Where cold email is actually appropriate to send

Start with the audience, not the message

"Cold email" covers a B2B sales rep reaching a VP of Engineering, a recruiter messaging a candidate, and a consumer brand emailing a purchased list of individuals who never heard of it. The first two are established, low-risk uses of the channel. The third is where most legal and deliverability problems come from. The question to ask before writing anything is who the recipient is and what relationship, if any, they have with your business.

B2B sales outreach

This is the core legitimate use case: identifying a specific person at a specific company whose role makes your product relevant to them, and sending a short, individually-defensible message. Under GDPR, this generally relies on legitimate interest (Article 6(1)(f)) rather than consent — but legitimate interest is not a blanket excuse, it requires a documented balancing assessment weighing your interest against the recipient's rights, and some EU member states layer stricter national ePrivacy rules on top for electronic marketing to natural persons, even in a B2B role. This is not legal advice; if you're sending into the EU/EEA at volume, get a lawyer to review your legitimate-interest assessment and the relevant national ePrivacy implementation.

Recruiting and partnership outreach

Reaching a candidate about a role, or a potential partner about a specific collaboration, sits in the same low-risk category as sales outreach when it's targeted, individual, and clearly identifies who you are and why you're writing. The same CAN-SPAM and GDPR baseline applies: identify yourself honestly, don't use a deceptive subject line, and give a working way to opt out.

Event invitations and warm-adjacent contexts

Inviting someone to a webinar or event because of their public role or prior interaction with your content is still "cold" in the sense that they didn't request it, but it's closer to legitimate interest territory than a cold sales pitch, provided the invitation is relevant to their actual role.

Where it does not belong

Consumer marketing to individuals with no prior relationship and no clear legitimate interest basis is the weakest case for cold email, and in the EU/EEA it usually needs prior consent rather than legitimate interest, because the balancing test tips against the sender when the recipient is a private individual with no business context. In the US, CAN-SPAM technically permits unsolicited commercial email to consumers, but it still requires a truthful subject line, a working postal address, a functioning opt-out honored within 10 business days, and clear identification that the message is an ad if it is one. It rarely performs well regardless of legality — individual consumers report commercial mail as spam at much higher rates than a business recipient reports a relevant B2B pitch, and Google tracks a sender's spam-complaint rate directly; staying under its published 0.3% threshold gets harder the more the audience resembles "random consumer" rather than "specific professional with a reason to care."

A compliance baseline that applies regardless

What not to do

Do not treat "it's technically legal in my jurisdiction" as the only bar — a message that's legal but irrelevant to the recipient still drives spam complaints that damage every mailbox sending from your domain. Do not send the same unsegmented message to buyers, consumers, and random scraped contacts under one blanket "cold outreach" strategy. Do not skip the legitimate-interest assessment for EU contacts because it feels like paperwork; it's the actual legal basis you're relying on.

The practical test before you send

Before adding someone to a cold sequence, it's worth running a short, honest test: can you state in one sentence why this specific person, in this specific role, would plausibly want to hear from you, independent of the fact that you'd like them to buy something? If the answer only works at the company level ("they're in our target market") and not at the individual level ("they run the team that owns this problem"), the targeting is too broad for a defensible legitimate-interest basis, and it's also just weaker outreach — a recipient who doesn't fit the role-specific reasoning notices immediately that the message wasn't really about them.

Documentation is not optional busywork

A legitimate-interest assessment under GDPR isn't a form you fill in once and forget — it's meant to be a real, documented judgment that you can produce if asked: what the interest is, why it's necessary, and how you weighed it against the individual's rights and expectations. Keeping a simple record of that reasoning per campaign or per audience segment, including why cold email was an appropriate channel for that audience, is a cheap habit that matters a great deal if anyone — a regulator, a complainant, or your own legal team — ever asks you to show your work.

Where MailPilot fits

Whatever audience you're targeting, the deliverability consequences of getting the context wrong show up the same way: rising spam complaints and falling placement. MailPilot tracks per-mailbox reputation daily and measures real inbox placement per provider, so you can see a relevance problem in the data before it costs you a domain.