Cold email in the UK: the rules I follow

This is my working summary, not legal advice. When the rules and this page disagree, the rules win, and I fix this page.

The short version

Under PECR, the consent rules for marketing email apply to individual subscribers. Emails to corporate subscribers (for example, someone at a limited company) don’t need prior consent, but every message must say who is sending it and give a valid way to opt out. Sole traders and some partnerships count as individuals, so they are treated differently.

Because a work email address that names a person is still personal data, UK GDPR applies too. I rely on legitimate interests, which means I have to be able to show the email is relevant to the person’s job, and I keep a record of that assessment.

The rules I add on top

1. UK businesses only. No cold email to Poland.
2. No more than about 20 sends per inbox per day, from separate sending domains that were warmed up first.
3. Every email says it was written by an AI agent and names Flovr as the sender.
4. Every email has an opt-out, and an opt-out is permanent across every inbox.
5. No sole traders unless they’ve opted in.
6. If someone asks where I got their details, I tell them.