Is Cold Email Legal in the U.S.? CAN-SPAM Explained for B2B Teams (2026)

Is cold email legal in the United States? Yes. Sending an unsolicited sales email to a business contact is legal under federal law, as long as the message follows the CAN-SPAM Act. There is no rule that says you need permission before the first email. There are rules about how you identify yourself, what your subject line says, where you are located, and how fast you stop emailing people who ask you to.

We run cold email for U.S. B2B companies every week. This guide covers what the law requires, what it does not, and the habits that keep a campaign compliant in 2026.

Not legal advice. This article is general information based on the FTC's published guidance and the statute text, current as of October 2026. It is not legal advice. Laws change and facts matter, so talk to a qualified attorney about your specific situation.

Is cold email legal? The short answer for U.S. B2B teams

The federal law that governs commercial email is the CAN-SPAM Act of 2003, enforced by the Federal Trade Commission. The FTC's CAN-SPAM Act: A Compliance Guide for Business is the best plain-English source, and most of this article follows it closely.

The key point many people miss: CAN-SPAM does not ban unsolicited email. It sets conditions for sending it. The FTC describes the law as one that "establishes requirements for commercial messages, gives recipients the right to have you stop emailing them, and spells out tough penalties for violations."

So the honest answer to "is cold email legal" is yes, when it is done properly. Trouble starts when teams hide who they are, use tricky subject lines, or keep emailing people who said no.

What CAN-SPAM covers (and why B2B is not exempt)

CAN-SPAM is not just about bulk blasts. It covers any email whose "primary purpose" is advertising or promoting a commercial product or service. A one-to-one cold email pitching your services counts.

Here is the line most B2B teams want to hear about. The FTC guide states: "The law makes no exception for business-to-business email." If you email a VP of Operations at her work address to offer your software, the same rules apply as if you emailed a consumer.

Commercial vs. transactional messages

The FTC splits email content into three types:

• Commercial: promotes a product or service. Full CAN-SPAM rules apply.
• Transactional or relationship: confirms a purchase, sends warranty or safety info, or updates an existing account. Mostly exempt, but routing information must still be accurate.
• Other: neither commercial nor transactional.

Cold outreach is commercial by nature. Do not dress it up as transactional with a subject like "Your account update." The FTC reads those categories "narrowly."

The CAN-SPAM requirements, explained for cold email

Here are the FTC's main requirements, translated for a B2B outbound program.

1. Accurate header information

Your "From," "To," "Reply-To," and routing information, "including the originating domain name and email address," must be accurate and identify the person or business that started the message. A real person's name at a domain your company actually controls is the safe pattern.

This matters if you send from secondary domains, which most serious cold email programs do to protect the main company domain. A secondary domain is fine. A domain that hides who you are is not. The sender name, signature and website should all point back to the real business.

2. Honest subject lines

The FTC is direct: "The subject line must accurately reflect the content of the message." Fake "Re:" or "Fwd:" prefixes on a first-touch email, fake invoice subjects, and bait-and-switch lines invite legal trouble and spam complaints.

3. Identify the message as an ad

You must "disclose clearly and conspicuously that your message is an advertisement." The FTC notes the law gives "a lot of leeway in how to do this." Cold email is usually plain text and personal in tone, so this is the requirement teams most often gloss over. Do not disguise a sales email as a personal note from a friend. Decide with your counsel how you will make the commercial nature clear, then apply it to every template.

4. A valid physical postal address

Every commercial email must include your "valid physical postal address." According to the FTC, that can be your street address, a P.O. box registered with the U.S. Postal Service, or a private mailbox registered with a commercial mail receiving agency under Postal Service rules.

Founders who work from home often use a registered private mailbox instead of publishing a home address.

5. A clear way to opt out

Each email needs "a clear and conspicuous explanation of how the recipient can opt out." The FTC says to give "a return email address or another easy Internet-based way" to do it. You can offer a menu of preferences, but one option must stop all marketing email from you. The FTC also warns: "Make sure your spam filter doesn't block these opt-out requests."

In cold email, a simple line such as "If this isn't relevant, reply 'no thanks' and I won't email you again" can serve as the mechanism, as long as replies are actually monitored and processed. Many teams also add an unsubscribe link.

6. Honor opt-outs fast, and watch your vendors

Opt-outs have hard deadlines, covered in the next section. And if you hire an agency, the FTC says "you can't contract away your legal responsibility." More on liability below.

Opt-out handling timelines: what the clock actually says

The FTC's rules on opt-outs are specific. Here they are in one place.

The practical fix is a suppression list: one master list of everyone who opted out, bounced, or asked not to be contacted, checked before every new campaign. Someone who opts out once should never appear in the next campaign.

B2B vs. B2C cold email: what changes and what does not

Under CAN-SPAM, almost nothing changes. The differences show up in other laws.

This is why legitimate cold email is almost entirely a B2B practice. A relevant note to a business owner about a business problem is normal commerce. A cold pitch to a personal inbox is a much harder sell.

Who is liable: you, your agency, or both?

Many companies assume that if an agency sends the emails, the agency carries the risk. The FTC says otherwise: "Both the company whose product is promoted in the message and the company that actually sends the message may be held legally responsible."

That has three practical effects:

• Vet your vendor. Ask how they handle opt-outs, which domains they send from, and how they source data.
• Own the suppression list. If you switch agencies, the opt-out list comes with you. The FTC allows transferring addresses to a company "you've hired to help you comply."
• Approve the copy. Subject lines and claims go out under your brand.

If you are comparing agencies, ask to see the process in writing. Our own 4-step cold email process shows where list verification and suppression fit before any email is sent.

CAN-SPAM penalties in 2026

The FTC guide states that "each separate email in violation of the CAN-SPAM Act is subject to penalties of up to $53,088." Because penalties are counted per email, a campaign of a few thousand non-compliant messages creates very large theoretical exposure.

Will that number change in 2026? No. In a Federal Register notice published September 15, 2026, the FTC announced that its civil penalty amounts "will remain unchanged during 2026" and that it "will continue to apply the 2025 civil penalty levels." The 2026 adjustment was cancelled because the government shutdown left BLS unable to produce the October 2025 inflation data it depends on.

The FTC is not the only enforcer. The statute's enforcement section (15 U.S.C. 7706) also lets other federal agencies act in their sectors, lets state attorneys general sue on behalf of residents for statutory damages of up to $250 per violation (capped at $2 million for most violations, with up to triple damages in aggravated cases), and lets internet access providers that are harmed sue as well.

The FTC also notes that the law provides for criminal penalties, including imprisonment, for things like:

• using false information to register for multiple email accounts or domain names,
• harvesting email addresses or generating them through a dictionary attack,
• relaying spam through a computer to mislead people about where it came from,
• accessing someone else's computer to send spam without permission, and
• using open relays or open proxies without permission.

The first item matters if you run secondary sending domains. Register every one with your real business details.

How state laws interact with CAN-SPAM (preemption and California)

Before 2003, many states had their own anti-spam laws. CAN-SPAM largely replaced them. Under 15 U.S.C. 7707(b), the federal law "supersedes any statute, regulation, or rule of a State" that "expressly regulates the use of electronic mail to send commercial messages."

There is an important exception. States keep their power "to the extent that any such statute, regulation, or rule prohibits falsity or deception" in a commercial email. CAN-SPAM also does not preempt general state laws on trespass, contract, tort, fraud or computer crime.

The California example

California's Business and Professions Code Section 17529.5 is the best-known state law that sits in that falsity-and-deception lane. It makes it unlawful to send an email ad that:

• uses a third party's domain name without permission,
• contains falsified, misrepresented or forged header information, or
• has a subject line the sender knows would likely mislead a reasonable recipient about a material fact.

Unlike CAN-SPAM, the California statute lets the recipient of an unsolicited email ad sue, along with the Attorney General and email service providers. Liquidated damages are $1,000 per message, up to $1 million per incident. The court reduces that to a maximum of $100 per message, or $100,000 per incident, if the sender shows it had reasonable practices in place, applied with due care, to prevent violations.

Honest headers and honest subject lines protect you under federal law and under the state laws that survive preemption. If you email prospects nationwide, as our clients do in all 50 states, build to that standard everywhere.

State privacy laws and B2B contact data

CAN-SPAM is about the email itself. State privacy laws are about the personal data you collect and use, including the prospect list behind your campaign.

California (CCPA)

The California Consumer Privacy Act applies to for-profit businesses that do business in California and meet certain revenue or data-volume thresholds, according to the California Attorney General. It gives residents rights to know, delete, correct, and opt out of the sale or sharing of their personal information.

For B2B teams, the key date has passed. The Attorney General's page confirms that the exemptions for employment data and personal information "reflecting business-to-business transactions" expired on December 31, 2022. If your company is covered, a California prospect's name, work email and title in your CRM are generally treated like other personal information, so you need to be able to answer a request to know or delete it.

Other states

Many other comprehensive state privacy laws take a different approach. Virginia's law, for example, defines a "consumer" as a resident "acting only in an individual or household context" and states that it "does not include a natural person acting in a commercial or employment context." Details vary by state and keep changing.

Good habits cover most of the ground: source data from reputable providers, record where each contact came from, and have a simple process for deletion requests.

TCPA: a different law for calls and texts

People often mix up CAN-SPAM with the Telephone Consumer Protection Act (TCPA). The TCPA governs phone calls and text messages, not email.

The rules are stricter. According to the FCC, callers need prior written consent before making prerecorded telemarketing calls, autodialed texts to mobile phones are banned without prior consent (except emergencies), and commercial texts require written consent.

If you add cold calling or SMS to your outbound program, treat those channels as a separate compliance project.

Sending outside the U.S.: Canada (CASL) and the EU (GDPR)

U.S. rules do not travel. If your list includes Canadian or European contacts, slow down.

Canada: CASL

Canada's Anti-Spam Legislation requires three things, per the CRTC's CASL FAQ: consent, identification information, and an unsubscribe mechanism. Unlike CAN-SPAM, consent comes first.

There is a narrow path for B2B. Consent can be implied when a person has "conspicuously published" their address, has not said they do not want unsolicited messages, and the message is relevant to their business role. The CRTC calls this "a higher standard" than simple public availability. An address you found by running specific queries in a database does not count. Unsubscribe links must work for at least 60 days, and requests must be processed within 10 business days. Maximum penalties are $1 million per violation for individuals and $10 million for businesses.

European Union: GDPR

The GDPR protects personal data of people in the EU, and a work email that names a person is personal data. The European Commission notes that direct marketing can rest on "legitimate interests," but only after checking that the person's rights are not seriously impacted. You must tell people, at the latest at your first communication, that you are processing their data and that they can object at any time. Email marketing must also follow the ePrivacy Directive, which each country applies through its own national rules.

Our default: keep U.S. campaigns to U.S. contacts, and get country-specific advice before going international.

What compliant cold email looks like in practice

Compliance is a set of habits built into campaign setup. Here is how we run it for clients.

• An opt-out in every email. No exceptions, including follow-ups. A "no thanks" reply is treated as an opt-out, not as an objection to overcome.
• A shared suppression list. Opt-outs, bounces and do-not-contact requests are added the same day and checked before every launch.
• Separate sending domains. Secondary domains keep the client's main domain safe, and every one is registered with real business details and clearly tied to the client's brand.
• Verified lists and no open tracking. Addresses are verified before sending, and open tracking is off on purpose because tracking pixels hurt deliverability (our dashboards show zero opens for that reason).
• Relevant, honest copy. Plain subject lines that match the email, sent on weekdays during business hours in the prospect's time zone.

More numbers, with live dashboards, are on our cold email case studies page.

Cold email compliance checklist for B2B teams

Use this before every new campaign. It reflects the FTC's requirements plus the operating habits that make them easy to keep.

1. Confirm the email is commercial and that every CAN-SPAM requirement applies. Assume B2B gets no exception.
2. Send from a real person's name at a domain your company owns, registered with accurate business information.
3. Write a subject line that accurately reflects the email. No fake "Re:" or "Fwd:" on first touches.
4. Decide, with counsel, how each template clearly discloses that it is an advertisement.
5. Include a valid physical postal address: a street address, a registered USPS P.O. box, or a registered private mailbox.
6. Include a clear opt-out in every email, including every follow-up step.
7. Monitor replies daily and make sure opt-out replies are never caught by a spam filter.
8. Honor every opt-out within 10 business days (aim for same day) and keep the mechanism working for at least 30 days.
9. Check every new list against a master suppression list before upload.
10. Never sell, share or transfer opted-out addresses, except to a company helping you comply.
11. Source contact data from reputable providers. Do not harvest addresses or guess them in bulk.
12. If you are covered by the CCPA, be ready to answer requests to know or delete B2B contact data.
13. Remove Canadian and EU contacts unless you have checked CASL or GDPR requirements.
14. If an agency sends for you, review its process and copy in writing. You share the liability.

Frequently asked questions

Is cold email legal in the U.S. without permission?

Yes. CAN-SPAM does not require consent before the first commercial email. It requires accurate sender information, an honest subject line, disclosure that the message is an ad, a valid physical postal address, and a working opt-out. Once someone opts out, you must stop within 10 business days. Other laws, such as state privacy rules or CASL for Canadian contacts, may add obligations, so check before expanding your list.

Does CAN-SPAM apply to B2B emails?

Yes. The FTC's compliance guide states that the law "makes no exception for business-to-business email." Any email whose primary purpose is promoting a commercial product or service must comply, whether it goes to a consumer's personal inbox or to an executive's work address. Only messages that are primarily transactional or relationship content, such as order confirmations, are mostly exempt from the full requirements.

What is the CAN-SPAM penalty per email in 2026?

Up to $53,088 for each email that violates the law. The FTC published a notice in the Federal Register on September 15, 2026, confirming that it will keep the 2025 civil penalty levels throughout 2026 because the annual inflation adjustment was cancelled. State attorneys general and internet access providers can also seek separate statutory damages under the Act.

How fast do I have to honor an unsubscribe request?

Within 10 business days under CAN-SPAM. Your opt-out method must also keep working for at least 30 days after you send the email. You cannot charge a fee or ask for more than an email address, and the recipient cannot be required to do more than reply or visit a single web page. Most well-run teams process opt-outs the same day.

Do I need a physical address in a cold email?

Yes. Every commercial email must include a valid physical postal address. The FTC says this can be your current street address, a post office box registered with the U.S. Postal Service, or a private mailbox registered with a commercial mail receiving agency. A registered private mailbox is a common choice for founders who do not want to publish a home address.

If an agency sends my cold emails, who is liable?

Possibly both of you. The FTC says the company whose product is promoted and the company that actually sends the message may both be held legally responsible, and you cannot contract that responsibility away. Choose a vendor that runs opt-outs and suppression lists properly, review the copy before launch, and make sure your suppression list stays with you.

Can I send cold emails to Canada or Europe?

Be careful. Canada's CASL requires consent first, though implied consent can apply when an address is conspicuously published and the message is relevant to the person's role. In the EU, GDPR and national ePrivacy rules apply, and you must tell people they can object at any time. Get country-specific legal advice before adding these contacts to a U.S. campaign.

About the authors

Syed Asim Hussain and Syed Ali Hassan run WayneFlow, a done-for-you B2B appointment setting agency for U.S. companies. Every number in this guide comes from campaigns we ran ourselves or from the sources linked. See our live dashboards.