CAN-SPAM and Cold Email: What the Law Actually Requires

CAN-SPAM does not require permission before you send a cold email, and it applies to B2B mail the same as consumer mail. It requires seven things of every commercial message: accurate headers, a non-deceptive subject line, identification as an ad, a valid postal address, a working opt-out, opt-outs honoured within 10 business days, and responsibility for anyone sending on your behalf.

This post quotes the law and the Federal Trade Commission's own guidance, then applies each rule to the way cold email is actually sent in 2026: rotating secondary domains, sequencing tools and multiple inboxes. This is not legal advice. If your situation has real exposure, take the primary sources below to a lawyer.

What counts as a commercial email under CAN-SPAM?

A message is covered if its primary purpose is commercial, whether you send one or a million. The FTC's CAN-SPAM Act: A Compliance Guide for Business puts it plainly:

"Despite its name, the CAN-SPAM Act doesn't apply just to bulk email. It covers all commercial messages, which the law defines as 'any electronic mail message the primary purpose of which is the commercial advertisement or promotion of a commercial product or service'... The law makes no exception for business-to-business email."

That last sentence settles a common myth in cold email circles. A pitch to a head of operations at a 200-person company is covered in the same way as a pitch to a consumer.

The FTC splits message content into three kinds: commercial, "transactional or relationship" (order confirmations, account notices, warranty information and similar), and "other". Mixed messages are judged by the subject line and by what comes first. The guide says that if "a recipient reasonably interpreting the subject line would likely conclude that the message contains an advertisement or promotion... the primary purpose of the message is commercial."

For cold outreach the answer is almost always simple. A first-touch email offering your service has no transactional content at all. Treat every step of a sales sequence as commercial.

Does CAN-SPAM require consent before cold emailing?

No. CAN-SPAM is an opt-out law: it governs the form of the message and what happens after someone asks you to stop. None of the requirements the FTC lists asks for prior permission, and the guide notes in another context that "you don't need to get members' consent to send them marketing emails" while preserving their right to opt out.

The statute only uses "affirmative consent" in narrow places, for example in 15 U.S.C. 7704(a)(5)(B), which waives the ad-identification requirement where "the recipient has given prior affirmative consent". It also governs sexually explicit mail separately. Neither applies to a normal B2B cold email.

That is US law only. If any recipients are in Canada, the EU or the UK, different and stricter rules apply. See CASL and cold email to Canada and GDPR and B2B cold email.

The seven requirements, applied to a cold sequence

Each requirement below comes from the FTC guide, with the statutory section it rests on. The right-hand column is where cold email setups tend to slip.

Requirement (FTC wording)	Statute	Where cold email goes wrong
"Don't use false or misleading header information."	7704(a)(1)	Personas or domains that obscure which business is actually sending
"Don't use deceptive subject lines."	7704(a)(2)	"Re:" or "Fwd:" on a first message, fake meeting confirmations
"Identify the message as an ad."	7704(a)(5)(A)(i)	Assumed not to apply to one-to-one-looking email
"Tell recipients where you're located."	7704(a)(5)(A)(iii)	Footer stripped out to make the email look personal
"Tell recipients how to opt out..."	7704(a)(3), (a)(5)(A)(ii)	No opt-out at all on follow-ups 2 to 5
"Honor opt-out requests promptly."	7704(a)(4)	Opt-out recorded in one tool, not in the others
"Monitor what others are doing on your behalf."	7704(a)(4)(A)(ii)-(iii)	Agency or freelancer runs the sends, client assumes it is covered

1. Headers must identify who initiated the message

The FTC wording: your "From," "To," "Reply-To," and routing information "must be accurate and identify the person or business who initiated the message." The statute adds that a From line "that accurately identifies any person who initiated the message shall not be considered materially false or materially misleading."

Secondary domains are common in cold email, and the law does not ban them. What it targets is identity: the statute treats an originating address or domain "obtained by means of false or fraudulent pretenses or representations" as materially misleading. A secondary domain registered openly by your business and sending under a real person's name is a different thing from a persona that exists only to hide the sender. Our guide to setting up secondary domains covers the technical side.

2. Subject lines must reflect the content

The guide: "The subject line must accurately reflect the content of the message." The statute's test is whether the subject "would be likely to mislead a recipient, acting reasonably under the circumstances, about a material fact regarding the contents or subject matter of the message."

Faking a reply thread on a first email is the obvious risk. So are subjects such as "Your invoice" or "Following up on our call" when there was no invoice and no call.

3. The message must be identifiable as an ad

This is the requirement cold emailers most often assume does not apply to them. The statute requires "clear and conspicuous identification that the message is an advertisement or solicitation". The FTC adds that "the law gives you a lot of leeway in how to do this".

The law does not prescribe a word or a label. It does not exempt short, plain-text messages either. How you meet this is a judgement to make with counsel, but "it reads like a personal note" is not one of the exceptions in the text.

4. A valid physical postal address

The FTC rule at 16 CFR 316.2 defines it as "the sender's current street address, a Post Office box the sender has accurately registered with the United States Postal Service, or a private mailbox the sender has accurately registered with a commercial mail receiving agency".

Founders working from home often use a registered PO box or a private mailbox service for this reason. A virtual office address that is not registered as a commercial mail receiving agency is worth checking against that wording.

5. A working opt-out, kept alive for 30 days

The statute requires "a functioning return electronic mail address or other Internet-based mechanism, clearly and conspicuously displayed", which "remains capable of receiving such messages or communications for no less than 30 days after the transmission of the original message."

Two consequences for cold email:

• A reply address can be the mechanism. The rule at 16 CFR 316.5 says recipients cannot be required to "take any other steps except sending a reply electronic mail message or visiting a single Internet Web page". A line telling people to reply if they want no more emails is built on that text. It only works if someone actually reads and actions those replies.
• The 30 days outlive your domain rotation. If you retire a secondary domain or delete an inbox the week after a campaign, replies to it stop arriving. Keep every sending inbox able to receive mail for at least 30 days after its last send. The statute does forgive a mechanism that is "unexpectedly and temporarily unable" to receive requests because of a problem "beyond the control of the sender". Deleting the mailbox yourself is not that.

The FTC also says: "Make sure your spam filter doesn't block these opt-out requests." Angry replies to cold email are often caught by filters or auto-archived by sequencing tools. Check that folder.

6. Honour opt-outs within 10 business days, across everything you send

The statute makes it unlawful to keep sending "more than 10 business days after the receipt of such request". The key phrase is that the request is about messages "from that sender", and the sender is the business being promoted, not the inbox.

This is the requirement modern cold email setups break most often. A team running 20 inboxes across five domains in two sequencing tools has, in practice, several separate suppression lists. Someone who opts out from alex@getacme.co is still due to get step one from alex@tryacme.io next month, from a different campaign. Under the text, that is still the same sender.

The practical fix is one master suppression list, keyed on the recipient's address. Every tool and every campaign checks it before sending. Add opt-outs to it the same day, not when someone gets round to it.

Two more parts of the same subsection matter for lead data:

• You may not "sell, lease, exchange, or otherwise transfer or release" an address that has opted out, except for compliance purposes. Do not include opted-out contacts in a list you share with a partner.
• 16 CFR 316.5 bars requiring "any information other than the recipient's electronic mail address and opt-out preferences". An unsubscribe page that asks for a reason is fine only if the reason is optional.

7. You cannot contract out of it

The guide: "even if you hire another company to handle your email marketing, you can't contract away your legal responsibility to comply with the law. Both the company whose product is promoted in the message and the company that actually sends the message may be held legally responsible."

If an agency runs your outbound, you need visibility of its suppression handling. If you are the agency, your client's opt-outs from earlier campaigns are your problem too.

Address harvesting and permutation guessing

CAN-SPAM includes "aggravated violations" in 7704(b). One is relevant to how cold email lists get built. It covers addresses "obtained using an automated means that generates possible electronic mail addresses by combining names, letters, or numbers into numerous permutations", and addresses scraped from sites that publish a notice that they do not give addresses away.

Read the condition carefully. This subsection applies to a message "that is unlawful under subsection (a)". The FTC guide lists "harvesting email addresses or generating them through a dictionary attack" among the conduct that can bring criminal penalties.

This is directly relevant to email finders, including ours, which build candidate addresses from a name and domain and then check them over SMTP. How the aggravation provisions apply to your own list sourcing is a question for a lawyer. What the text makes clear is that how you got an address can raise the stakes for any other breach. It does not lower the bar for the rest. For the broader collection question across the US, UK and EU, see is it legal to collect business emails.

Penalties, and who can be liable

The FTC guide, as read on 1 October 2026, says: "Each separate email in violation of the CAN-SPAM Act is subject to penalties of up to $53,088". It also notes that "more than one person may be held responsible for violations".

The figure applies per email. A five-step sequence to 2,000 people is up to 10,000 separate messages. The FTC adjusts this maximum for inflation, so check the guide for the current figure rather than relying on this post.

Does CAN-SPAM override state anti-spam laws?

Mostly, but not entirely. 15 U.S.C. 7707(b)(1) says the Act supersedes state laws that expressly regulate commercial email, "except to the extent that any such statute, regulation, or rule prohibits falsity or deception in any portion of a commercial electronic mail message". State rules against deceptive email survive, which is one more reason the header and subject-line rules deserve the most care.

CAN-SPAM is the legal floor, not the deliverability bar

Meeting CAN-SPAM does not get you to the inbox. Mailbox providers set their own rules for bulk senders, and those rules are stricter in places. Google and Yahoo expect one-click unsubscribe headers from bulk senders, which CAN-SPAM does not require. See Gmail and Yahoo bulk sender requirements and the implementation guide to one-click unsubscribe.

The law also says nothing about bounces. Sending to dead addresses is not a CAN-SPAM violation, but it is the fastest way to get a cold email domain filtered. That is a list hygiene problem, not a legal one.

A compliance checklist for your next sequence

1. Every step of the sequence, not just the first, carries an opt-out instruction and your postal address.
2. The postal address meets the 16 CFR 316.2 definition.
3. Subject lines describe the email. No fake "Re:" or "Fwd:" on a first touch.
4. The From name is a real person or your business, on a domain your business registered openly.
5. One master suppression list covers every domain, inbox and tool, and is updated within days, not weeks.
6. Retired inboxes keep receiving mail for at least 30 days after their last send.
7. Opt-out replies are not lost to spam filters or auto-archive rules.
8. Anyone sending on your behalf uses your suppression list.
9. Recipients outside the US are split out and handled under their own law.

Most of this is process, not copy. The common failures are a suppression list that does not follow the recipient across domains, and an inbox deleted before its 30 days are up.

Before the next campaign, run the list through a verifier so that the people who can reply to you are real.