CAN-SPAM Compliance for Cold Email 2026: What US Senders Must Know
🎯 What This Guide Covers
- Direct answer: is cold email legal, and under what conditions
- The 7 CAN-SPAM requirements explained in plain English
- How CAN-SPAM compares to GDPR and CASL
- A compliant email footer template you can copy today
- Real penalties and a pre-send compliance checklist
Is Cold Email Legal in the US?
Yes — this is one of the most misunderstood points in cold outreach. Many people assume "cold" email is inherently illegal or spam by definition. It isn't. The CAN-SPAM Act explicitly permits unsolicited commercial email, provided the sender meets a specific set of disclosure and opt-out requirements.
What CAN-SPAM prohibits isn't cold outreach itself — it's deception: fake sender information, misleading subject lines, no way to opt out, and ignoring opt-out requests once received.
The 7 CAN-SPAM Requirements Explained Simply
- Don't use false or misleading header information. Your "From," "To," and routing information must accurately identify who's sending the email.
- Don't use deceptive subject lines. The subject must reflect the actual content of the email.
- Identify the message as an ad if it is one. This mostly matters for pure promotional blasts; standard B2B outreach with genuine 1:1 framing is generally treated differently, but disclosure never hurts.
- Tell recipients where you're located. Include a valid physical postal address — a registered business address, PO box, or private mailbox all qualify.
- Provide a clear way to opt out. Every email needs a visible, working method to stop future emails.
- Honor opt-out requests promptly. You have a maximum of 10 business days to stop emailing someone who's opted out — no fees, no additional steps required of them.
- Monitor what others do on your behalf. If you hire an agency or use a tool to send on your behalf, you're still legally responsible for compliance.
CAN-SPAM vs GDPR vs CASL — Which Applies to You
| Law | Jurisdiction | Consent Model | Opt-out Window |
|---|---|---|---|
| CAN-SPAM | United States | Opt-out (no prior consent needed) | 10 business days |
| GDPR | European Union / EEA | Opt-in (legitimate interest can apply for B2B in some cases) | Immediate, on request |
| CASL | Canada | Opt-in (implied consent applies in limited B2B cases) | 10 business days |
The rule of thumb: apply the strictest law relevant to your recipient's location, not your own. Emailing a prospect physically located in Germany means GDPR governs that email, regardless of where you're sending from. For the full breakdown of EU requirements, see our GDPR Cold Email 2026 guide.
Compliant Email Template/Footer Example
[Your personalized email body]
Best,
[Your Name]
---
[Your Company Name] | [Valid Physical Business Address]
Don't want emails like this? Unsubscribe here — you'll be removed within 10 business days.
Note this is deliberately minimal — you don't need a wall of legal text. A clear name, a real address, and a working unsubscribe link satisfy the core requirements.
Penalties and Real Enforcement Examples
CAN-SPAM violations are calculated per email, not per campaign, which is what makes the penalty structure serious at scale — a violation across a large send can compound into penalties in the tens of thousands of dollars very quickly.
The FTC has pursued high-profile enforcement actions against large-scale commercial spammers with settlements reaching into the millions of dollars. For most small B2B senders, the more immediate practical risk isn't direct FTC action — it's complaint-driven filtering: enough spam complaints and your domain gets blocklisted by ISPs long before any legal action would occur.
A Practical Pre-Send Compliance Checklist
- ☐ Sender name and email address are accurate and not spoofed
- ☐ Subject line reflects the actual content of the email
- ☐ A valid physical postal address is included in the footer
- ☐ A clear, working opt-out link or instruction is present
- ☐ You have a documented process to honor opt-outs within 10 business days
- ☐ You've confirmed the recipient's location to check if GDPR or CASL also applies
- ☐ Any agency or tool sending on your behalf is briefed on these requirements
Related reading:
FAQ
Is cold email legal in the US?
Yes. Unsolicited commercial email is legal in the United States under the CAN-SPAM Act of 2003, as long as the sender follows its requirements: accurate header information, non-deceptive subject lines, a working opt-out mechanism, honoring opt-outs within 10 business days, and including a valid physical postal address.
Do I need consent before sending a cold email under CAN-SPAM?
No. Unlike GDPR, CAN-SPAM does not require prior consent (opt-in) to send commercial email. It's an opt-out regime: you can email first, but you must honor unsubscribe requests promptly and follow the other disclosure requirements.
What are the penalties for CAN-SPAM violations?
Each individual violating email can result in penalties up to the tens of thousands of dollars, calculated per email, not per campaign. The FTC has pursued enforcement actions with settlements in the millions against large-scale violators, though most small business risk comes from complaint-driven ISP filtering rather than direct FTC action.
Does CAN-SPAM apply if I'm emailing people outside the US?
CAN-SPAM applies to commercial email sent to US recipients or sent from US-based senders. If you're emailing prospects in the EU or Canada, you also need to consider GDPR and CASL, which have stricter, consent-based requirements.
Need Your Campaigns Reviewed for Compliance?
We help B2B teams build compliant, high-deliverability cold email systems across US, EU, and Canadian regulations.
Book a Free Call →