Is It Legal to Email Journalists You Found in a Media Database?

The short answer

Yes, in almost every jurisdiction, provided you meet 3 conditions: honest sender information, a real physical postal address, and a working way to opt out. Cold email to a business address is lawful under US law without prior consent, and reachable under EU and UK law through legitimate interests rather than consent. This article is general information, not legal advice.

The United States

CAN-SPAM governs commercial email and does not require prior consent. What it requires is that the sender is identified accurately, the subject line is not deceptive, a valid physical postal address appears in the message, an opt-out mechanism is present and works, and opt-outs are honoured within ten business days.

There is a wrinkle worth knowing. A pure media pitch may not be commercial email at all, since its purpose is editorial rather than a transaction, and the strictest requirements attach to commercial messages. Most senders comply regardless, because the requirements are trivial to meet and the classification argument is not one you want to have.

The EU and UK

GDPR does not ban cold email. It requires a lawful basis, and for B2B contact the usual basis is legitimate interests rather than consent — which is workable when the recipient's professional role is precisely to receive information from sources.

Relying on it means being able to show your reasoning. Document the assessment, keep it proportionate, honour objections immediately, and tell recipients where their details came from and how to be removed. A journalist's work address held for pitching is a strong case; the same address used for unrelated product marketing is not.

Some member states apply stricter rules to individual professionals than to generic company addresses, so a named journalist deserves more care than a newsdesk inbox.

Where it gets stricter

Canada's anti-spam law is the tightest of the major regimes and generally requires express or clearly implied consent, with meaningful penalties. Publicly published business contact details can support implied consent where the message relates to that person's role — which covers a media pitch, but not much else.

Australia and most of the rest broadly follow the identify-yourself and honour-opt-outs pattern.

What compliance looks like in practice

• Use a real sending identity and a monitored reply address.
• Put a physical postal address in the footer of every send.
• Include a one-click opt-out and process it immediately, not in ten days.
• Keep a suppression list and check it before every campaign.
• Say where you got the details if asked. Being unable to answer is the actual risk.

The practical point: legal compliance is the floor, and it is a low one. Being deleted is a far more common outcome than being fined.

Where the actual risk sits

Enforcement against a company sending relevant pitches to journalists' work addresses is rare. The regulators' attention goes to volume consumer spam, deceptive headers and senders who ignore opt-outs, none of which describes normal media relations.

The realistic risks are commercial rather than legal, and they arrive sooner. Spam complaints damage sending reputation, and a domain that accumulates them starts landing in junk folders for every recipient, including the ones who wanted to hear from you. That is usually irreversible in practice without changing infrastructure.

The second risk is reputational and specific to this audience. Journalists talk to each other, and they publish. A sender who ignores removal requests or misrepresents where the data came from can find that behaviour written about, which is a worse outcome than any realistic fine.

The defensive posture is the same in both cases: send relevant mail to people whose job is to receive it, honour every removal immediately, and be able to answer honestly when asked why they were contacted.

About this guide

General information on email marketing law as of August 2026, not legal advice. Consult a qualified lawyer for your jurisdiction. Last reviewed 15 August 2026.

How this was measured, and when

Every figure on this page was re-run against the live database on October 20, 2026. The counts move as the database grows and as addresses are rechecked, so a figure here is a reading on a date rather than a fixed fact. When this study was first published the same set was smaller, which is why these percentages differ from the ones it originally carried. Each one is reproducible from the filters described above.

The four requirements, plainly

The US CAN-SPAM Act applies to commercial email including a pitch, and the Federal Trade Commission sets out what compliance looks like. Use honest headers, which means a real from name and a subject line that describes the message. Include a valid postal address in every email. Give a working way to opt out and honor it within 10 business days. Do not disguise what the message is for.

Penalties run to $53,088 per email, which is the reason to be literal about this rather than approximately compliant. None of it stops you pitching. It stops you pitching anonymously, and it makes leaving easy, which is a reasonable price for writing to someone who did not ask to hear from you.