Quick answer
Yes, with no prior consent required. The CAN-SPAM Act is an opt-out law: you can email a stranger first, but the message needs accurate header information, a non-deceptive subject line, a clear ad disclosure, your physical postal address, and a working opt-out honored within 10 business days. There is no B2B exception and no volume floor. Violations run up to $53,088 per email.
Is cold email legal in the US
I run outbound into the US for most of my B2B clients, and this is the one legal question that almost never comes up before launch, unlike the questions I get constantly about sending into the EU. That is because the US answer is simpler and friendlier to a cold sender: yes, you can send a commercial email to someone who never asked for it and never gave consent. The CAN-SPAM Act, enforced by the Federal Trade Commission, does not ask you to earn permission first. It asks you to be honest about who you are and to let the recipient stop hearing from you easily once you have reached out.
That is the whole shape of US law on this. No opt-in requirement, no named-individual test like Norway's, no legitimate interest analysis like the EU's GDPR. Just a short list of things the email itself has to get right, covered next.
What CAN-SPAM actually requires
The FTC's own compliance guide lists the requirements in plain terms. Every one of these applies to a single cold email to one prospect, not just to a bulk marketing blast:
| Requirement | What it means in practice |
|---|---|
| Accurate header information | Your "From," "To," "Reply-To" and routing information, including the sending domain, must identify the real sender. No spoofed domains, no misleading display names. |
| Non-deceptive subject line | The subject must accurately reflect the content of the message, not promise something the email does not deliver. |
| Clear ad disclosure | You must disclose, clearly and conspicuously, that the message is an advertisement. The FTC gives businesses latitude on how to phrase this. |
| A valid physical postal address | A real street address, a registered P.O. box, or a commercial mail-receiving agency address, included in the message. |
| A working opt-out mechanism | A reply address or an internet-based way to opt out, with the request honored within 10 business days. |
| Third-party accountability | Hiring an agency or a tool to send on your behalf does not transfer your legal responsibility for any of the above. |
None of these are difficult to meet. Most sending platforms add the unsubscribe link and the physical address automatically once you configure them, and a founder sending a genuine, specific first email rarely needs a deceptive subject line to get a reply anyway. The accurate-header rule is worth a second look if you send from several mailboxes at once: rotating across multiple sending addresses for deliverability reasons does not loosen the requirement, every one of those addresses still has to identify the real sender.
The one rule people actually miss. It is the physical address. A lot of B2B senders assume CAN-SPAM is only about the unsubscribe link, add that, and skip the postal address entirely. The FTC's guide lists it as its own separate requirement, not a footnote to the opt-out rule.
Opt-out, not opt-in: the real difference from the EU
The single biggest difference between US and EU cold email law is the starting assumption. CAN-SPAM assumes you can send until the recipient says stop. GDPR and the EU's ePrivacy rules generally assume the opposite: you need a lawful basis, usually legitimate interest for a relevant B2B contact, before the first message goes out at all. The FTC's guide states this directly: "you don't need to get members' consent to send them marketing emails," though recipients can opt out at any time regardless of any existing relationship.
| United States (CAN-SPAM) | European Union (GDPR and ePrivacy) | |
|---|---|---|
| Consent model | Opt-out: send first, honor opt-out requests | Opt-in or legitimate interest required before sending |
| B2B exception | None, explicitly stated by the FTC | Varies by country, legitimate interest often covers relevant B2B contacts |
| Who enforces it | Federal Trade Commission, civil penalties | National data protection authorities, country by country |
| Maximum penalty | $53,088 per violating email | Up to 4% of global annual turnover under GDPR, country-specific fines under ePrivacy rules |
A sequence built for the US rarely transfers cleanly to Europe for this reason, and the reverse is also true: a list built with EU-style legitimate interest documentation is more conservative than CAN-SPAM actually demands.
What counts as a commercial email
CAN-SPAM only governs "commercial" messages, which the statute itself defines in 15 U.S.C. § 7702 as any email whose primary purpose is the commercial advertisement or promotion of a product or service. A cold outreach email pitching a meeting about your product sits squarely inside that definition. The same section separately defines a "transactional or relationship message", one that facilitates, completes or confirms a transaction the recipient already agreed to, or delivers account, warranty or employment-related information, and those carry lighter requirements since the recipient already has a reason to expect them. A reply to a prospect who already booked a call, or a confirmation email after a demo, falls on the lighter side. The first cold email that starts the relationship does not.
Why there is no B2B exception
Teams new to US outbound sometimes assume CAN-SPAM is a consumer-protection law that does not reach B2B sales email. The FTC's own guide closes that door directly: the law "makes no exception for business-to-business email." It also sets no volume threshold, so a single email to one prospect carries the same header, disclosure and opt-out obligations as a million-message campaign. The practical effect for outbound teams is that the rules are easy to meet but not optional to skip just because the list is small or the recipient is a company rather than a consumer.
Who enforces it, and what breaking it costs
The Federal Trade Commission enforces CAN-SPAM, and its own compliance guide puts the maximum civil penalty at $53,088 per separate violating email, a figure last adjusted for inflation in January 2024 and confirmed unchanged through the rest of 2026 after a government shutdown disrupted that year's scheduled adjustment. There is no cap on the total across a campaign, so the number scales with how many messages actually violate the rules, not with how many campaigns you ran. Hiring an agency or a sending tool to handle delivery does not remove your own liability either: the guide is explicit that a business cannot contract away its legal responsibility for compliance.
Do state laws add anything on top
Mostly no, by design. 15 U.S.C. § 7707(b)(1), CAN-SPAM's own preemption clause, states that the federal law "supersedes any statute, regulation, or rule of a State... that expressly regulates the use of electronic mail to send commercial messages," with one carve-out: state laws that prohibit falsity or deception inside a commercial email keep applying. So a state cannot impose its own separate consent requirement for commercial email, but ordinary state fraud, deception and computer-crime laws still reach a cold sender who lies in the message itself.
LinkedIn and other channels into the US
CAN-SPAM's text covers "electronic mail messages," and there is no US ruling treating a LinkedIn message the same way, unlike the position some German courts have taken on messaging platforms (covered in is cold email legal in Germany). In practice that means a cold LinkedIn message into the US sits outside CAN-SPAM's specific header, disclosure and opt-out requirements, though LinkedIn's own user agreement and anti-spam policies still apply regardless of what federal email law says. I treat both channels with the same basic discipline anyway: identify yourself honestly and make it easy to disengage, since that is good outbound practice independent of which specific law technically reaches the channel.
What I build into a US-bound sequence
Because CAN-SPAM's bar is about honesty and an easy exit rather than prior permission, the compliance work for a US sequence is mostly a sending-infrastructure setup, not a legal review. My own first emails run 30 to 40 words, one concrete problem and one concrete offer, email and LinkedIn run as one sequence rather than separate motions, and the unsubscribe link, sender identity and physical address all live in the sending tool's footer so they travel with every message automatically rather than depending on whoever wrote that day's copy to remember them.
A CAN-SPAM checklist before you send
- Confirm your sending domain and display name match the real sender, no borrowed or spoofed identity.
- Write a subject line that matches the email, not one engineered purely to get an open.
- Add a clear, if light-touch, ad disclosure somewhere in the message.
- Include a real physical address, not just an unsubscribe link, in the footer.
- Wire the opt-out to something you actually monitor, and remove the person within 10 business days, not at the next list sync.
- Check what your sending tool adds automatically versus what you still need to add by hand, since not every platform includes the physical address by default.
Not legal advice. I'm a GTM consultant, not a lawyer. Every claim above links to the FTC's own guide or the statute itself so you can read the primary source directly. Have a US lawyer review your specific sequence and footer before a large campaign, particularly if you also sell into the EU and are running two different compliance postures at once.
Key takeaways
- CAN-SPAM is an opt-out law: no prior consent is needed to send a cold email into the US, unlike GDPR's legitimate-interest or consent basis in the EU.
- The real requirements are accurate headers, a non-deceptive subject line, a clear ad disclosure, a physical postal address and a working opt-out honored within 10 business days.
- There is no B2B exception and no volume floor. The FTC's own guide states the rules apply to a single email the same as a bulk campaign.
- Penalties run up to $53,088 per violating email, with no cap on the total, and hiring a third party to send does not remove your own liability.
- State laws mostly cannot add their own consent requirement on top, per CAN-SPAM's own preemption clause, except where they prohibit fraud or deception.
FAQ
Is cold email illegal in the US?
No. The CAN-SPAM Act permits sending a commercial email without prior consent, as long as the message includes accurate header information, a non-deceptive subject line, a clear ad disclosure, a physical postal address and a working opt-out mechanism.
Do I need consent before sending a cold email in the US?
No. CAN-SPAM is an opt-out law, not an opt-in one. The FTC's own guide states you do not need a recipient's consent to send marketing email, though they can opt out of future messages at any time.
Does CAN-SPAM apply to B2B cold email?
Yes, with no exception. The FTC's compliance guide states the law "makes no exception for business-to-business email," and there is no minimum volume below which the rules stop applying.
What happens if I violate CAN-SPAM?
The FTC can pursue civil penalties of up to $53,088 per separate violating email, with no cap on the total across a campaign. Hiring an agency or a sending tool does not transfer that liability away from your business.
Does CAN-SPAM override state laws on email marketing?
Mostly yes. 15 U.S.C. section 7707(b)(1) states federal law supersedes state statutes that expressly regulate commercial email, except where those state laws prohibit falsity or deception within the message itself.