Can you email a business you have never spoken to?

"Is cold email legal?" has no single answer, and that is why so much advice about it is wrong in both directions — either "GDPR banned it" or "B2B is exempt". Neither is true.

Two different rules apply, and which one applies depends on who the subscriber is, not on whether the message feels like marketing.

The line that actually matters

A corporate subscriber — a limited company, an LLP, a public body — may receive unsolicited marketing email in the UK. The lawful basis is legitimate interests, and it comes with conditions: identify yourself, offer an opt-out, and honour an objection immediately.

An individual subscriber — a consumer, and also a sole trader or an unincorporated partnership — needs consent, or the narrow PECR soft opt-in that applies when they previously enquired or bought and were told at that point.

So info@acmeplumbing.co.uk at Acme Plumbing Ltd is mailable. dave@gmail.com is not, on no record. And dave@daveplumbing.co.uk, if Dave is a sole trader, is an individual subscriber on his own domain.

The part no software can fix, said out loud

No email address tells you whether the business behind it is incorporated.

That is a real gap, and the honest thing is to carry it rather than paper over it. Every corporate verdict here travels with that caveat, because the alternative — treating every business-looking domain as a company — is how a sole trader receives mail nobody had a basis to send.

The practical answer is a register lookup for anything you plan to mail at volume, and a lower threshold of certainty for a sole trader's domain than a limited company's.

The named person is two questions, not one

A named individual at a company is both a corporate subscriber for PECR and personal data for UK GDPR. So the PECR question is "may I send this", and the GDPR question is "what is my basis for processing their name and address".

The answer to the second is legitimate interests, and legitimate interests is not a box to tick — it is an assessment: purpose, necessity, balance. Written down, available if asked.

The platform writes it from what it actually holds, and fails it when provenance or purpose is missing. A form filled in with plausible sentences would be worse than no form, because it would look like compliance while recording nothing true.

What a harvested contact has to carry

Thirteen recorded fields per address, 12 verification checks producing a risk score and a bounce probability, and 12 pre-send checks where one failure blocks the send outright.

And the engine is compliance-first by construction rather than by configuration: 29 prohibited categories never produce a contact at all, and four source types are refused as sources. It is not an "extract every email" tool, and it does not pretend that a bigger list is a better one.

Why blocking rather than warning

A list that is compliant when it is built is not necessarily compliant when it is used — somebody objects, somebody leaves the company, a record ages past the point where it says anything current. So the gate runs at build, at export and at send, three times.

The alternative is the normal industry behaviour: a warning in the interface and a send button next to it.

Where the free half fits

None of this requires buying data. A company's own site usually publishes the address, and the crawl reads it for no key and no credit — including following a Facebook or LinkedIn page to the company's real website. Lawful basis and cost are separate questions, and the cheap answer is also usually the better-documented one.

The question to ask

Before any list goes out: for each row, what kind of subscriber is this, and what is my basis?

If a tool cannot answer that per row, it is not a compliance feature. It is a volume feature with a compliance page.