CAN-SPAM does not ban cold email in the United States. You can send commercial email to a business contact without prior consent, as long as each message has accurate header information, a non-deceptive subject line, identification as an advertisement, your valid physical postal address, and a working way to opt out. Opt-outs must be honored within 10 business days. The law has no exception for business-to-business email, so it applies to sales prospecting just as it applies to consumer marketing (FTC).

This is general information, not legal advice. Talk to a lawyer about your specific situation.

This post applies CAN-SPAM to the practical details of cold outreach: templates, sequences, multiple senders, and outreach tools. For a broader look at how CAN-SPAM, GDPR, and other regimes compare, see Consent, records and the rules that outlive your list.

Does CAN-SPAM apply to cold B2B email?

Yes. The FTC’s compliance guide says the law covers all commercial messages and makes no exception for business-to-business email (FTC). What determines coverage is the message’s primary purpose:

Commercial content advertises or promotes a product or service. A typical cold email pitching your software or agency is commercial.
Transactional or relationship content facilitates a transaction the recipient already agreed to or updates them about an existing relationship. These messages are largely exempt, but they still can’t contain false or misleading routing information.

If a message mixes both, the FTC looks at the subject line and where the transactional content appears. If the subject line would lead a recipient to think it’s an ad, or the transactional content isn’t mainly at the beginning, the message is treated as commercial (FTC).

For cold email, assume your first touch and every follow-up are commercial messages. A genuine one-to-one reply to a prospect’s own question is a different matter, but sequences built to promote your offer are commercial.

The CAN-SPAM requirements, applied to cold email

Requirement	What the law says	What it means for a cold email template
Accurate header information	From, To, Reply-To, and routing information, including the originating domain and address, must be accurate and identify the sender	Use a real person’s name and a domain your company owns. No fake personas or borrowed domains
No deceptive subject lines	The subject line must accurately reflect the content	No fake “Re:” or “Fwd:” threads, no fake invoice or meeting subject lines
Identify the message as an ad	Disclose clearly and conspicuously that it’s an advertisement; the law allows flexibility in how	A clear statement in the footer or body that this is a business solicitation
Physical postal address	A valid physical postal address, which can be a street address, a registered USPS post office box, or a registered private mailbox	Put your company address in the signature or footer of every message
Opt-out mechanism	A clear explanation of how to opt out; the mechanism must work for at least 30 days after sending	A plain-language opt-out line plus a link or reply instruction
Honor opt-outs promptly	Within 10 business days; no fees, no extra personal information, no more than a reply email or a single web page	Suppress the address across every mailbox and tool quickly
Monitor others	Hiring someone to send your email doesn’t transfer your legal responsibility	Your agency’s or SDR vendor’s mistakes are still your problem

All rows above are drawn from the FTC’s compliance guide and the statute at 15 U.S.C. § 7704.

A compliant footer doesn’t have to be long or awkward. A simple version:

Jordan Lee, Account Executive, Acme Analytics 123 Main Street, Suite 400, Austin, TX 78701 This is a sales message from Acme Analytics. If you’d rather not hear from us, reply “unsubscribe” or click here and we’ll stop.

That covers identification, postal address, and an opt-out with two easy methods. Some notes:

Reply-based opt-outs count, because the law allows opt-out by reply email. Make sure someone actually processes those replies.
A link is easier to automate. If you use one, it must lead to no more than a single page and can’t require a login or extra personal details.
One-click unsubscribe headers (the List-Unsubscribe and List-Unsubscribe-Post headers defined in RFC 8058) are a mailbox provider requirement for bulk senders, not a CAN-SPAM requirement, but they give recipients a clean alternative to the spam button. See One-Click Unsubscribe.

Opt-outs in multi-step sequences

Sequences are where cold email programs most often get CAN-SPAM wrong. An automated follow-up that goes out after someone has asked you to stop is a violation once the 10-business-day window has passed, and it’s a bad experience well before then.

Build these rules into your process:

Stop the sequence on any opt-out signal. “Unsubscribe,” “remove me,” “not interested, don’t contact me” should all end the sequence.
Suppress across every mailbox and domain. If a prospect opts out from one rep’s mailbox, a colleague’s mailbox can’t start a new sequence to them next month.
Suppress across tools. If you use more than one outreach platform, sync the suppression list between them, and with your CRM.
Keep the record. Don’t delete opted-out addresses. Keep them on a suppression list so future imports are screened against it. Our post on suppression list design covers what to store.
Never sell or share opted-out addresses. The law prohibits selling or transferring them, except to a company you’ve hired to help you comply (FTC).

The CAN-SPAM statute lets a recipient opt out of some or all of your commercial messages, and the restriction lifts only if the person later gives affirmative consent (15 U.S.C. § 7704).

For guidance on the deliverability side of sequences, see Follow-Ups Without Hurting Deliverability.

How you get addresses matters too

CAN-SPAM treats some list-building methods as aggravated violations. It’s unlawful to send a commercial email that otherwise violates the Act if you knew or should have known that the address was:

collected by automated means from a website or online service that posted a notice saying it doesn’t give out addresses, or
generated by automatically combining names, letters, or numbers into possible addresses (a “dictionary attack”)

(15 U.S.C. § 7704(b)).

Ethical list building is covered in How to Find Business Email Addresses Ethically. The short version: find the right person through legitimate research, use sources whose terms you respect, and verify before you send.

Penalties

Each separate email that violates CAN-SPAM can carry a penalty of up to $53,088, according to the FTC’s guide at the time of writing (FTC). The FTC adjusts civil penalty amounts for inflation, so check the guide for the current figure. Both the company whose product is promoted and the company that sends the message can be held responsible.

CAN-SPAM isn’t the only rule that applies

Compliance with CAN-SPAM is the legal floor in the US. Two other sets of rules shape cold email in practice:

Mailbox provider requirements. Gmail and Yahoo ask all senders to keep spam rates below 0.3% (Google, Yahoo), and Yahoo asks bulk senders to honor unsubscribes within 2 days (Yahoo). These are stricter than CAN-SPAM’s 10 business days.
Other countries’ laws. If your list includes people in the EU or UK, GDPR and related rules apply. See GDPR and B2B Cold Email. Canada’s anti-spam law also works differently from CAN-SPAM.

A cold email compliance checklist

Before launching a campaign:

The From name is a real employee and the domain belongs to your company.
Subject lines describe the actual content.
Each message identifies itself as a business solicitation.
Your valid physical postal address is in every message.
Every message includes a clear opt-out that works for at least 30 days.
Opt-outs stop all sequences and are suppressed across all mailboxes, domains, and tools.
Opt-outs are processed well within 10 business days (ideally the same day).
The list was built without harvesting or dictionary generation.
Any agency or contractor sending for you follows the same rules, and you check.
Addresses were verified, so you aren’t mailing dead or guessed addresses.

For the last item, our free email verifier checks syntax, domain and MX records, disposable and role-based addresses, free providers, and common typos. It doesn’t connect to the mailbox over SMTP, so it can’t confirm an individual inbox exists, but it filters out structural problems before you send.

FAQ

Is cold emailing legal in the US?

Yes, commercial email to people who haven’t opted in is legal under CAN-SPAM, provided each message meets the Act’s requirements and you honor opt-outs. CAN-SPAM is an opt-out law, not an opt-in law. Other laws may apply if you email people outside the US.

Do I need an unsubscribe link in a one-to-one sales email?

If the email’s primary purpose is commercial, it needs a clear way to opt out. That can be a reply instruction rather than a link, as long as it works and you honor it. A personal, individually written pitch is still commercial if it promotes your product.

Does CAN-SPAM require me to say “advertisement” in the subject line?

No. The FTC says you must disclose clearly and conspicuously that the message is an advertisement, but the law allows flexibility in how you do it. A clear statement in the body or footer is common.

How fast do I need to process an opt-out from a cold email?

CAN-SPAM allows up to 10 business days. Yahoo’s bulk sender guidance asks for 2 days, and Google recommends processing unsubscribe requests within 48 hours. In practice, stopping the sequence immediately is the safest approach.

CAN-SPAM and Cold Email: What US Law Requires