Is Cold Email Legal in the USA? CAN-SPAM Rules for B2B Teams

November 12, 2026
Iampona Frota

Yes, cold email is legal in the United States, including unsolicited email to business addresses. US law uses an opt-out model: you don’t need permission before the first message, but every message must follow the CAN-SPAM Act, and you must stop emailing anyone who asks. The FTC’s compliance guide says the law makes no exception for business-to-business email. Your outreach to a VP of Operations is regulated exactly like a consumer promotion.

This guide covers what the law requires, how fast you must honor opt-outs, what the penalties look like, who is liable when a platform sends on your behalf, and how to build a process your team can follow every day.

Crono

Make Compliant Outreach Repeatable

Crono connects sales tools, workflows, and AI agents to help B2B teams coordinate outreach execution.

Visit

TL;DR

Cold email to business contacts is legal in the US without prior consent, as long as each message complies with CAN-SPAM.
Every commercial email needs honest header and subject line information, a clear identification as an ad or solicitation, a valid physical postal address and a working opt-out.
Honor opt-outs within 10 business days, without charging a fee or asking for more than the recipient’s email address.
You stay responsible for compliance even when an agency or sales platform sends the messages for you.
Penalties can reach up to $53,088 per violating email, and the FTC has pursued large cases, so build compliance into your workflow, not into an afterthought.

The short answer: opt-out, not opt-in
What CAN-SPAM requires in every cold email
How to handle opt-outs
Penalties and enforcement
Do state laws change the picture?
Who is responsible when a tool or agency sends for you
A pre-send checklist for cold email
Perspective: compliance is an execution problem
Making compliant outreach repeatable
Run compliant outbound with Crono
FAQ
Sources

The short answer: opt-out, not opt-in

Many sales leaders arrive at this question after reading about European rules and assuming the US works the same way. It doesn’t. The US has no general requirement that a recipient opt in before you send a first commercial email. According to a summary of the consent question, CAN-SPAM contains no opt-in requirement for ordinary email addresses. What the law demands instead is transparency and a clean exit.

That is why cold outreach remains a standard part of B2B pipeline building in the US. The legal question is rarely “may we send this?” It is “does this message, and the process behind it, meet the rules?”

Two clarifications matter before you go further:

Commercial purpose decides coverage. The Act applies to a message whose primary purpose is the commercial advertisement or promotion of a product or service, per the FTC guide. A cold email pitching your software qualifies.
This article covers email only. Texts and phone calls fall under separate rules. If your sequences include calls or messages beyond email and LinkedIn, have counsel review those channels separately.

What CAN-SPAM requires in every cold email

The statute, 15 U.S.C. § 7704, makes it unlawful to send a commercial email unless the message identifies itself as an ad or solicitation, gives clear opt-out notice and includes the sender’s valid physical postal address. The FTC’s guide turns this into a practical list. Here is how each element looks inside a sales email.

1. Honest header information

Your “From,” “To,” “Reply-To” and routing information must be accurate and identify the person or business that actually sent the message. Practically, that means:

Send from a real mailbox on a domain your company controls.
Use a sender name that matches a real person or your company.
Never spoof another address or use a misleading display name.

2. A subject line that matches the content

The subject line can’t mislead the recipient about what is inside. Fake threads such as “Re: our call yesterday” when no call happened are the classic violation. Curiosity is fine; deception is not. A subject like “Question about your outbound process” works when the email is about your outbound offering.

3. Identification as an advertisement

The message must clearly identify itself as an ad or solicitation. The FTC guide notes that the law gives you flexibility in how you do this, so a plain sentence that makes the commercial intent unmistakable, such as a line stating you are reaching out to introduce your product, satisfies the intent of the rule. Most good cold emails already do this in the first two sentences.

4. A valid physical postal address

Every message needs your valid physical postal address. The FTC guide says this can be your current street address, a post office box registered with the US Postal Service, or a private mailbox registered with a commercial mail receiving agency. Put it in a standard signature block so it can’t be forgotten.

5. A clear way to opt out

Each email must explain how the recipient can stop receiving messages from you. A reply-email option or a link to a simple web page both qualify. The next section covers the timing rules.

How to handle opt-outs

The opt-out rules are where most operational failures happen, because they depend on your systems, not only your copy. The CAN-SPAM Rule at 16 CFR Part 316 and the FTC guide set these requirements:

Make the mechanism work for at least 30 days after you send the message.
Honor each request within 10 business days.
Charge no fee for opting out.
Ask for nothing beyond an email address and the recipient’s opt-out preferences.
Require no more than a reply email or a visit to a single web page. No logins, no multi-step forms.

In practice, ten business days is the legal outer limit, not a target. Teams that run multi-step sequences across several tools should suppress an opted-out contact immediately, because a follow-up that fires on day three after a “please remove me” reply is a violation waiting to be counted. If you want a refresher on building a compliant unsubscribe flow, this guide to email marketing fundamentals covers opt-out handling in the wider email context.

A suppression process that holds up

Keep one master suppression list that every tool, sequence and sender reads from.
Treat plain-language replies as opt-outs. “Not interested, stop emailing me” is a request even if no one clicked a link.
Sync across channels and systems. Your CRM, your sequencing tool and any list you import must all respect the same list.
Never sell or transfer the address of someone who opted out. The FTC guide prohibits it, except to a company you hired to help you comply.
Log the date of each request. If a question ever arises, the log shows you acted inside the 10-business-day window.

Penalties and enforcement

The stakes are real. As of 2026, each separate email that violates CAN-SPAM can carry a civil penalty of up to $53,088, and the amount is adjusted periodically for inflation. Because the penalty applies per message, a poorly governed campaign multiplies the exposure quickly.

Enforcement is not hypothetical. In 2024, the FTC obtained a $2.95 million penalty from Verkada, which the agency described as the largest it had obtained for a CAN-SPAM violation. The complaint alleged that the company flooded prospective customers with commercial email, failed to include an unsubscribe option, failed to honor opt-out requests and left out a physical postal address. Notably, the recipients were prospective business customers, which shows that B2B outreach gets no special treatment.

Who can bring a case

The FTC and certain other federal agencies may sue under the Act, and state attorneys general and internet access providers also have standing in defined circumstances, according to Cornell’s Legal Information Institute. State attorneys general may act over materially false or misleading transmission information, deceptive subject lines or a pattern of violating opt-out and identification requirements. Individual recipients can’t sue under CAN-SPAM directly, but a pattern of complaints can still reach a regulator or a mailbox provider.

Do state laws change the picture?

Mostly, no. CAN-SPAM preempts state statutes that expressly regulate the use of email to send commercial messages, with an exception for state law that prohibits falsity or deception in a commercial email, per 15 U.S.C. § 7707(b)(1) as collected by the Future of Privacy Forum. In plain terms: a state can’t add a stricter opt-in rule for commercial email, but it can enforce its own laws against lying in your messages.

Minnesota is a useful example. Its commercial email statute is an opt-out statute and does not require consent, and its falsity and deception provisions continue to apply alongside the federal law.

Two cautions follow from this:

Contact data is a separate question. State privacy laws may govern how you collect, store and sell personal information, even though they don’t change the rules for sending the email itself. If you build lists from multiple sources, ask counsel how your state exposure looks.
Other countries have different rules. If your list includes contacts in the EU or UK, the consent and legitimate-interest rules there are separate from US law. US compliance doesn’t cover them.

Who is responsible when a tool or agency sends for you

Using a sales platform, an outsourced SDR team or an agency doesn’t move the legal responsibility. The company that benefits from the marketing messages remains responsible for CAN-SPAM compliance when it outsources email to a third-party vendor. The FTC guide reaches the same conclusion: both the company whose product is promoted and the company that sends the message may be held accountable.

That has direct consequences for how you run outbound:

Own the footer. Confirm that your postal address and opt-out language appear in every template, including follow-ups.
Own the suppression list. Don’t let an agency keep its own separate list.
Write compliance into the contract. Require vendors to follow CAN-SPAM and to honor your suppression data.
Audit what actually goes out. Review sent messages, not just templates.

For a deeper look at program-level controls, see our guide on whether your email program is actually CAN-SPAM compliant.

A pre-send checklist for cold email

Use this list before any new sequence goes live:

Check	What to confirm
Sender identity	Real mailbox, accurate From and Reply-To
Subject line	Reflects the content, no fake replies or forwards
Ad identification	The email makes clear it is a solicitation
Postal address	Street address or registered PO box or private mailbox
Opt-out	Reply or one-page method, free, active for 30+ days
Suppression	Master list synced across every tool and channel
Turnaround	Requests processed well within 10 business days
Vendors	Contracts and audits cover anyone sending for you

Perspective: compliance is an execution problem

Most compliance failures we see in outbound are not caused by bad intent. They come from fragmented stacks: one tool for data, one for sequencing, a CRM that doesn’t know what the others did, and a suppression list that lives in only one of them.

That is why we built Crono as a sales execution layer that connects your CRM and sales tools instead of replacing them. When prospecting, enrichment, outreach and pipeline management work from the same workflows, it is far easier to keep one source of truth for who can be contacted and who has asked to stop. Our approach is designed to make the compliant path the default path for both your reps and your AI agents.

We also believe good compliance and good performance point the same way. Relevant, signal-driven outreach to the right accounts, with honest subject lines and an easy exit, protects deliverability and your brand while it builds pipeline. Sending fewer, better-targeted messages is safer than sending more.

Alex

Making compliant outreach repeatable

Legal clarity is the starting point. The next step is a process that doesn’t depend on every rep remembering the rules.

Standardize templates. Lock the signature block, address and opt-out line into approved templates. Our B2B cold email template shows a structure that keeps the message honest and short.
Target with signals. Reaching accounts that have a reason to care reduces complaints and opt-outs. Our B2B cold outreach strategies cover how to do this.
Coordinate channels. If you combine email with LinkedIn, the opt-out rule still applies to the email leg, and a request on one channel should pause the others. See our multichannel outreach playbook.
Supervise automation. When AI drafts or sends messages, the rules still apply to every message. Review how you deploy AI sales agents with those guardrails in mind.

Run compliant outbound with Crono

Crono connects your CRM and sales tools in one execution layer, combining buying signals, data enrichment, multichannel engagement, workflow automation and AI agents. Plans are priced per seat: Pro starts at 79 € per month per seat and Ultra at 119 € per month per seat, with an Enterprise plan available. See the pricing page for current details, or explore the Agentic Sales Engine, which starts at 99 € per month for 10,000 credits.

If you want a single place to manage targeting, sequences and suppression across your team, book a look at Crono.

FAQ

Do I need permission before sending a cold email to a business contact in the US?

No. CAN-SPAM doesn’t require consent before a first commercial email, and it has no exception for B2B messages either. You must follow the content rules and honor opt-outs. This is general information, so have a lawyer review your specific program.

Is it legal to email someone whose address I found online or in a database?

CAN-SPAM regulates the message, not where the address came from. Your email must still meet every content and opt-out requirement. Separate state privacy rules may apply to how you collect and use personal data, so ask counsel about your list-building practices.

How fast must I stop emailing someone who unsubscribes?

Within 10 business days, according to the FTC’s CAN-SPAM guide. The opt-out method must work for at least 30 days after you send the message, and you can’t charge a fee or require more than a reply or a single web page visit. Suppressing contacts immediately is the safer habit.

Am I liable if my agency or sales tool sends the emails?

Yes, the company benefiting from the messages stays responsible. Write compliance obligations into vendor contracts, share one suppression list and audit what is actually sent.

Can I use a role-based or shared inbox as my opt-out address?

Yes, as long as the reply address or web page works and someone monitors it. An unmonitored inbox that lets requests sit for weeks puts you outside the 10-business-day window.