Short answer: yes, cold email is legal in the US
Cold email is legal in the United States. Unlike the EU, the US does not require you to get permission before sending a first commercial email. You can email a stranger about your services, provided the message follows the CAN-SPAM Act.
The catch is that CAN-SPAM is a rulebook, not a loophole. The FTC's compliance guide says the law <u>makes no exception for business-to-business email</u>, so emailing a company owner at a work address does not exempt you. Break the rules and the maximum civil penalty is currently reported at $53,088 per violating email, according to compliance write-ups that cite the FTC's inflation-adjusted figure.
The rest of this guide explains what the rules require, what the law does not cover, and where small businesses actually get into trouble.
What CAN-SPAM actually requires
CAN-SPAM covers any email whose primary purpose is advertising or promoting a product or service. The FTC enforces it. Despite the name, the FTC states that it applies to all commercial email, not only bulk sends.
The core requirements, drawn from the FTC's compliance guide for business, are:
- Honest header information. Your "From", "To" and reply address must identify the real sender. No spoofed or misleading routing details.
- No deceptive subject lines. The subject must reflect what is inside the email.
- Identify the message as an ad. The FTC says you do not need specific wording or the word "advertisement". The message just must not disguise what it is.
- Include a valid physical postal address. This can be a current street address, a registered post office box, or a private mailbox registered with a commercial mail service.
- Explain how to opt out. The opt-out method must be easy for an ordinary person to recognise, read and understand. Recipients should not have to contact you directly or pay anything to stop receiving email.
- Honor opt-outs within 10 business days. The FTC sets this as the deadline, and the unsubscribe mechanism should keep working for 30 days after you send.
- Monitor what others do for you. If you hire a company to send email on your behalf, both you and that company can be held responsible.
That list is the whole legal baseline. If every email you send meets it, you are on the right side of federal law.
What CAN-SPAM does not require
Many owners assume cold email needs a signed opt-in, like a newsletter. It does not. CAN-SPAM works on an opt-out model, so you can send a first message without consent. Collecting opt-in is a good practice, not a legal condition.
It also does not ban emailing business addresses, scraping a public website for a contact, or sending follow-ups. What it bans is deception and ignoring requests to stop.
One thing to be careful about: a legal message is not the same as a welcome one. Legal compliance gets you out of FTC trouble. It does not stop a recipient marking you as spam, which brings a different problem (see below).
The penalties, in plain numbers
The FTC's maximum civil penalty is $53,088 per email that violates the law, reported by Transcend and Adaptive Security as the most recent inflation-adjusted figure, up from $51,744. The penalty applies per message, not per campaign.
In practice, that does not mean a small business sending 500 emails faces a $26 million fine. Enforcement tends to target large, deliberate or repeat offenders. But the per-email structure explains why the FTC treats ignored unsubscribes and fake headers seriously, and why a sloppy 5,000-email blast is a bad place to cut corners.
Your realistic exposure is usually less dramatic and more annoying: a complaint, an FTC inquiry, a blocked domain, or a reputation hit with your own customers.
Where small businesses get caught out
Most problems come from process failures, not intent. These are the common ones.
Unsubscribes that do not stick. If someone opts out in one tool and a second tool or an old list re-enrols them two months later, you have broken the 10-business-day rule. This is the most common mistake when a team runs more than one sending tool.
Vague or misleading subject lines. "Re: our call" or "Invoice attached" sent to someone you have never spoken to is the sort of subject line that gets you into trouble.
Missing postal address. It is easy to forget in a short, plain-text cold email. It needs to be in every message.
Bought lists. CAN-SPAM does not itself forbid a purchased list, but it does prohibit address harvesting and other practices the FTC treats as aggravating. Purchased lists also tend to have old addresses, spam traps and people who never expected to hear from you. Build or verify your own list instead.
Selling or sharing opt-out addresses. The FTC's guide says you may not sell or transfer the addresses of people who opted out. The only exception is giving them to a company you have hired to help you comply.
Rules beyond CAN-SPAM that affect you
Federal law is not the only thing to check.
State law. Some states have their own commercial email rules, and California's are generally considered stricter than the federal baseline. If you email California residents or businesses, have a lawyer review the current state requirements before you scale up. This guide does not cover them in detail and the exact exposure depends on your situation.
California privacy law. The CCPA gives California residents rights to access, delete and correct their personal data. If your prospect list includes California individuals, the way you collect, store and use their data matters, as well as the email you send. Business contact data can fall under these rules in some circumstances, so confirm with counsel how it applies to you.
Other countries. If your list includes recipients in the EU, UK or Canada, the rules change. The EU's GDPR requires a lawful basis, and Canada's CASL generally requires express or implied consent. Cold email that is fine in Texas can be a violation in Toronto. Filter your list by country before sending.
Text messages and phone calls. These fall under different laws, including the TCPA. Nothing here applies to cold texting or auto-dialed calls, which carry stricter consent rules.
Inbox providers enforce stricter rules than the law
For day-to-day results, the rules Google, Yahoo and Microsoft apply matter more than the FTC does. If your emails land in spam, being legal does not help.
According to PowerDMARC's summary of the requirements, the bulk sender rules apply once you send 5,000 or more emails per day to a provider's users. Those senders need authentication (SPF, DKIM and DMARC), a spam complaint rate under 0.3%, and a one-click unsubscribe that uses the RFC 8058 header standard. Most small businesses send far fewer than 5,000 a day, but the same signals still influence whether smaller senders reach the inbox.
The practical takeaways:
- Set up SPF, DKIM and DMARC on your sending domain before the first email.
- Send cold email from a separate domain or subdomain, not your main business domain, so a deliverability problem does not affect invoices and customer mail.
- Warm up new mailboxes gradually rather than sending hundreds of emails on day one.
- Keep volume per mailbox modest and your list clean.
- Stop emailing anyone who replies "remove me", even if the wording is not an official unsubscribe.
A pre-send compliance checklist
Run this before every campaign:
- The From name and address are real and identify your business.
- The subject line honestly describes the email.
- A working unsubscribe method is in every message.
- Your physical postal address is in every message.
- One shared suppression list covers every tool and every mailbox, and is updated within 10 business days at most. Same day is better.
- Your list excludes recipients in the EU, UK and Canada unless you have a lawful basis.
- Each address comes from a source you can name, not a mystery file.
- SPF, DKIM and DMARC pass on the sending domain.
- Anyone sending on your behalf has agreed in writing to follow these rules.
Do it yourself, or hire it out?
Compliance is not hard, but it is easy to let slip. If you send 50 hand-written emails a week to local businesses, a clean template, a postal address and a simple suppression spreadsheet may be all you need.
Once you run several mailboxes, multiple sequences or an outsourced team, the risk shifts to the system: shared suppression lists, domain setup, warm-up and monitoring. That is where a managed service can earn its fee. If you are weighing that route, <a href="https://www.zapplon.com/email-agents">AI-run cold email outreach</a> is one option, and whoever you choose should be able to show you how they handle opt-outs, list sourcing and domain setup. Under the FTC's guide, hiring someone does not move the legal responsibility away from you.
Cold email is a poor fit if you cannot name a clear audience, you have no offer that is relevant to them, or your customers are mostly private consumers who have never heard of you. In those cases, local SEO or paid ads usually produce better leads with fewer compliance questions.
FAQ
Do I need permission before sending a cold email in the US?
No. CAN-SPAM uses an opt-out model, so you do not need prior consent to send a first commercial email. You must include an unsubscribe method, honor requests within 10 business days, and meet the other rules above. Other countries, such as Canada and EU member states, do require consent or a lawful basis.
Does CAN-SPAM apply to B2B cold email?
Yes. The FTC's guide says the law makes no exception for business-to-business email. Emailing a manager at a company address carries the same obligations as emailing a consumer.
Can I use a purchased email list?
CAN-SPAM does not explicitly ban it, but it is risky. Purchased lists often include stale addresses, spam traps and people who never agreed to hear from you, which damages deliverability. If someone on the list has opted out of another sender, you may also have no way of knowing. A list you built and verified yourself is safer.
This is general information, not legal advice
The rules above are the federal baseline, and penalty figures are adjusted for inflation over time. If you plan to send at volume, email California residents, or reach recipients abroad, have a lawyer who handles marketing law check your process once. The cost is small compared with a single serious complaint.