before a recipient reads anything.
Should I warm up a new sending domain?
Yes. Raise daily volume across several weeks and watch complaint rates. A domain that jumps straight to thousands of messages a day is treated as suspicious.
