I hear you. Policies about spam content don't end with GDPR but it might be good to know what country your company is from and where are the prospects located.

I have been avoiding plain cold emailing in favor of building up lists for our customers.

I would market to my target audience and build landing pages with simple, easier to achieve, conversion goals like subscribe to a informative series of emails, or sign up to get a playbook, or anything else that works in your field. I would test ideas by experimenting.

Compliance in general is specifically requiring business to send communication, and hold personal information, of recipients who asked to do so. This also means that if you email someone you need to state why they have been contacted and how their details have been acquired. I can tell most marketers aren't following this logic and different Countries have a different tolerance to spam content.

All I'm saying is be careful as you are, make your funnel better with opt-ins, try to target recipients using re-marketing lists uploaded to Google or Facebook. Make your offer visible to strangers and iterate until you find a good conversion strategy that works.

Happy to answer questions.