In the United States, commercial cold email is legal under CAN-SPAM if you follow its rules: truthful sender information, non-deceptive subject lines, a clear working unsubscribe honored promptly, and a physical mailing address in the message. That's a description of the statute, not legal advice.
Outside the U.S. the picture changes sharply — Canada's CASL and the EU's rules are far stricter, often requiring consent before the first message. If your list crosses borders, which rules apply gets genuinely complicated.
The honest boundary: how the rules apply to your specific list, industry, and targeting is a lawyer question, and a cheap one compared to getting it wrong. What we can say operationally: sender reputation punishes spammy behavior long before regulators do.