Is cold email legal?
In the United States, yes, under CAN-SPAM. It does not require the recipient's prior consent. It does require honest headers, a physical address, and a working opt-out honored within ten business days.
The short answer
- In the United States, cold email is legal under the CAN-SPAM Act. The FTC describes it as an opt-out law: prior consent is not required before sending a commercial email, but every message must meet specific requirements.
- CAN-SPAM requires accurate 'From' and routing information, a non-deceptive subject line, clear identification as an advertisement where applicable, a valid physical postal address, and a working opt-out honored within 10 business days, per the FTC's compliance guidance.
- The FTC states plainly that CAN-SPAM makes no exception for business-to-business email. Every commercial email to a US recipient is covered by the same rules, whether the recipient is a business contact or a consumer.
- Legality outside the US varies by jurisdiction and is often stricter. GDPR in the EU and CASL in Canada, among others, apply different and more consent-oriented rules to the same kind of outbound email.
Why 'legal' does not mean 'permission-free'
CAN-SPAM's core design is what the FTC calls an opt-out framework. A sender does not need the recipient's permission before the first email. But every message has to meet a specific set of requirements, and the recipient has to be given a real way to stop future messages. That is different from a consent-based system, where permission is required before any contact happens at all.
The FTC's compliance guide lists the core requirements directly. Accurate header and routing information, so the recipient can tell who sent the message. A subject line that does not misrepresent the content. Clear identification as an advertisement when the message is promotional. A valid physical postal address in the email. A clear, working opt-out. And opt-out requests honored within 10 business days. The guide also states that the law makes no exception for business-to-business email. That closes a common misconception that B2B outreach sits outside CAN-SPAM's scope.
Penalties are per violation, not per campaign. The FTC's guidance puts the maximum civil penalty at up to $53,088 per violation as of 2026. Both the company whose product is promoted and the company that sent the message can be held responsible, even when a third party was hired to handle the sending.
CAN-SPAM's core requirements
| Requirement | What it means |
|---|---|
| Accurate headers | The 'From', 'To' and routing information must be truthful, not disguised or misleading |
| Honest subject line | Must not misrepresent the email's actual content |
| Ad disclosure | Promotional messages must be identifiable as advertisements |
| Physical address | A valid postal address, PO box, or registered mailbox must be included |
| Working opt-out | A clear, functioning way to unsubscribe, honored within 10 business days |
Source: FTC's CAN-SPAM Act Compliance Guide for Business, ftc.gov, checked September 2026.
What this means in practice for a cold outbound program
Legality under CAN-SPAM is a floor, not a strategy. Meeting the letter of the law, correct headers, a real address, a working unsubscribe, does not by itself make a cold email program effective or well received. Deliverability, list quality and relevance still decide whether messages reach an inbox and get a response. It also does not cover obligations outside CAN-SPAM. A recipient's own jurisdiction may impose separate, stricter rules, wherever the sender is located.
Disclosure: SalesCrew is our product. It allows cold outbound as a matter of product policy, with suppression enforced when an audience is frozen and again at send time. It does not determine your legal obligations under CAN-SPAM or any other law. Those obligations stay with the sender, whichever tool is used to send.
CAN-SPAM compliance does not cover every jurisdiction
Questions
- Does CAN-SPAM apply to B2B cold email specifically?
- Yes. The FTC states explicitly that CAN-SPAM makes no exception for business-to-business email. Every commercial email to a US recipient is covered, whether the recipient is a business or a consumer.
- What is the penalty for violating CAN-SPAM?
- Up to $53,088 per violation as of 2026. Each non-compliant email can count as a separate violation, with no cap on the total across a campaign. Both the company whose product is promoted and the company that sent the message can be held liable.
- Does CAN-SPAM legality mean cold email is legal everywhere?
- No. Legality varies by jurisdiction. CAN-SPAM governs email to US recipients. Other countries and regions, including the EU under GDPR and Canada under CASL, apply different and often stricter rules to the same kind of email.