In the United States, commercial cold email is legal under CAN-SPAM if you follow its rules: truthful sender information, non-deceptive subject lines, a clear working unsubscribe honored promptly, and a physical mailing address in the message. That's a description of the statute, not legal advice.
Outside the U.S. the picture changes sharply. Canada's CASL and the EU's rules are far stricter, often requiring consent before the first message. If your list crosses borders, which rules apply gets genuinely complicated.
The honest boundary: how the rules apply to your specific list, industry, and targeting is a lawyer question, and a cheap one compared to getting it wrong. What we can say operationally: sender reputation punishes spammy behavior long before regulators do.