Outreach

Cold outreach rules for founders: what you may send, and to whom

Some sections describe the law in Germany (as of August 2026). General information, not legal advice. Other countries regulate this differently.

Cold outreach is legal, but the rules follow the channel and the recipient's location, not your intent. In the United States, email to strangers is allowed with an honest sender, a postal address and a working opt-out; calls need a registry check; text messages need express consent. In the EU, a marketing email needs prior consent even towards businesses, and LinkedIn or WhatsApp messages count as email. Post and turning up in person are open almost everywhere. Record where every address came from, and act on a no across all channels at once.

The channel decides, not your intent

Almost every founder asks the question the same way: am I allowed to contact people who have not asked me to? The answer never depends on how polite the message is or how relevant the offer feels. It depends on two things you do not choose: which channel you use, and where the recipient sits. The same sentence can be perfectly lawful as a letter and an offence as a message on a professional network.

The second, quieter price is the one that catches people out. The visible cost of getting it wrong is the fine. The invisible one is the sending domain: a young domain that collects complaints and bounces gets filtered, and then the emails to people who did want to hear from you stop arriving as well. That damage is slow, silent and much harder to undo than a letter from a lawyer.

How much freedom each route leaves

Email to strangers

Allowed with rules

No prior consent is required in the United States, but the sender, the subject line and the postal address have to be honest, and the opt-out has to work and be honoured within ten business days.

Message through networks and messengers

Platform terms decide

Federal email law does not cover these, but the platform's own terms usually do, and text messages fall under the far stricter telephone rules. A messenger message is not the safe alternative it looks like.

Call to consumers

Registry and consent apply

You have to check the national do-not-call registry, keep your own suppression list, and stop at once when asked. Automated dialling and pre-recorded voices need express written consent on top of that.

Call to businesses

Largely open

Business lines are outside most of the registry rules, but the automated-dialling restrictions and a number of state laws still apply. The person who says stop has to be recorded as stopped.

Letter by post

Open without groundwork

The channel with the fewest rules almost everywhere, in the United States and in Europe alike. Slow and not free, which is exactly why it is the one nobody has ruined.

Choose the channel first, then build the list. Doing it the other way round is how founders end up with data they may not use.

The bars illustrate how much room a channel leaves before the first contact, they are not measured data. They describe the position in the United States; the section further down sets out how the same channels look in the EU and the UK.

Two bodies of law, both at once

Most confusion about cold outreach comes from mixing the two up. They ask different questions, and passing one does not settle the other.

The marketing rules

May you approach this person in this way?

Federal and state marketing law governs the contact itself. It does not ask where you got the address, it asks whether this way of reaching out is acceptable. It is channel-specific: email, telephone, text message and post are each governed differently.

Breaking these rules brings a regulator, a carrier block or a private lawsuit, depending on the channel.

The data rules

May you process this person's data at all?

Where your recipient sits in the EU or the UK, a second body of law applies before you send anything: it starts the moment you put a name and an address into a spreadsheet. It requires a documented reason, a balancing of interests and a notice to the person about where their data came from.

Breaking these rules brings a complaint to a supervisory authority and a fine measured against worldwide turnover.

Five routes, five sets of rules

The position in the United States, with the limit that trips founders up most often in each row.

Route	Consumers	Businesses	Limit
Email	Allowed with rules	Allowed with rules	Honest sender and subject, a real postal address, a working opt-out honoured within ten business days. In the EU and the UK the same email needs consent or a corporate recipient.
Telephone	Registry check first	Largely open	Automated dialling and pre-recorded messages need express written consent whoever you call. Several states add their own rules on top.
Text message	Express consent	Express consent	Treated as a call, not as an email, and the registry now covers it. The strictest of all the channels in the United States.
Letter by post	Open	Open	Almost no federal restriction. In the EU it needs a documented balancing of interests and a notice about where the data came from.
In person	Open	Open	The freest route there is, and the only one where you find out immediately whether you are intruding.

General orientation, not legal advice. Rules follow the recipient's location, and several states add requirements of their own. Check what applies where the people on your list actually sit.

The route that needs none of these rules: getting your first 10 customers, one at a time →

How that confirmation link comes about, and what has to be kept from it: building an email list, signup, proof, deliverability →

The presumption that opens the business call

Calling a business is the one cold channel that European law leaves open without prior agreement, and it opens only under three conditions at the same time. They are worth knowing even outside Europe, because they describe what separates a call people take from a call people report.

1A factual connection to their business

Your offer has to relate to how the company earns its money. A mobile bike repair service may call a bicycle courier firm. The same workshop may not call an accountancy practice merely because people who own bikes work there.

2The right person

The call has to reach the person who decides on this specific purchase. Calling a switchboard to be passed around is not a call to the decision-maker, it is an interruption of three people on the way to one.

3A proportionate form

It has to be plausible from the recipient's point of view that they would want to hear this offer now. That presumption carries a short, specific call. It does not carry two hundred sequential calls from a trade directory.

The exception for people who already bought

Both in Europe and, in a looser form, elsewhere, there is one way to email people without asking first: they have already bought from you. It is narrow, and all four conditions have to hold at the same time.

The address came from a sale

You obtained it in connection with selling something, not from a prize draw, not from an enquiry that went nowhere, and not from a business card.

You are advertising something similar

It has to be your own comparable service. A bike repair business may advertise a service check, not an insurance policy it happens to broker on the side.

The notice was there from the start

When the address was collected and in every message since, the right to object has to be pointed out clearly and free of charge.

Nobody objected

The moment someone objects, the exception ends immediately and permanently. An objection does not expire with time.

This is the narrowest of all the doors and the one most often held open too wide. An enquiry that never became a sale does not count, and neither does a different service you also happen to offer.

In five steps to outreach you can defend

The order matters more than the effort. Four of the five steps cost minutes; the one that costs real time is the only one that produces customers.

Pick the channel before you build the list

10 minutes

Look at the table above and see which route to your group is open without groundwork. For consumers that is post and turning up in person; for businesses the telephone as well. Ask this after collecting addresses and you have often researched for the wrong channel.

A channel where the first approach is allowed, instead of a list you are not permitted to use.

Record where every address came from

1 minute per entry

One column in your spreadsheet saying where the name and contact details came from: company website, public register, trade directory, a conversation. In a dispute that column is the difference between an explanation and a shrug.

A list whose origin you can evidence at any time.

Set up the mandatory parts once, properly

30 minutes, one off

Every approach says who you are and how you can be reached, states in one sentence where you got the details, and carries a way to object. On a call, your own visible number is part of that.

A template you do not have to think through again at every contact.

Approach people one at a time, with a visible reason

20 minutes per contact

The first sentence says why this company in particular. That is not a courtesy, it is the very justification the presumption of interest rests on. If you cannot state the connection in one sentence, you do not have one.

Contacts whose legality you can justify if you are ever asked.

Act on an objection at once, across all channels

5 minutes per case

A no goes straight into a permanent suppression list, for every route. Someone who objects by email and gets a call two weeks later has been turned from a closed matter into a case.

A suppression list that still holds when you research the same address again a year later.

Where cold outreach sits among the other routes: marketing channels for founders, which channel for which audience →

What applies outside the United States

The rules follow the recipient, which means one list with addresses in three regions is governed by three sets of rules at the same time. The safest approach for a mixed list is to run the strictest one for everyone.

Region	Email	Telephone	Worth knowing
United States	No prior consent, but honest sender, postal address and a working opt-out	Check the national registry, automated dialling only with written consent	The freest of the three regimes on email and the strictest on text messages. Since 2025 a revocation has to be accepted through any reasonable method and applied across channels within ten business days.
United Kingdom	Free towards incorporated companies and public bodies, consent towards sole traders	Check the preference register, otherwise permitted	The line runs between a company and a natural person, not between private and business. The maximum fine was raised in 2025 to 17.5 million pounds or 4 percent of worldwide turnover.
Germany and the EU	Consent, towards businesses as well	Consumers: express consent. Businesses: a presumed interest is enough	The strictest of the three. Messages through professional networks and messengers count as email there, which is where most cold outreach from abroad goes wrong.

State of August 2026. General orientation, not legal advice; the details move, and the EU rules in particular are interpreted differently between member states.

What it costs when it goes wrong

These are the ceilings the law allows, not what a first offence by a solo founder typically produces. They are worth knowing because they explain why the topic is taken seriously, not because they describe your likely Tuesday.

Statutory maxima

Federal email law, per emailabout $46,500

Telephone rules, per call$500

Telephone rules, per wilful call$1,500

UK marketing rules, since 2025£17.5m or 4%

Germany, unlawful advertising call€300,000

In practice the cheaper outcome is the more common one, and the expensive part is rarely the fine. It is the week you spend on the matter instead of on customers, and the sending domain you have to rebuild trust for. Both are avoidable by writing to fewer people with more care.

Maxima under the relevant acts, state of August 2026. General orientation, not legal advice.

Five mistakes that turn outreach into a case

Each of them feels like a shortcut. Each of them is the reason the topic has a reputation it did not need.

Using a bought address list. The seller routinely promises that consent is on file. You are the one who has to evidence it, and someone else's tick in someone else's database is not evidence.

Treating a business card from a trade fair as consent. It documents a conversation, not agreement to be marketed to. Used as a licence, it leaves you with neither consent nor proof of it.

Reading a newsletter sign-up as permission to make sales calls. Consent covers the channel and the purpose it was given for, and nothing beyond that.

Withholding your own number to protect the pick-up rate. In much of Europe that is a separate offence with its own fine, quite apart from whether the call itself was allowed.

Acting on an objection only in the channel it arrived in. A no applies to every route and it does not expire, even when the same address turns up in your spreadsheet months later through a different source.

Frequently asked questions

Is cold outreach legal?

In the United States, yes, with conditions that differ sharply by channel. Cold email is allowed without prior consent as long as the sender and subject are honest, a real postal address is included and the opt-out works. Cold calling requires a check against the national do-not-call registry. Text messages need express consent and are the strictest channel of all.

Does the same apply if my recipient is in Europe?

No, and this is the trap. The rules follow the recipient's location, not yours. In the EU a marketing email needs prior express consent even towards businesses, and messages through LinkedIn or WhatsApp are treated as email. In the UK the line is different again: email to an incorporated company is free, email to a sole trader needs consent.

Does a business card from a trade fair count as consent?

No. It documents that a conversation happened, nothing more. Where consent is required, you need an express and documented agreement from that conversation, and even that is hard to evidence in a dispute. A sign-up link the person clicks themselves afterwards is far safer.

Can I buy a list of email addresses?

You can, and it is the fastest way into trouble. Sellers routinely claim consent is on file, but the obligation to evidence it sits with you, not with them. Bought lists also carry high bounce rates, which is what gets a young sending domain blocked. The addresses you research yourself are fewer and worth more.

What does a violation cost?

Under federal email law, penalties reach roughly 46,500 dollars per email. Telephone violations carry 500 dollars each and 1,500 dollars where wilful, which is why a single mishandled calling campaign can become a class action. In the UK the maximum was raised in 2025 to 17.5 million pounds or 4 percent of worldwide turnover.