Is Cold Email Legal in the US? The 8 CAN-SPAM Rules
Cold email is legal in the US when each message meets the FTC's eight CAN-SPAM requirements. Here they are, on one example email.
Robbert Veer, Founder
8 min read
Is cold email legal in the United States? Yes. The CAN-SPAM Act sets eight requirements for commercial email, and asking permission first is not one of them. You must be honest about who you are, give a postal address, offer a way to opt out and honor it within 10 business days. This is not legal advice.
A cold email is a first sales email to a business you have had no contact with. This guide covers US cold email laws for an agency that sends them to local businesses. It walks through the eight requirements, shows one example email with each requirement marked, and explains the rule that follows you when software or a freelancer sends for you.
Is cold email legal in the US?
Yes, when each message meets the CAN-SPAM Act. The CAN-SPAM Act is the US law that sets the rules for commercial email. The Federal Trade Commission publishes a compliance guide for business, and three points in it answer most questions an agency has.
- One email counts. The guide says the Act "doesn't apply just to bulk email." A single sales email to one dentist is covered.
- Business recipients count. In the FTC's words, "The law makes no exception for business-to-business email."
- Every email is its own case. Each separate email that breaks the Act can bring a penalty of up to $53,088.
Notice what is missing. Nothing on the FTC's list asks you to get permission before the first message. The list covers how you behave once you have sent it.
What are the eight CAN-SPAM requirements?
The FTC's guide numbers them 1 to 8. The middle column below uses the FTC's own headings.
| # | FTC requirement | What it means for a cold email |
|---|---|---|
| 1 | Don't use false or misleading header information | The From name, the reply address and the domain identify you or your agency |
| 2 | Don't use deceptive subject lines | The subject reflects what the message is about |
| 3 | Identify the message as an ad | You say clearly that you are offering a service. The guide gives "a lot of leeway" on how |
| 4 | Tell recipients where you're located | A valid postal address. A street address, a post office box registered with the US Postal Service or a registered private mailbox all qualify |
| 5 | Tell recipients how to opt out of receiving future marketing email from you | A reply address or another easy internet-based way to say stop |
| 6 | Remember that subscribers and members can opt out of marketing emails, too | A subscription or membership does not remove the right to opt out |
| 7 | Honor opt-out requests promptly | Within 10 business days. The opt-out has to keep working for at least 30 days after you send |
| 8 | Monitor what others are doing on your behalf | You stay responsible when someone else sends for you |
Two details under requirement 7 catch people out. You cannot charge a fee or ask for anything beyond an email address before you honor an opt-out. And once someone has opted out, you cannot sell or transfer their address.
What does a compliant cold email look like?
It names the sender, says what it is, carries a postal address and gives a way out. Here is one, written for a made-up web design studio and a made-up dental practice. The names, the address and the phone number are fiction.
From: Dana Reyes, Northside Web Studio (dana@northsideweb.example)
Subject: The booking form on Brightside Dental's site
Hi Dr. Patel,
I opened brightsidedental.example on my phone this morning. The booking form asks for 11 fields before a patient can send it.
I run Northside Web Studio, a web design studio in Mesa, and I'm writing to offer our services. I'd like to show you the three changes I would make first. Would a 10-minute call on Thursday suit you?
Dana Reyes
Northside Web Studio, 210 Elm Street, Suite 4, Mesa, AZ 85201
555-0134If you'd rather not hear from me, reply "stop" and I won't email you again.
| Part of the email | FTC requirement it meets |
|---|---|
| A real name, a real studio and its own domain in the From line | 1, no false or misleading header information |
| A subject that names what the email is about | 2, no deceptive subject line |
| "I'm writing to offer our services" | 3, identify the message as an ad |
| The street address under the signature | 4, tell recipients where you're located |
| The line about replying "stop" | 5, tell recipients how to opt out |
Honoring opt-outs and monitoring others, requirements 7 and 8, happen after you press Send. A reply that says "stop" has to reach a person who removes the address, and it has to happen within 10 business days.
A note on requirement 3. The guide does not give exact words, and this example uses plain ones. Whether softer wording does the job in your emails is a question for a lawyer.
Writing this way has a second benefit. A subject line built from something you saw on the owner's own website is accurate by construction. You never have to wonder whether it misleads.
Who is responsible when software or an agency sends the email?
You are. Requirement 8 in the FTC's guide, "Monitor what others are doing on your behalf", is written for anyone who sends through a tool or for a client.
The FTC's guide says that even if you hire another company to handle your email marketing, "you can't contract away your legal responsibility to comply with the law." It adds that both the company whose product is promoted and the company that sends the message may be held legally responsible.
For an agency, that plays out in two ways.
- You prospect for yourself with a tool. Your agency is the business being promoted, and the tool does not carry your duties. Leadodo is a tool of this kind. Your Outbound Machine sends under your agency's name, and Leadodo never contacts anyone itself.
- You run cold email for a client. The client's service is promoted and you press Send. On the guide's wording, both of you may be held responsible. Agree in writing who handles opt-outs and who keeps the list of people who said stop.
Do cold email laws cover follow-ups, letters and LinkedIn?
Follow-ups, yes. Each follow-up is a separate commercial email, so each one has to meet all eight requirements. A person who opted out after your first email must not get your second. Our cold email follow-up templates are written with that in mind.
Letters stand on different ground. The guide defines its subject as electronic mail messages. A posted letter is paper and follows postal rules, which this post does not cover. In a sequence that opens with a letter and continues by email, the eight requirements apply to each email.
LinkedIn messages run under LinkedIn's own terms. How the Act treats messages on social platforms is a question for a lawyer.
What changes when the business is outside the US?
The starting point changes. The FTC's list lets you email first and stop when asked. Some countries ask for consent before the first message.
Canada is the nearest example. The Canadian government's guidance on its anti-spam law, CASL, says businesses must get consent before they send a commercial electronic message. Consent can be express or implied, and implied consent "is only recognized in certain circumstances" (Government of Canada). The same site says penalties for the most serious violations "can reach $1 million for individuals and $10 million for businesses" (Government of Canada).
The UK and the countries of the EU have their own rules, and this post does not cover them. If a business on your list sits outside the US, read that country's official guidance before you send. A list filtered to US addresses keeps you under one rulebook.
Is a legal cold email also a delivered one?
No. The law and the inbox are run by different people.
The FTC's guide describes what the law asks. Mailbox providers decide what reaches the inbox, and they ask for more. Google's email sender guidelines ask anyone who emails personal Gmail accounts for SPF or DKIM authentication, a spam rate below 0.3% and an easy way to unsubscribe. A cold email can meet all eight FTC requirements and still land in spam.
That is the case for sending fewer, better-aimed emails. Our guide to cold email deliverability covers the setup. If the term itself is new to you, start with what a cold email is, and the cold email guide covers the rest of the channel.
Questions
Do I need permission to send a cold email in the US?
No. The FTC's eight CAN-SPAM requirements do not include getting permission before the first email. They do require a working way to opt out, and you must honor a request within 10 business days. Some countries, Canada among them, ask for consent first. This is not legal advice.
Does the CAN-SPAM Act apply to B2B email?
Yes. The FTC's guide says, "The law makes no exception for business-to-business email." An email from your agency to a local business owner is covered in the same way as an email to a consumer.
What is the penalty for breaking the CAN-SPAM Act?
Each separate email in violation can bring a penalty of up to $53,088, according to the FTC's guide. More than one party can be held responsible for the same email.
Does a cold email need an unsubscribe link?
It needs a clear way to opt out. The FTC's guide accepts a return email address or another easy internet-based way, so a line that says "reply stop" can do the job when a person reads the replies. Sending tools often add a link. Either way, the request must be honored within 10 business days.
Do I need a physical address in a cold email?
Yes. Requirement 4 asks for a valid physical postal address. The guide accepts a current street address, a post office box registered with the US Postal Service or a private mailbox registered with a commercial mail receiving agency.
Next step. See how your Outbound Machine posts the letter, sends three emails under your agency's name and stops for every business that replies. Outbound Machine.
