Cold email in 2026: spray-and-pray is dead, not the channel

In 2026, the average reply rate for a B2B cold email has dropped to 3.43%, as measured by Instantly across billions of emails sent in 2025. The usual conclusion: the channel is dead, killed by GDPR and overflowing inboxes.

That’s a misdiagnosis. Cold email isn’t dead. In France, GDPR allows it in B2B on the basis of legitimate interest, with no prior consent required. And top-quartile campaigns get a 5.5% reply rate, with the elite above 10.7%, while the average collapses. What’s dying is spray-and-pray: undifferentiated mass sending.

This article separates the channel from the practice, shows why GDPR doesn’t kill B2B cold email, what spray-and-pray really breaks, and what keeps the channel alive.

Is cold email dead in 2026?

No. Cold email isn’t dead; it has split into tiers. The average campaign has fallen to a 3.43% reply rate, but the top quartile holds at 5.5% and the elite exceed 10.7% (Instantly, Cold Email Benchmark Report 2026, 2025 data). A dead channel doesn’t produce a threefold gap between the average and the top performers. What the average measures is the disappearance of a practice, not of a channel.

The gap tells a specific story. The average is dragged down by broad lists all sent the same message, whose yield falls below 3%. The top performers don’t hold up thanks to a better formula: they hold up because they contact fewer people, better targeted.

Instantly puts it bluntly: the best performers replace volume with precision and get two to four times as many replies. Surface-level personalization, meanwhile, has stopped setting anyone apart, a finding covered in detail in why generic cold email is dead. The channel still works, just not for people who use it like a megaphone.

Did GDPR kill B2B cold email in France?

No. In B2B, GDPR doesn’t require the recipient’s prior consent. The CNIL (France’s data protection authority) allows business-to-business email prospecting on the basis of legitimate interest (Article 6(1)(f)), under three conditions: the message relates to the person’s professional activity, every email includes a simple way to unsubscribe, and the person is informed of how their data is used. GDPR didn’t close the channel; it banned one way of using it.

The rule changes depending on the target. For an individual consumer (B2C), prior consent is still required. For a professional, as long as the outreach relates to their role (the CNIL’s example: pitching software to a company’s IT director), legitimate interest is enough.

The CNIL’s published rules on email prospecting also set out the guardrails: disclosing where the data came from at first contact, the right to object, and deleting an inactive prospect after three years. None of these obligations kills cold email. What they specifically prohibit is off-topic sending with no clear identity and no way out: the very definition of spray-and-pray.

What is spray-and-pray, and why is it dying?

Spray-and-pray is sending the same generic message to a broad list, with no connection between the recipient and the timing of the outreach. It’s dying for a mechanical reason: when every outbound team generates its personalized lines with a language model, they all end up looking alike, and spam filters, swamped by that volume, have gotten stricter. The message loses its differentiation and its legitimacy at the same time.

The reflex to make up for falling reply rates is to increase volume. That’s exactly the move that makes the problem worse. Below the 3% mark, the constraint is almost never the copy; it’s the quality of the list. Sending more to a broad list doesn’t just push the reply rate down further; it damages your sending infrastructure.

It’s the same logic that explains why an AI SDR’s mass sending fails: automating bad targeting doesn’t produce meetings; it produces ignored volume, faster. The machine speeds up the dying practice; it doesn’t save it.

Why does spray-and-pray destroy your sender reputation?

Because its real cost isn’t a bad reply rate; it’s losing access to the inbox. Since February 2024, Google has required any sender of more than 5,000 messages a day to Gmail to have full authentication (SPF, DKIM, DMARC), one-click unsubscribe, and a spam complaint rate kept below 0.30%. Generic mass sending crosses that threshold, and the domain’s reputation collapses.

Sender reputation is an asset, not a setting. Once it’s damaged, it doesn’t just penalize the offending campaign: it sends subsequent emails to spam, including the well-targeted ones that would have converted. Spray-and-pray doesn’t just botch one send; it burns the channel for every send that follows.

Google’s official sender guidelines go further than the enforcement threshold: they recommend staying below 0.10% complaints and never reaching 0.30%. In other words, the margin for error is narrow, and undifferentiated sending eats through it in a few campaigns. It’s a self-inflicted death, not the death of the channel.

What keeps cold email alive?

Signal-based targeting. What separates 3.43% from 10.7% isn’t a better hook; it’s timing: contacting a decision-maker because a real event opens a buying window, not because they’re on a list. A published tender, an expiring certification, a new role, a funding round: these public traces tell you when and why to reach out, and make the message legitimate through its timing.

This kind of targeting changes the nature of sending. You’re no longer trying to reach everyone in the hope of a few replies; you’re contacting a few people with a concrete reason to do it now. It’s also why buying intent can’t be read on LinkedIn but shows up in official registers, and why prospecting that starts from the buying signal flips the volume logic on its head. That same signal, once detected, separates a message that gets a reply from a recycled merge field.

That’s the foundation Agify builds prospecting on: cross-referencing public sources to detect the signal, then contacting the right person at the right time with a real reason. If you want to see which signals open a buying window in your market, we can talk it through in a short call.

Frequently asked questions

Is cold email legal in France in 2026?

Yes, in B2B. The CNIL allows business-to-business email prospecting on the basis of legitimate interest, without prior consent, provided the message relates to the person’s professional activity, every email includes a simple unsubscribe option, and the person is informed of how their data is used. For individual consumers, prior consent is still mandatory.

What’s the difference between targeted cold email and spray-and-pray?

Spray-and-pray sends the same generic message to a broad list, with no connection to timing. Targeted cold email starts from a real signal (a tender, a certification, a new role) and contacts a specific person because an event opens a buying window. The first stalls below a 3% reply rate; the second stays among the top performers.

How many emails can you send before you risk your sender reputation?

Since February 2024, Google has required anyone sending more than 5,000 messages a day to Gmail to use SPF, DKIM, and DMARC authentication, offer one-click unsubscribe, and keep their spam complaint rate below 0.30%. But volume isn’t the only factor: a generic send to a broad list drives complaints up well before that threshold and damages the domain’s deliverability for a long time.

Does B2C cold email follow the same rules as B2B?

No. For individual consumers, GDPR and the CNIL require prior consent before any prospecting email. The legitimate interest basis, which waives that consent, applies only to business-to-business prospecting, and only when the outreach relates to the role of the person being contacted.

Do you need to deeply personalize every cold email for it to work?

Not in the same way for everyone. What makes the difference isn’t how deep the personalization goes when it’s applied uniformly; it’s how relevant the timing is. A short message backed by a real buying signal beats a heavily personalized message sent with no reason to reach out now. Precise targeting matters more than writing effort.

Conclusion

Cold email isn’t a channel at the end of its life; it’s a channel that no longer forgives undifferentiated sending. GDPR didn’t shut it down: in B2B, it allows it on the basis of legitimate interest, as long as you target accurately and leave a way out. The 3.43% average doesn’t measure the death of the channel; it measures the end of spray-and-pray, whose real cost is sender reputation, not just reply rate.

What’s still alive fits in one sentence: contact the right person at the right time, for a real reason. It’s a signal problem, not a formula problem. To pin down the signals that matter in your market, let’s look at your situation together.

Written by the Agify team, which runs B2B prospecting campaigns targeted by buying signals for sales teams in markets with usable public traces.