CAN-SPAM and Cold Email: The 7 Rules US Senders Must Follow (2026)

Is cold email legal under CAN-SPAM

CAN-SPAM covers all commercial messages, which the law defines as “any electronic mail message the primary purpose of which is the commercial advertisement or promotion of a commercial product or service.” That includes cold B2B outreach. The law makes no exception for business-to-business email.

What often surprises people: CAN-SPAM is permissive. You can email a cold prospect first, as long as you identify yourself, don’t mislead, and offer an unsubscribe. There’s no opt-in requirement. The law simply says you have to give recipients a way out after you’ve sent the message.

This is the fundamental difference between US law and the rules in Europe or Canada. Under GDPR, you typically rely on a lawful basis like “legitimate interest” before emailing a B2B contact. Under CASL, you typically need express or implied consent before sending commercial messages to Canadian recipients. “Implied consent” exists if you’ve had a prior business relationship with the contact, but it expires after two years. Cold outreach with no prior relationship requires express consent first.

So if you’re emailing US-based prospects with no prior relationship, CAN-SPAM allows it. However, “allowed” comes with seven specific rules.

The 7 CAN-SPAM requirements every cold email sender follows

Each separate email in violation of the CAN-SPAM Act is subject to penalties of up to $53,088. Here are the requirements, drawn from the FTC’s compliance guide:

1. Do not use false or misleading header information

Your “From,” “To,” “Reply-To,” and routing information, including the originating domain name and email address, must be accurate and identify the person or business who initiated the message.

In practice, this means your sending domain, your display name, and your reply address all match your real identity. Sending from “john@bigcorp.com” when you work at a different company is a violation.

2. Do not use deceptive subject lines

The subject line must accurately reflect the content of the message. Subject lines like “Re: our call yesterday” when no call took place, or “Your invoice” when there’s no invoice, violate the Act.

You might be thinking: where’s the line between “creative” and “deceptive”? A good test is whether a reasonable person reading the subject would feel misled after opening the email. If the answer is yes, rewrite it.

3. Identify the message as an ad where applicable

The law gives you a lot of leeway in how to do this, but you must disclose clearly and conspicuously that your message is an advertisement. In B2B cold email, this is rarely an issue since most outreach reads as a business conversation rather than a promotional blast. Still, if your email is primarily selling a product or service, the commercial nature has to be clear from context.

4. Include your valid physical postal address

Your message must include your valid physical postal address. This can be your current street address, a post office box you’ve registered with the U.S. Postal Service, or a private mailbox you’ve registered with a commercial mail receiving agency.

Most cold email senders add this to their email signature. A PO Box or registered virtual mailbox counts.

5. Tell recipients how to opt out

The law requires that every commercial email includes a clear and conspicuous opt-out mechanism, but it does not specifically require a clickable unsubscribe link.

You can comply by including a plain-text line like “Reply to this email if you’d like to opt out.” As long as recipients have a clear, functioning way to remove themselves from your outreach, you’re covered.

For cold email specifically, many outbound teams prefer a reply-based opt-out because it keeps the message feeling like a 1:1 conversation rather than a marketing blast. However, mailbox providers’ bulk-sender rules (Gmail and Yahoo since 2024) require one-click unsubscribe headers at volume. If you’re sending at scale, an unsubscribe link is the safer approach.

Tip: Tools like lemlist let you add an unsubscribe link or reply-based opt-out to every email in a sequence automatically, and sync suppression lists across your entire sending infrastructure, so opt-outs are honored everywhere at once.

6. Honor opt-out requests within 10 business days

Any opt-out mechanism you offer must be able to process opt-out requests for at least 30 days after you send your message. You must honor a recipient’s opt-out request within 10 business days.

Ten days is the legal maximum. In reality, you want to process opt-outs immediately. Someone who opted out and receives another email within that window is more likely to file a spam complaint than a formal legal complaint. Spam complaints hurt your sender reputation directly.

If a prospect replies “remove me” and your team re-adds them two weeks later, that’s a violation. This often happens when teams run outreach across separate tools without a unified suppression list.

7. Monitor what others do on your behalf

The law makes clear that even if you hire another company to handle your email marketing, you can’t contract away your legal responsibility to comply with the law. If you use an agency, a freelancer, or an outbound tool to send emails for you, you’re still on the hook for every message.

CAN-SPAM penalties and real enforcement

The fine can reach $53,088 per email for the rest of 2026. The FTC confirmed in the Federal Register on 15 September that its civil penalty amounts will not change this year and that it will keep applying the 2025 levels.

That’s per individual email. It is assessed per individual email, not per campaign. A 1,000-email campaign where every message is non-compliant has a theoretical exposure of over $53 million.

And the FTC does enforce it. Verkada was required to pay a $2.95 million monetary penalty to settle allegations the company inundated prospective customers with commercial emails in violation of the CAN-SPAM Act, the largest penalty obtained by the FTC for a CAN-SPAM violation. The complaint alleged that Verkada violated CAN-SPAM by flooding prospective customers with commercial emails and failing to include the option to unsubscribe or opt-out, honor opt-out requests, and provide a physical postal address.

Beyond the FTC, the CAN-SPAM Act has certain aggravated violations that may give rise to additional fines. The law provides for criminal penalties, including imprisonment, for accessing someone else’s computer to send spam without permission, using false information to register for multiple email accounts or domain names, and harvesting email addresses.

CAN-SPAM vs GDPR vs CASL for cold email

If your prospects are only in the US, CAN-SPAM is the law that applies. But most outbound teams reach people across borders. Here’s how the three major frameworks compare:

Under CASL, consent can be implied instead of express in defined windows. A purchase creates implied consent for 2 years and an inquiry creates it for 6 months. Outside of those windows, you generally can’t cold email Canadian recipients.

The practical takeaway: segment your lists by recipient country and apply the strictest relevant law to each segment. If a contact is in Canada, follow CASL. If they’re in the EU, follow GDPR. If they’re in the US, follow CAN-SPAM.

CAN-SPAM compliance checklist for cold email campaigns

Here’s a quick reference you can use before any sequence goes live:

• •

  Accurate “From” name and reply-to: Both match your real identity and business

• •

  Honest subject line: Reflects the actual email content, no fake “Re:” or “Fwd:”

• •

  Physical postal address: In the email signature or footer (PO Box is fine)

• •

  Clear opt-out mechanism: Either a reply-based opt-out line or an unsubscribe link

• •

  Opt-outs honored immediately: Suppression applied within hours, synced across all tools

• •

  Global suppression list: One list that prevents re-enrollment across every campaign and every tool

• •

  Third-party oversight: If agencies or contractors send on your behalf, you’ve verified their compliance

The biggest operational risk on this list is the suppression sync. If a prospect unsubscribes in one tool but stays active in another and gets re-enrolled in a new sequence two months later, that violates CAN-SPAM’s 10-day opt-out requirement.

In lemlist, the blacklist feature syncs suppression across all campaigns and sending accounts, so a contact who opts out of one sequence is automatically blocked from every future send. This works whether the opt-out came through an unsubscribe link or a manual reply.

→ Try lemlist (no credit card required)

Compliance and deliverability protect each other

Following CAN-SPAM isn’t just about avoiding fines. The same behaviors that keep you legal also keep your emails out of spam folders.

Honest subject lines and accurate “From” information reduce spam complaints. A working opt-out that you honor quickly tells mailbox providers (Gmail, Outlook) that you’re a legitimate sender. Verified, targeted lists lower bounce rates, which protects your domain reputation.

On the other hand, the fastest way to destroy deliverability is also the fastest way to break CAN-SPAM: misleading headers, no opt-out, and a dirty list.

Gmail’s bulk sender requirements enforce SPF, DKIM, and DMARC authentication, require one-click unsubscribe support, and demand low complaint rates. These expectations overlap almost perfectly with CAN-SPAM compliance. If you’ve built your outbound around the law, you’re already most of the way toward good inbox placement.

lemlist’s Deliverability Hub monitors mailbox and domain health, pre-checks campaigns for risky content before they send, and rotates across inboxes to protect your reputation at scale. Every account also includes lemwarm, which builds sender reputation automatically for new domains and mailboxes.

Send cold email that lands and stays compliant

CAN-SPAM gives US senders a clear, workable framework: tell the truth, give people a way out, and honor it quickly. The law isn’t complicated. The hard part is operationalizing it across every campaign, tool, and team member.

That’s where having everything in one platform pays off. lemlist covers lead sourcing, email verification, multichannel sequencing, opt-out handling, and deliverability monitoring in a single workflow, so compliance doesn’t depend on manual checklists or multi-tool duct tape.

→ Try lemlist (no credit card, cancel anytime)