# Is Cold Email Legal in Russia?

Cold email in Russia cannot be treated as automatically legal just because it is B2B. If a message promotes your services or uses data that identifies a person, you need a documented legal basis, a clear way to stop contact and a process that can prove both. A company email address alone is not blanket permission to send offers.

## Why cold email cannot be labelled legal in advance

A single campaign may fall under both advertising rules and personal-data rules. An invitation to buy, request a quote or book a meeting will usually have a promotional purpose. And a work address combined with a name and job title can identify a specific person, so it is not merely an anonymous company record.

A neutral subject line does not remove this risk. Calling a message a “business proposal” changes little if it promotes a service and the recipient asks where their data came from. If you cannot explain the basis for contact, the record of consent where required, and the removal route, the dispute is about missing controls rather than wording.

The line between a personal business contact and a general corporate inbox depends on the data and the circumstances. For uncertain segments, obtain a legal review before launch rather than relying on a sales-team assumption.

## What a provider should be able to show before launch

Do not accept a general promise of compliance. Check the documents and operating process: who determines the purpose of processing, who acts on instructions, where recipient requests are recorded, and who is responsible for deletion. Align these points with your own [privacy policy](/en/privacy/) and contract documents.

| What to check | Sign of a working process | Red flag |
|---|---|---|
| Basis for contact | It is defined for each recipient category | A generic claim that the contact was publicly available |
| Do-not-contact requests | One exclusion list and a named owner | Opt-outs remain only in an individual manager’s inbox |
| Data transfer | Access, retention and deletion are defined | Lists are passed between contractors without rules |
| Outreach copy | Its promotional nature and claims have been reviewed | The email promises something that cannot be substantiated |

- Document the campaign purpose and recipient categories.
- Define the basis for processing each contact set.
- Agree how requests for deletion will be handled.
- Assign a client representative for disputed requests.
- Review the contract, processing instructions and CRM access.

## How to review a list without creating a legal weakness

Start with a simple question: why is each record needed? A company name, a shared departmental inbox and a named employee’s contact details require different treatment. Do not combine them into one file and assume they are equally suitable for promotion. Review whether the role is current, whether the contact is relevant to the task and whether any additional data needs to be retained.

- Identify the data genuinely needed for the business contact.
- Separate shared corporate details from named employees’ data.
- Exclude people who have already asked not to be contacted.
- Set retention periods, access rights and deletion steps.
- Pass only a reviewed and documented list into the campaign.

A common mistake is adding new records to an old CRM export and sending the combined file to a provider without status markers. It may contain former employees, personal addresses or people who previously asked not to hear from you. [List verification](/en/services/list-verification/) is not only about delivery: it also reduces the number of contacts that should not enter communication at all.

## What must happen after a recipient opts out

An opt-out is not an objection to overcome. “Delete my address” or “do not contact me again” should trigger a short process: record the request, stop future touches, update exclusions across every relevant system and confirm the outcome where appropriate. Do not promise deletion while retaining the contact in a reserve spreadsheet for a later campaign.

For example, a director may reply that they are not interested. If a manager treats this as an ordinary no and does not record it, another colleague may send a new offer a month later. To the recipient, that is evidence of poor control, not two isolated emails. A sound process distinguishes an opt-out from silence and makes the status available to everyone handling replies, including a [reply-handling team](/en/services/reply-handling/).

An unsubscribe link is useful, but it does not replace handling a free-form reply. The stop request must take effect regardless of how the recipient expresses it.

## When cold outreach is not the right route

Do not build a cold campaign if the product needs extensive explanation before its value is clear, the offer targets a broad consumer audience, or your team cannot handle requests quickly and accurately. It is also a poor fit when the only plan is to send identical promotional copy to a large list and expect recipients to infer its relevance.

For complex B2B sales, first decide which companies genuinely fit your task and who inside them can appropriately receive the conversation. In focused cases, [account-based marketing](/en/services/account-based-marketing/) is a better fit: value comes from a reasoned selection of a limited account list, not contact volume.

OT9 does not replace legal advice with a generic checklist. In [full-service outreach](/en/services/full-service-outreach/), we review the task, data boundaries, contact logic and opt-out handling; where legal risk is elevated, involve your specialist legal counsel before launch.

## Frequently asked questions

**Can I email a shared company address without consent?**

A shared address is not automatic permission to send promotional messages. Assess the inbox purpose, the content of the email and the requirements that apply to the campaign. If the address is tied to a specific person or used for promotion, the risk still needs to be addressed.

**Is an unsubscribe link enough?**

No. It gives a recipient one way to refuse, but it does not itself create a basis for the initial promotional contact. A request to delete data or stop emails must be processed even when it arrives as a normal reply.

**If an email address is published on a website, may I use it for outreach?**

Public availability is not the same as consent to receive offers. A company may publish an address for customers, suppliers or job applicants rather than third-party promotion. The reason it was published and your intended use need to be considered separately.

**Who is responsible when an agency sends the emails?**

Passing a list to an agency does not remove responsibility by itself. Client and provider should define their roles, instructions, access rights and response process before launch. These arrangements should exist in the documents and in day-to-day operations.

**What is the fine for sending email without consent in Russia?**

Consequences depend on the type of violation, the facts and the current version of the law, so a generic figure from search results is not a sound basis for a decision. Address the underlying risk before launch: unsupported consent, unnecessary data, missing opt-out records or unclear responsibilities. For a specific situation, seek advice from qualified legal counsel.

---
Source: https://ot9.ru/en/guides/cold-email-legality-russia/ · OT9 (KAP Group) · updated 2026-08-10