In this guide · 8 sections
- 01When the Spam Control Act applies to AI cold email
- 02What an unsolicited bulk email must contain
- 03Scraped and AI-found email lists
- 04PDPA and DNC when you add calls, SMS or WhatsApp
- 05Deliverability: why AI volume hurts your domain
- 06A compliant small-batch AI outreach process
- 07Do it yourself or get help?
- 08Frequently asked questions
Short answer
Cold sales emails are unsolicited, so once you send more than 100 similar messages in 24 hours (or 1,000 in 30 days, 10,000 a year), the Spam Control Act requires <ADV> in the subject, an unsubscribe email address and true headers. Never use harvested addresses. Calls and SMS need DNC checks.
When the Spam Control Act applies to AI cold email
The Spam Control Act 2007 covers electronic messages with a Singapore link, which section 7 defines broadly: the message originates in Singapore, the sender is in or registered in Singapore, or the recipient is in Singapore when it is accessed. Most outreach by a Singapore business meets that test.
The main obligations apply to messages that are all three of the following:
| Test | What the Act says | Typical AI cold email |
|---|---|---|
| Commercial | Section 3: judged by content and presentation, for example offering goods or services | Yes, a sales or meeting request |
| Unsolicited | Section 5: the recipient did not request or consent to it; a published address is not consent | Yes, even if the address is on their website or LinkedIn |
| In bulk | Section 6: over 100 similar messages in 24 hours, 1,000 in 30 days, or 10,000 in a year | Often yes once a tool sends sequences daily |
Personalisation does not help with the bulk test. The Act counts messages "containing the same or similar subject matter", so 150 AI-written variations of the same pitch in a day are still more than 100 similar messages.
What an unsolicited bulk email must contain
Section 11 says anyone who sends, causes or authorises unsolicited commercial messages in bulk must comply with the Second Schedule. Our Spam Control Act guide goes through each paragraph; in short:
Second Schedule essentials
The Act works mainly through civil claims. Our Spam Control Act guide covers the remedies, including statutory damages per message, and section 3(4) on businesses that knowingly allow someone else to promote their products by spam.
Scraped and AI-found email lists
Many AI outreach tools find prospects' addresses automatically. Section 9 of the Act says a person must not send, cause or authorise messages to addresses generated or obtained through a dictionary attack or address-harvesting software. Unlike the bulk rules, this applies to all electronic messages, commercial or not, in any volume (it does not apply to messages sent to mobile numbers).
The Act defines address-harvesting software as software specifically designed or marketed for searching the internet for electronic addresses and collecting or compiling them. A dictionary attack is generating likely addresses by combining names, letters and symbols, which is how many "email finder" tools guess firstname.lastname@company. Before using a prospect database, ask the provider how addresses were collected, and avoid tools that advertise scraping or guessing addresses.
PDPA and DNC when you add calls, SMS or WhatsApp
Business contact information, such as a work email or office number provided for business purposes, is largely outside the PDPA's data protection provisions, per the PDPC's key concepts guidelines. Personal emails and personal mobile numbers are not.
The Do Not Call provisions cover marketing calls, SMS and messages to Singapore telephone numbers. Our DNC registry guide explains the rules: check numbers against the registry within the previous 21 days unless you have clear and unambiguous consent, while purely business-to-business messages are excluded. If your AI sequence adds a WhatsApp or SMS step to a personal mobile number, run the DNC check first.
Deliverability: why AI volume hurts your domain
Even legally compliant cold email can damage your domain. Google's email sender guidelines say every sender to Gmail needs SPF or DKIM, senders of more than 5,000 messages a day to Gmail need SPF, DKIM and DMARC, and spam rates reported in Postmaster Tools should stay below 0.1% and never reach 0.3%. Marketing messages also need one-click unsubscribe.
Cold recipients report spam far more often than customers who opted in. If outreach goes from the same domain as your invoices and staff email, a spike in complaints can push all of it to spam. Our guide to fixing emails going to spam in Gmail covers recovery.
A compliant small-batch AI outreach process
This process keeps volume under the bulk thresholds where possible, and makes you compliant if you go over them.
Build the list by hand or from consented sources
Use addresses prospects published for business enquiries, events where they opted in, or referrals. Avoid harvested or guessed addresses.
Use AI to research and draft, not to send blindly
Have AI summarise the prospect's business and draft a short, specific email. A person reviews every message for accuracy before it goes out.
Cap daily volume
Under 100 similar messages a day and 1,000 in 30 days keeps you outside the Act's bulk definition. Larger campaigns must follow the Second Schedule.
Add the unsubscribe basics anyway
Include a line explaining how to opt out with a reply-to address, and keep a suppression list across every tool.
Authenticate a separate sending domain
Set SPF, DKIM and DMARC, and monitor spam rates in Google Postmaster Tools.
Keep records
Note where each address came from, when it was contacted, and any unsubscribe request with the date it was actioned.
Do it yourself or get help?
Drafting outreach with AI and sending a few dozen reviewed emails a day is manageable in-house. The risk grows with automated sequences, bought or scraped lists, and outreach sent from your main domain.
IT Sorted is a Singapore-based team of developers with over 10 years of experience. Our Emails Land in Spam: Fix (S$249) inventories every service sending as your domain, sets up SPF, DKIM and DMARC, monitors DMARC and moves you to enforcement safely, checks blacklists and requests delisting, with a before-and-after test report. We do not write or send outreach campaigns, and this guide is not legal advice.
Frequently asked questions
It is not banned, but it is regulated. Under the Spam Control Act, unsolicited commercial emails sent in bulk, meaning over 100 similar messages in 24 hours, 1,000 in 30 days or 10,000 in a year, must carry <ADV> in the subject, an unsubscribe email address and honest headers. Sending to harvested or guessed addresses is banned at any volume. This is general information, not legal advice.
No. Section 5(2) of the Spam Control Act says a recipient is not treated as having requested or consented to a message merely because their electronic address was given or published by them or on their behalf. A cold email to an address listed on a company website is still unsolicited.
Usually yes. The Act counts messages containing the same or similar subject matter, so many personalised variations of the same sales pitch can still exceed the thresholds of 100 in 24 hours, 1,000 in 30 days or 10,000 in a year. Personalisation does not change what the message is about.
Check how it finds them. Section 9 of the Spam Control Act prohibits sending messages to addresses obtained through address-harvesting software, which searches the internet and collects addresses, or through dictionary attacks, which generate likely addresses. That ban applies to all emails, whether or not they are bulk or commercial.
No, the DNC provisions cover marketing calls, SMS and messages to Singapore telephone numbers, not email. If your outreach sequence adds calls, SMS or WhatsApp messages to personal mobile numbers, check them against the DNC registry within 21 days of sending unless you have clear consent. Purely business-to-business messages are excluded.