How to find clients for your agency: legal outreach and channels that work (2026)

The way to find clients for your agency is to work the people who already trust you first (past clients, past colleagues and other agencies), sell one clear offer that's easy to recommend, and add one outbound channel you run every week. Cold email can be that channel, but only if you follow the spam rules in your recipient's country, and those rules differ more than most cold email tool vendors let on.

This guide is for freelancers and new agency owners, often working remotely and selling into the US, UK, EU and Australia. It sets out the anti-spam rules side by side from official sources, then covers the legal, practical channels: referrals, partner programmes, productised offers, platforms, LinkedIn and communities, plus a weekly routine. If you're building a software product rather than a service business, our guide to getting your first customers without ads covers founder-led sales and customer conversations in more depth.

Where agency clients usually come from

Most new agencies win their first clients through people who've seen their work: former employers, old colleagues, past freelance clients and their introductions. That's because buying a service is buying trust. A prospect can't test an agency the way they can trial software, so they lean on someone else's word.

That shapes the order to work in:

1. Warm: past clients, colleagues and your network, asking for named introductions.
2. Borrowed trust: other agencies, software partner programmes and platforms where buyers already look for help.
3. Cold: targeted outreach by email or LinkedIn, done legally and personally.
4. Slow and compounding: LinkedIn content, buyer communities and case studies.

Cold outreach is where you can get into legal trouble, so here are the rules first.

Is cold email legal for agencies?

Cold email to businesses is legal in the US and, to company addresses, in the UK, is usually possible in the EU under GDPR legitimate interest, and needs consent in Australia and Canada. In every one of them you must identify yourself and honour unsubscribes. The rule that applies is usually set by where the recipient is, not where you're sitting.

United States: CAN-SPAM

The US doesn't require consent before a commercial email, but it does set rules for every one you send. The FTC's CAN-SPAM compliance guide says the law covers all commercial messages and "makes no exception for business-to-business email". Your emails must:

• Use accurate header information that identifies who sent the message.
• Have a subject line that accurately reflects the content.
• Disclose clearly and conspicuously that the message is an advertisement.
• Include your valid physical postal address (a registered PO box or private mailbox is allowed).
• Explain clearly how to opt out, and honour opt-outs within 10 business days.

The opt-out must keep working for at least 30 days after you send, and you can't charge a fee or ask for more than an email address to process it. You can't sell or transfer an opted-out address. The FTC also says harvesting addresses or generating them through a dictionary attack can carry criminal penalties, and that each separate email in violation is subject to penalties of up to $53,088.

United Kingdom: PECR and UK GDPR

The UK splits recipients into corporate subscribers and individuals. The ICO's business-to-business marketing guidance says the PECR email rule "does not apply to corporate subscribers", so you don't need consent under PECR to email a limited company or similar body. You must not disguise or conceal your identity, and you must give a valid address to opt out.

Sole traders and some partnerships are different. The ICO says they're treated the same as individuals, so you can only email them if they've specifically consented or the soft opt-in applies (which needs, among other things, that you got their details in the course of a sale or negotiation of a sale). Many freelancers are sole traders, so check first.

UK GDPR still applies to business contacts: the ICO says an address like a named employee's identifies an individual, and their right to stop their data being used for direct marketing is absolute. If you buy a business contact list, UK GDPR applies to the personal data on it. The ICO notes this guidance is under review after the Data (Use and Access) Act, and its February 2026 statement says the Act gives it power to issue PECR fines of up to £17.5 million or 4% of global turnover.

European Union: GDPR legitimate interest

B2B outreach in the EU usually relies on GDPR's legitimate interest basis, but it's conditional and national rules sit on top, so treat this section as a starting point only. The European Commission's legitimate interest page says lists with contact details are processed on legitimate interest grounds, that people must be told at the latest at the first communication that their data is used for adverts and that they can object at any time, and that the rights and freedoms of the people concerned must not be seriously affected.

The European Data Protection Board's SME guide says you must weigh your interest against people's rights and consider what they may reasonably expect. On bought lists, the Commission's third-party data page says the seller must be able to demonstrate the data was obtained in compliance with GDPR, and that email marketing must also comply with the ePrivacy Directive, which each country implements its own way.

One national example: France's CNIL says (page dated 10 June 2026) that prospecting professionals can rest on legitimate interest when the message relates to the person's profession, that they must have been informed and be able to object simply and free of charge, and that every message must identify the sender. Other EU countries may be stricter, so check the regulator in the recipient's country.

Australia: the Spam Act

Australia needs consent before you send, and the law reaches you even if you're overseas. Section 16 of the Spam Act 2003 bans sending a commercial electronic message with an "Australian link" unless the account-holder consented. Section 7 says a message has that link if, among other things, the device used to access it is in Australia or the recipient organisation carries on business in Australia. Sending from Bali or London to a Sydney business is covered.

Consent means express consent or consent that can reasonably be inferred from conduct and business relationships (Schedule 2, clause 2). Two clauses matter for agencies:

• Publication alone isn't consent. Clause 4(1) says consent "may not be inferred from the mere fact" an address has been published.
• Conspicuously published work addresses can be. Under clause 4(2), consent is taken to exist where an address for a particular employee, officer, self-employed person, role or function has been conspicuously published, it's reasonable to assume the publication was agreed to, and there's no statement saying they don't want unsolicited commercial messages. Your messages must then be relevant to that person's work-related business, functions or duties, or to the role concerned.

In practice, emailing a published head of marketing address about marketing services may fit. Scraping every published address in a city won't.

Every message must clearly identify who authorised it and include contact details likely to stay valid for at least 30 days (section 17), plus a functional unsubscribe facility (section 18). business.gov.au's email marketing page says to remove people no later than 5 working days after they ask, to keep a record of who gave express consent, when and how, and that the ACMA can investigate and fine businesses. The Act sets civil penalties in penalty units, scaling up for repeat offenders and for many breaches on the same day.

Canada: CASL

Canada also requires consent, with a similar exception for published work addresses. Innovation, Science and Economic Development Canada's consent guidance says express consent is someone agreeing, verbally or in writing, to receive your messages, while implied consent applies only in certain cases. If you rely on a conspicuously published address, it must not carry a statement that the person doesn't want unsolicited messages, and your message must be relevant to their business, role or duties.

Each message must include your business name, a mailing address and a phone number, email or website valid for at least 60 days, and a free unsubscribe that's actioned within 10 business days. The government's CASL overview says penalties for the most serious violations can reach $1 million for individuals and $10 million for businesses (Canadian dollars).

The rules side by side

What this means for cold email tools

A tool doesn't make your outreach legal. The FTC says "you can't contract away your legal responsibility", and both the business being promoted and the sender can be held liable, so an agency doing outreach for a client shares the risk too.

Mailbox providers add their own rules. Google's email sender guidelines require every sender to Gmail to use SPF or DKIM and keep its spam rate below 0.3% (it recommends below 0.1%). Senders of more than 5,000 messages a day to Gmail accounts must use SPF, DKIM and DMARC and support one-click unsubscribe. Blasting a scraped list through a new domain is the quickest way to break both the law and these limits.

If you use outreach at all, keep it small and personal: a hand-checked list of companies, a reason specific to each one, your real name and address, an easy opt-out, and a log of who unsubscribed.

Referrals and partnerships

Referrals are the most reliable source of agency clients because the trust is already there. The work is making them happen on purpose rather than waiting.

Ask your clients, specifically

Ask every happy client for one named introduction, at the moment they're happiest: right after a launch or a good result. "Who else do you know who's dealing with this?" works better than "let me know if you hear of anyone". Make it easy by writing a two-line note they can forward.

Partner with other agencies

Agencies that do adjacent work are your best referral partners. A brand studio turns away web builds, a web shop turns away paid ads, and a big agency turns away small budgets. Offer to take their overflow and send them yours. Agree up front how you'll handle the client relationship and any referral fee, in writing. If you're subcontracting rather than referring, our guide to going from freelancer to agency covers the terms.

Join a software partner programme

Software companies send work to agencies that sell and implement their product, but the best listings are earned. Examples:

• Shopify. Shopify Partners says partners can earn on apps, themes, store builds and referrals, and that it paid partners US$1.3 billion in 2025. The Partner Directory, where merchants hire help, is by invitation: Plus, Premier and Platinum partners are invited, along with a limited number of Registered partners. Plus needs at least US$500k a year in revenue to Shopify from referred or co-sold merchants, or US$2.5M from existing merchants, plus at least 2 Plus or Enterprise shops or 40 Standard shops acquired in the last 5 years.
• Klaviyo. Klaviyo's partner page lists agencies in its Agency Directory and offers a Partner Portal where partners submit lead referrals and get training and certifications.

Join the programme for the platform your clients already use, and treat a directory listing as a later bonus, not your first client.

Productised offers make every channel easier

A fixed-scope, fixed-price offer is easier to refer, easier to post about and easier to say yes to than "we do websites". It also gives a cold message something concrete to propose. Pick one problem, one deliverable, one price and one timeline. Our guide to productised services walks through packaging models and real prices.

Platforms and marketplaces

Platforms put you where buyers are already looking for help, at the cost of competing on price and following the platform's rules.

• LinkedIn Service Pages. LinkedIn's Service Pages FAQ says freelancers and small business owners can create one for free, that Premium Business adds a "Request proposal" button, and that Service Pages are available globally except in China. Its service requests page notes that submitting a proposal starts a conversation and doesn't guarantee a contract.
• Freelance marketplaces such as Upwork. These can bring early work and reviews. Upwork's pages refused to load for us on 26 October 2026, so we haven't quoted its fees or rules; check them on the platform before you rely on it.

Use platforms to get your first few reviews and case studies, then move repeat clients to direct contracts where the platform's terms allow.

LinkedIn content and personal messages

LinkedIn works for agencies when you post about the problems you fix and message people personally. Short posts showing a before and after, a teardown or a lesson from a project give prospects a reason to remember you. Personal messages turn that attention into calls.

LinkedIn's Professional Community Policies say not to use the invitation feature "to send promotional messages to people you don't know", and ban untargeted, irrelevant or obviously unwanted commercial messages. So connect without a pitch, and only message about something relevant to them.

Communities where your buyers gather

Buyer communities are slower than outreach but bring warmer leads. Go where your clients talk about their problems: industry associations, ecommerce or SaaS founder groups, local business networks. Help first and promote rarely, and read each group's rules. Agency owner communities are different: they bring referrals and overflow from peers rather than clients. Our guide to communities for agency owners and freelancers compares the main ones. To swap notes with other remote founders and agency owners, join Remote Builders (it's free).

The channels compared

A weekly pipeline routine

A small routine you keep beats a big campaign you abandon. Set your own targets and adjust them after a month, because response rates depend on your market and offer.

1. Monday: pick this week's segment (one industry, one problem) and list ten to twenty companies by hand.
2. Monday: check each recipient's country against the rules above, and note who's a company and who's a sole trader.
3. Tuesday: ask two past clients or partners for a named introduction.
4. Tuesday to Thursday: send personal outreach in the morning and hold calls in the buyer's working hours.
5. Wednesday: publish one LinkedIn post about a problem you solved.
6. Thursday: spend 30 minutes helping in one buyer community.
7. Friday: follow up, honour every unsubscribe, and log each conversation with its source, the problem in their words and the next step.

After a month, the log will show which source produces calls and clients. Put more time there.

Common mistakes

• Buying a list and blasting it. It breaches consent rules in Australia and Canada, needs GDPR checks in the UK and EU, and wrecks your sending domain.
• Assuming B2B email is exempt. The FTC says CAN-SPAM makes no B2B exception, and sole traders count as individuals in the UK.
• Thinking your location protects you. Australia's Spam Act covers messages accessed in Australia, wherever you send from.
• Treating any published address as consent. In Australia and Canada, it must be conspicuously published with no opt-out note, and your message relevant to their role.
• Hiding who you are. Every regime above requires you to identify yourself.
• Leaving unsubscribes in a shared inbox. Deadlines run from 5 working days to 10 business days.
• Relying on the tool for compliance. You can't contract away responsibility.
• Selling everything to everyone. A vague offer makes referrals and outreach harder.
• Never asking for referrals. Happy clients rarely introduce you unprompted.
• Mass LinkedIn invites with a pitch. LinkedIn's policies ban promotional invites to strangers.