Short answer: Is cold email legal? In the United States, yes, as long as the sender follows the CAN-SPAM Act. That law does not require permission before you send a commercial email. It sets rules for how the email must be written and how opt-outs must be handled. It applies to business-to-business email as well as consumer email. Other countries have different rules, and some are stricter. This article is general information based on the Federal Trade Commission’s published guidance. It is not legal advice.
- US rule: commercial email is allowed if it meets the CAN-SPAM requirements.
- Your responsibility: hiring an agency does not move the legal duty off your company.
- Outside the US: the rules differ by country, so check before you send there.
Is cold email legal in the United States?
The main federal law is the CAN-SPAM Act, enforced by the Federal Trade Commission. The FTC publishes a plain-language summary, the CAN-SPAM Act compliance guide for business. Everything in this article about US cold email laws comes from that page. Read it yourself before you rely on any summary, including this one.
The guide describes a set of requirements for commercial messages and a right for recipients to make you stop. It does not describe a general duty to get consent before the first email. That is why unsolicited commercial email is lawful in the US when the rules are followed. The law works on an opt-out basis: you may send, the recipient may tell you to stop, and you must then stop.
Legal is a low bar. A message can meet every legal requirement and still be filtered as spam by a mailbox provider, or annoy the person who gets it. Compliance keeps you inside the law. Good targeting and honest writing are what make cold email work.
Does CAN-SPAM apply to B2B cold email?
Yes. Some senders assume the law is about consumer mail only. The FTC guide says otherwise in direct terms: “The law makes no exception for business-to-business email.” It covers commercial messages, which the guide defines as email whose primary purpose is the commercial advertisement or promotion of a product or service.
A cold email that introduces your company and asks for a sales conversation is promoting a service. Treat it as covered. So the short answer on whether B2B cold email is legal is the same as for any commercial email: it is, when it follows the rules below.
What does CAN-SPAM require of a cold email?
The FTC guide lists the main requirements. Here they are in short form, with what each means for can-spam cold email in practice. The wording in the guide is the authority, not this table.
| Requirement | In practice |
|---|---|
| Accurate header information | Real sender name and domain |
| Honest subject line | Subject matches the message |
| Identify the message as an ad | Do not disguise a pitch |
| Valid physical postal address | Your address in every email |
| Tell people how to opt out | Clear way to say stop |
| Honor opt-outs promptly | Stop sending when asked |
| Monitor what others do for you | Check your agency’s work |
Three of these deserve a closer look because they are where cold email most often goes wrong.
Honest headers and subject lines
The guide says: “Don’t use false or misleading header information.” The from name, the sending address and the domain must identify who is really sending. The subject line has to reflect what is in the message. Tricks such as a fake “Re:” to suggest an earlier conversation, or a subject that hides the commercial purpose, are the kind of thing these rules are aimed at. Sending from a separate outreach domain is fine in itself, provided the message makes plain which company it is from.
A physical address
Every message must include a valid physical postal address for the sender. Many cold emails leave this out because it makes the message look less like a personal note. It is still required. The FTC guide explains which kinds of address qualify.
Opt-outs
Each message must explain how the recipient can stop future email from you. According to the guide, the opt-out mechanism must keep working for at least 30 days after you send the message, and you must honor an opt-out request within 10 business days. Once someone has opted out, they stay opted out. In practice, a well-run program removes people as soon as they ask and keeps a suppression list so they are never contacted again by a later campaign.
What are the penalties for breaking cold email laws?
They are large enough to take seriously. The FTC guide states that each separate email in violation of the CAN-SPAM Act is subject to penalties of up to $53,088. That is per email, not per campaign. The FTC adjusts this figure from time to time, so check the guide for the current amount.
Most businesses that follow the requirements above will never come near an enforcement action. The point of knowing the figure is to understand why the basics are not optional.
Who is responsible if an agency sends for you?
You are, along with the agency. The FTC guide is clear that even if you hire another company to handle your email marketing, you cannot contract away your legal responsibility to comply with the law. Both the company whose product is promoted and the company that sends the message may be held responsible. One of the listed requirements is to monitor what others are doing on your behalf.
For a buyer, that turns into a short list of things to check before a campaign goes out in your name.
- Read the emails before they send. Check that the sender name, subject line and content are honest.
- Look for your postal address. It should be in every message.
- Ask how opt-outs are handled. Who removes the person, how quickly, and where is the suppression list kept?
- Ask what happens to opt-outs if you leave. You should receive the list so those people are never contacted again.
- Ask where the contact data comes from. Our guide to B2B contact data covers the sources and their trade-offs.
- Ask which countries are on the list. If any contacts are outside the US, other laws apply.
An agency that is vague on any of these is exposing you, not just itself. For the wider picture of the work involved, see what a cold email agency does. At Next Reply, the client approves every list before anything sends, which gives you a direct check on who will be contacted.
What about cold email to people outside the US?
CAN-SPAM is a US law. Other countries have their own rules on commercial email, and they do not all follow the same opt-out approach. Some require a form of consent or another legal basis before you send. Some treat business recipients differently from consumers. Privacy laws may also govern how you collect and store a person’s contact details in the first place.
We are not going to summarize those laws here, because a loose summary of a law is worse than none. If your list includes people in Canada, the United Kingdom, the European Union, Australia or anywhere else outside the US, read the guidance published by that country’s regulator and speak to a lawyer who knows that jurisdiction before you send. The location of the recipient matters, not just where your company is based.
US states can also have their own laws that touch on commercial email and privacy. A lawyer can tell you whether any apply to your situation.
Want to see how a campaign would be run before you commit? Tell us who you want to reach, and we will walk you through the list, the copy and how opt-outs are handled. Ask us how it works →
New to the channel? Start with what cold email is. When you compare providers, ask how they handle opt-outs and the sender address. Our list of cold email agencies to compare includes more questions to ask.
Frequently asked questions
Do I need permission to send a cold email in the US?
The FTC’s CAN-SPAM guide does not describe a general requirement to get consent before sending a commercial email. It describes rules for the message and a duty to honor opt-outs. Other countries may require consent, so this answer applies to US recipients only.
Does a cold email need an unsubscribe link?
It needs a clear explanation of how the recipient can opt out of future email from you. The FTC guide sets out what an acceptable opt-out method looks like. Whatever method you use, it has to work and requests have to be honored within the time the guide gives.
Is it legal to buy an email list for cold outreach?
This depends on how the data was collected and where the people on it are located, and it is a question for a lawyer. Apart from the legal side, bought lists are often out of date, which causes bounces and complaints. See our guide on where to buy B2B leads for the practical trade-offs.
If my agency breaks the rules, am I liable?
You can be. The FTC guide says you cannot contract away your legal responsibility, and that both the company whose product is promoted and the company that sends the message may be held responsible.
Is this article legal advice?
No. It is general information drawn from the FTC’s published guidance. Laws change and your situation has its own facts. Talk to a qualified lawyer before making decisions that depend on the law.
Want cold email run in the open?
Next Reply is a cold email agency for B2B companies. Every plan includes list building, sending infrastructure setup, copy, follow-ups and monthly reporting, and you approve every list before anything sends. Compare the plans or tell us who you want to reach.