Can You Send Bulk Email Legally? Start With Purpose and Jurisdiction

As of October 26, 2026, you may be able to send bulk email legally, but “bulk” is not the decision that determines legality. Start with the message’s purpose, the people receiving it, the jurisdiction involved, and your evidence for permission or another lawful basis. Then verify identification, unsubscribe handling, data provenance, and suppression processes before sending.

There is no single global limit that makes a campaign legal or illegal. Sending volume is an operational constraint, while legal requirements depend on the applicable rules and facts. Provider comparisons commonly separate bulk-email services by sending model, limits, and compliance-related controls, but a service’s plan or quota does not itself establish legal permission to contact a person (Email Vendor Selection’s bulk email service overview; Mailtrap’s mass email service comparison).

Use this decision procedure

1. Classify the message purpose

Write one sentence describing the message before choosing a sending tool:

• Transactional or service-related: connected to an existing interaction or requested service.
• Marketing: promotes a product, service, event, or commercial relationship.
• Cold outreach: sent to people who may not have requested contact.
• Mixed: combines service information with promotion.

If the purpose is mixed, evaluate the promotional content rather than assuming the message is purely operational. Keep the classification, campaign owner, and intended audience in your campaign record.

2. List every relevant jurisdiction

Record where the sender is established, where the organization operates, and where recipients are located. Do not infer that one country’s permission makes the same campaign acceptable elsewhere. If the recipient location is unknown, treat that uncertainty as a reason to improve the data or pause the campaign—not as permission to proceed.

For operational background, see Compliance Operations. This is general information, not legal advice.

3. Identify the contact source and permission evidence

For each audience segment, document how the address was collected, when it was collected, what the person was told, and whether the evidence covers this message purpose. A purchased, copied, scraped, or inherited list needs particular scrutiny; possession of an address is not the same as permission to market to it.

Use the cold outreach data provenance guide to record source, collection context, and review status. If a record is inaccurate, correct or remove it using the process in Correct inaccurate prospect data.

4. Check message controls before scheduling

At minimum, confirm that the message identifies the sender accurately, uses a monitored reply path where appropriate, and provides a clear unsubscribe route. The unsubscribe mechanism should be easy to find and should feed a suppression process that prevents later promotional sends to that address.

Review the cold email unsubscribe requirements and the cold email compliance checklist before approving the campaign. These operational checks do not replace jurisdiction-specific legal review.

5. Apply a go/no-go rule

Proceed only when the purpose, jurisdictions, audience source, sender identity, unsubscribe path, and suppression owner are documented and reviewed. Hold the campaign when any of those fields is unknown, when the list contains unresolved inaccurate data, or when the team cannot explain why the message may be sent to each segment.

If the campaign is legitimate but large, separate legal approval from delivery planning. Provider comparisons discuss bulk-service limits and sending capabilities, but a quota is not a legal safe harbor (Email Vendor Selection; Mailtrap).

What “limits” should mean in practice

Teams often ask for a maximum number of emails they can send. That is the wrong denominator for a legal decision. Track these separate denominators:

• Recipients: how many people are targeted.
• Jurisdictions: which rules may apply to those people.
• Permission records: how many contacts have documented, relevant evidence.
• Suppressed contacts: how many must be excluded because of unsubscribe, complaint, or other suppression status.
• Delivery capacity: what your configured sending system can process responsibly.

A campaign can be small and still be noncompliant, or large and properly controlled. Volume may affect provider operations and review priority, but it does not answer the permission question by itself.

How RepMail fits into the workflow

RepMail by LetsZero can support campaign operations, but it does not decide whether a campaign is lawful. Its current application path supports sending through AWS SES SMTP from a verified custom sending domain or subdomain, subject to configuration and sender verification. It also includes one-click unsubscribe headers and a footer link in campaign messages.

RepMail processes verified SES/SNS delivery, bounce, complaint, open, and click events with idempotency safeguards. Permanent-bounce and complaint events can add suppressions; transient bounces are not treated identically. Tracking depends on configuration and recipient mail-client behavior, and an open is not an assured human-read signal.

The practical boundary is simple: complete the compliance review first, then use the sending system to enforce the approved audience and record campaign outcomes. Do not use warm-up caps, quotas, tracking, or automated suppression as a substitute for a lawful basis or accurate records.

A dated go/no-go checklist

Use this checklist for each campaign and retain the answers with the approval record.

Check	Go condition	Stop condition
Purpose	The message is classified as service, marketing, cold outreach, or mixed	The team cannot describe the purpose in one sentence
Jurisdiction	Sender and recipient locations are recorded and reviewed	Recipient location or applicable review is unknown
Data provenance	Source, collection context, date, and evidence are documented	The list is copied, purchased, scraped, or inherited without review
Accuracy	Names, addresses, and relevant company details are checked	Known inaccurate records remain in the audience
Sender identity	The sender and reply path are clear and accurate	The campaign relies on misleading identity or an unmonitored path
Unsubscribe	A clear unsubscribe route and suppression owner are tested	No working suppression process exists
Suppression	Unsubscribes, complaints, and relevant bounces are excluded	The send list was exported without current suppression checks
Approval	A named owner records the decision and date	No person is accountable for the release

Common mistakes

• Treating a provider limit, plan, or sending quota as legal permission.
• Using one rule for every recipient without checking jurisdictions.
• Confusing possession of an email address with permission to send marketing.
• Sending before removing unsubscribed, complained-about, or inaccurate records.
• Calling a mixed promotional message transactional because it includes account information.

FAQs

Is there a universal legal bulk-email limit?

No universal number can answer the question for every campaign. Separate legal review from delivery capacity, and assess purpose, audience, jurisdiction, and evidence.

Can I send cold email legally?

Possibly, depending on the facts and applicable jurisdiction-specific requirements. Document data provenance, sender identity, the message purpose, and unsubscribe handling before sending. Use the cold email compliance guide for agencies for an operational review path.

Does using RepMail make a campaign compliant?

No. RepMail by LetsZero can support sending and suppression operations, but the sender remains responsible for deciding whether the audience and message may be contacted.

What should I do when I cannot verify a contact’s source?

Hold the record out of the campaign, investigate the source, or remove it. Do not treat uncertainty as permission.

Sources