Cold email

What it means

A cold email is a sales message sent to someone who has had no previous contact with the sender and has not consented to receive it. It is used mainly in selling to businesses, where a salesperson approaches a potential customer with an offer or a request for a meeting. Unlike bulk email marketing, it is more of an individual approach to a small number of recipients.

Legally, cold email is assessed under two sets of rules. The electronic communications rules govern when unsolicited commercial messages may be sent and generally require prior consent, with narrow exceptions for existing customers. The GDPR governs the processing of personal data, which includes an individual's email address.

Contacting a company at a generic address such as info@ is assessed differently from emailing a named individual. Interpretation of the rules for business recipients is not uniform across the EU, and Slovak practice tends to be strict. Before launching a campaign it is therefore worth assessing the specific case.

How it works in practice

If a company decides to send cold emails to businesses, it should have a documented legal basis, most often legitimate interest with an assessment that it does not override the recipient's rights. The message must clearly state the sender, the reason for contact, the source of the address and an easy way to refuse further messages. Opt-outs must be honoured immediately.

Cold email works through relevance. Instead of blasting purchased lists, a small number of well-chosen companies with a personalised message addressing their specific problem works better. The aim is a conversation or a lead, not an instant sale. Purchased databases also often breach the GDPR.

For consumers, the safer route is building your own list with consent, ideally through double opt-in, where the person confirms sign-up by clicking a link in an email. Such a list is legally clean and has better deliverability and higher open rates than any cold outreach.

What to watch out for

The biggest risk is bought or automatically harvested address lists. The company cannot show where the contacts came from, and mailing them may breach both the GDPR and the rules on unsolicited communications. Fines, complaints and damage to the domain's reputation follow, hurting delivery of ordinary emails too.

The technical side matters as much. Bulk sending from the main company domain without SPF, DKIM and DMARC records set up sends emails to spam and gets the domain blacklisted. A separate subdomain, gradual volume increases and monitoring of complaint rates are recommended.