If you’re a UK B2B company weighing up cold email against direct mail, there’s a legal angle that rarely makes it into the “which channel converts better” conversation: cold B2B email in the UK is regulated, and most companies sending it are already in breach without realising. Letters, by contrast, sit almost entirely outside that regime.
This isn’t a scare piece — plenty of companies run cold email outreach every day without consequence. But “without consequence so far” and “compliant” aren’t the same thing, and the gap between them is worth understanding before you build an entire pipeline on it.
What PECR Actually Says About Cold Email
The Privacy and Electronic Communications Regulations (PECR) sit alongside UK GDPR and specifically govern electronic marketing — email, SMS, and automated calls. For B2B email, the rules are more permissive than for consumers, but there’s a real line:
- You generally need the recipient’s corporate email address (role-based, like
info@or a named work email tied to their job), not personal data scraped from somewhere unrelated to the business relationship. - The message must give a clear, easy way to opt out, and you must honour opt-outs promptly.
- You must not disguise or conceal your identity, and you must give a valid contact address.
- Buying or scraping a list without a lawful basis for processing those individuals’ data is where most of the actual legal exposure lives — this is a UK GDPR issue layered on top of the PECR one.
In practice, a huge amount of cold B2B email sent in the UK — bought lists, scraped LinkedIn data, no clear opt-out — sits in a legal grey zone at best. The ICO doesn’t pursue every breach, but enforcement has been increasing, and the reputational cost of a complaint (even an unenforced one) is often worse than the fine.
Regulatory exposure by channel
Addressed mail falls outside PECR entirely — it isn't an electronic communication
Why Letters Sit (Mostly) Outside This
PECR regulates electronic marketing specifically. Addressed physical mail isn’t an electronic communication, so the consent and opt-out machinery that applies to email and SMS simply doesn’t apply to a letter in the same way. That doesn’t mean letters are a data-protection free-for-all — UK GDPR still governs how you source a business’s name and address and how long you keep it — but the compliance burden is meaningfully lighter:
Consent requirement
Cold email: Must have a lawful basis + opt-out mechanism
Letters: UK GDPR lawful basis for the data, no PECR consent regime
Opt-out mechanics
Cold email: Must be clear, immediate, and honoured without delay
Letters: Standard "right to object" under GDPR, less time-pressured
Regulator
Cold email: ICO, under both PECR and UK GDPR
Letters: ICO, under UK GDPR only
Common failure point
Cold email: Scraped/bought lists with no clear lawful basis, buried or missing opt-out
Letters: Mainly data retention and sourcing — fixable with basic process, not a structural channel risk
This Isn’t a Reason to Panic About Email — It’s a Reason to Be Deliberate
To be clear: this isn’t an argument that cold email is illegal or that every company doing it is at serious risk. Plenty of B2B cold email is run properly — real corporate addresses, honest sender identity, working opt-outs, data sourced on a defensible basis. The point is that doing it properly takes real legal diligence that most small teams don’t have the bandwidth to do rigorously, and the failure mode isn’t “nothing happens” — it’s an ICO complaint, a damaged relationship with a prospect, or in the worst case, enforcement action.
Letters remove most of that overhead. You’re not navigating PECR’s electronic-marketing consent rules at all — you’re dealing with the more familiar question of “do we have a legitimate basis to hold this business’s name and address,” which most legitimate B2B prospecting already satisfies.
Where Mailsource Fits
This is part of why Mailsource exists as a channel, not just a creative studio. Every campaign is built on data sourced on a legitimate basis, with proper records of where contact details came from — the same diligence we’d want applied to our own outreach. Combined with the fact that letters sit outside PECR’s electronic marketing regime entirely, that makes direct mail one of the more straightforward channels to run compliantly at scale, without a legal team sitting between you and every campaign.
If part of your reason for exploring direct mail is “cold email due diligence is eating too much of our time,” that’s a completely legitimate reason to make the switch — not just a tracking or response-rate argument, but a genuine reduction in regulatory surface area.