Cold email for freight forwarders: what UK rules allow

Business-to-business email is more permissive than most people think, and stricter than most people practise. The short version of PECR.

Cold email in freight sits in a strange place. Half the industry believes it is illegal and does none of it. The other half sends purchased lists to five thousand addresses and hopes.

Neither position matches the actual rules. UK business-to-business email marketing is governed mainly by PECR, alongside UK GDPR, and it is more permissive than the cautious camp thinks and stricter than the enthusiastic camp practises.

What follows is my working understanding of it, written plainly. I am not a lawyer and this is not legal advice, so check anything you are unsure about with your own adviser or against the ICO’s own guidance.

The distinction that decides everything

PECR draws a line between corporate subscribers and individual subscribers, and it is not the line most people assume.

Corporate subscribers are limited companies, limited liability partnerships, plcs, public bodies and Scottish partnerships. Marketing email to a named person at one of these does not require prior consent.

Individual subscribers are individuals, sole traders and most partnerships. These need consent, or the narrow soft opt-in that applies to your own customers and enquirers.

In logistics that distinction matters. A supply chain manager at a limited company importer is a corporate subscriber. The owner-driver you want to subcontract to may well be a sole trader, and the same email to both is treated differently.

Check the legal entity before you send. It is a five-second Companies House search and it changes what you are allowed to do.

What you can do

Emailing a named business contact at a limited company about a service relevant to their role is generally lawful under PECR, provided you meet the basic conditions every time:

• Identify yourself clearly. Real company name, registered address and company number.
• Do not disguise or conceal who you are or use a misleading subject line.
• Provide a working opt-out route in every message, and honour it promptly.
• Keep a suppression list of everyone who has opted out and check every send against it.

UK GDPR still applies to the personal data involved, so you also need a lawful basis, normally legitimate interests, a documented assessment of that, a privacy notice you can point to, and a route for someone to object or ask what you hold.

What gets businesses into trouble

1. Buying lists. Purchased data almost never comes with a provable, specific basis for you to email it. It also tends to be old, which produces bounces and reputational damage regardless of the law.
2. Scraping generic inboxes indiscriminately. info@ addresses at limited companies are lower risk than personal ones, and blasting thousands of them is still the behaviour that attracts complaints.
3. Ignoring opt-outs. The most common cause of an ICO complaint being upheld, and the easiest thing on this list to get right.
4. No records. If you cannot show where an address came from, you cannot defend the send.
5. Treating sole traders as businesses. Common in haulage subcontracting and a genuine exposure.

Your own customers and enquirers

The soft opt-in covers people who gave you their details in the course of buying or enquiring about something similar, provided you gave them a chance to refuse at the time and give them an opt-out in every message.

That is why the quote follow-up and the dormant customer email are both lower risk than cold outreach, and why they also produce more work. The people on that list have a relationship with you already.

Keep the record of how each contact arrived. Quote request, tender, trade show, website form. A list with a provenance column is worth considerably more than a bigger list without one.

How I would run it in practice

• Build lists by hand, by named person and named company, and verify the legal entity.
• Two hundred well-researched contacts, not five thousand scraped ones. The response rate difference is not marginal.
• Send from a real person’s address at your own domain, with SPF, DKIM and DMARC configured.
• Write to one person about one thing. If the email could go to anyone, it will perform like it.
• Opt-out link in every send, suppression list checked automatically, and a note of the date somebody unsubscribed.
• Review the list twice a year and delete what has gone cold. Storage without purpose is its own problem.

Done this way, cold email in freight still works. Done as volume, it burns your domain, your reputation in a small industry, and eventually your budget.