Yes, you can send cold email under the CAN-SPAM Act. The law does not require permission before you send a first message. It regulates how you send: honest headers, a clear ad disclosure, a real postal address and an opt-out that works. But legal and welcome are different things. Gmail, Yahoo and anti-spam groups judge you on behavior, not on whether you followed a federal statute. This guide covers both layers.

Key takeaways

• CAN-SPAM is an opt-out law, not an opt-in law. Cold B2B email to US recipients is allowed if you meet its FTC-published requirements.
• Each non-compliant email can carry a civil penalty of up to $53,088, so one bad campaign can multiply into a large exposure.
• Compliance is the floor. Mailbox providers watch spam complaints and engagement, and they can block a legal sender.
• Rules differ by country. The UK and EU are far stricter than the US, so a US-only checklist is not enough for global lists.
• Honor opt-outs fast, keep lists targeted and monitor deliverability. That protects you from regulators and from the spam folder.

Table of Contents

• What CAN-SPAM actually says about cold email
• Is a cold email the same as spam?
• The unsubscribe rules, step by step
• Where the law stops and Gmail and Yahoo begin
• Outside the US, the answer changes
• A compliant cold email, line by line
• Compliance checklist for a team
• Our perspective: legal is the start, not the goal
• Run compliant outreach with PlusVibe
• FAQ
• Sources

What CAN-SPAM actually says about cold email

The CAN-SPAM Act covers commercial email: any message whose primary purpose is advertising or promoting a product or service. The FTC’s compliance guide for business states that the law applies to business-to-business email as well as consumer email. Being a B2B sender gives you no exemption.

The law does not ban unsolicited commercial email. It sets conditions. The FTC lists them as follows:

1. Don’t use false or misleading header information. Your “From”, “To” and “Reply-To” fields, and the routing information, must identify the person or business who sent the message.
2. Don’t use deceptive subject lines. The subject must reflect what is inside the message.
3. Identify the message as an ad. The FTC says you can do this in a clear and conspicuous way. It does not prescribe exact wording.
4. Tell recipients where you are located. Include a valid physical postal address. A street address, a registered PO box or a private mailbox all count under the FTC’s guidance.
5. Tell recipients how to opt out. The mechanism must be clear and easy to use.
6. Honor opt-outs promptly. The FTC gives you 10 business days to stop emailing someone who opts out, and the opt-out method must keep working for 30 days after you send.
7. Monitor what others do on your behalf. Hiring an agency or a tool does not move the legal responsibility away from you.

The penalty is per email

Penalties are counted per message. The FTC guide puts the civil penalty at up to $53,088 for each email in violation. A sequence of 5,000 emails with a missing address is not one mistake, it is 5,000 of them. In practice enforcement targets egregious senders, but the arithmetic is the reason to get the footer right before you launch.

Is a cold email the same as spam?

Under the statute, no. Under the definitions used by the people who run email infrastructure, often yes. Spamhaus has published a position that argues cold emailing as practiced today is spam by its own definition: no prior consent, no existing relationship, and frequently sent in bulk.

You do not have to agree with that view to take it seriously. Blocklists, filters and mailbox providers are shaped by it. A deliverability analyst writing at Spam Resource makes a similar point, that legal arguments do little for you once engagement signals turn against your mail.

A practical way to think about it:

You need to pass both tests. Passing the first does nothing for the second.

The unsubscribe rules, step by step

Most compliance failures in outbound come down to the opt-out. Here is what a clean process looks like.

1. Put a visible opt-out in every email. A text line or link that someone can act on without logging in. The FTC says you cannot charge a fee, demand extra personal information beyond an email address, or make the person do more than reply or visit a single web page.
2. Treat a reply of “stop” or “remove me” as an opt-out. If your opt-out method is a reply, a human reply asking to be removed still counts in spirit. Suppress that address immediately rather than at the deadline.
3. Suppress across the whole company. If three reps or two clients’ campaigns reach the same person, an opt-out for one sender should apply to the others. The FTC guide says you cannot sell or transfer an address of someone who opted out, other than to a company you hired to help you comply.
4. Keep the suppression list permanent. Re-importing an old CSV is the easiest way to email someone who already said no.
5. Do not make the unsubscribe the hard part. Hiding it in gray text invites spam complaints, which are the signal providers punish hardest.

The legal limit is 10 business days. As a working standard, aim for the same day. A person who has opted out and still gets email is the person most likely to hit “report spam”.

Where the law stops and Gmail and Yahoo begin

Compliance with a federal statute says nothing about whether your mail reaches the inbox. Gmail and Yahoo set their own rules for bulk senders, generally those sending around 5,000 or more messages a day. According to a 2026 deliverability guide, these include:

• Authentication with SPF, DKIM and DMARC.
• One-click unsubscribe support (RFC 8058), implemented with a List-Unsubscribe-Post header.
• A user-reported spam rate kept below 0.10%, with 0.30% as a level that often leads to rejection.

Two details trip up high-volume teams. The 5,000 message threshold is counted across all subdomains of a domain, not per subdomain. And one-click unsubscribe is a technical header requirement, not just a footer link.

Most cold email programs spread volume across many inboxes and stay well under 5,000 per domain a day. That does not make you exempt from the principles. Authentication is still the baseline for anyone who wants to avoid the spam folder, and a spam-complaint rate near 0.1% is a bad place to be at any volume. For a deeper walk through the technical side, see our guides on email deliverability best practices and the email deliverability checklist.

Outside the US, the answer changes

If your list includes people in other countries, CAN-SPAM is not the law that matters most. The rules there start from consent, not from opt-out.

In the UK, Regulation 22 of PECR restricts unsolicited marketing email to individual subscribers. The main exception is the “soft opt-in”, which applies where you obtained the contact details during a sale or negotiations for a sale and gave the person a chance to opt out at that time. Regulators pay attention to evidence: UK guidance for businesses warns that organizations unable to document how and when consent was obtained are often found in breach when investigated.

PECR’s consent rule is aimed at individual subscribers, which can include sole traders and some partnerships. Corporate subscribers are treated differently, but the distinction is easy to get wrong. If you send into the UK or EU, get advice from a lawyer who handles data protection, and do not rely on a US checklist.

The clean way to handle a global list is to segment by country. Apply the strictest rule that matches the recipient’s location, and keep a record of the source of every contact.

A compliant cold email, line by line

Here is what a compliant first email looks like in practice. The structure matters more than the wording.

• From: a real person at your real company, on a domain you control.
• Subject: a plain description of what the email is about. No fake “Re:” thread, no fake urgency.
• Body: why you are writing to this person specifically, one relevant offer, one clear question. Our cold email best practices and sales email templates show what that looks like.
• Ad disclosure: a short, plain line that makes clear the message is a commercial offer.
• Footer: your business name, a valid postal address and a simple way to opt out.

Check the draft before you send. A free cold email spam checker catches risky phrasing and formatting problems that filters flag.

Compliance checklist for a team

Compliance fails at handoffs, not in the template. If several people or clients send from the same stack, assign these owners.

• List sourcing: a record of where each contact came from and the date.
• Suppression: one shared do-not-contact list, applied before every send.
• Footer and address: locked in a shared template that reps cannot edit by accident.
• Authentication: SPF, DKIM and DMARC verified on every sending domain before warm-up starts.
• Complaint monitoring: someone who looks at bounce and complaint rates weekly and can pause a campaign.
• Agency or tool vendors: a written expectation that they follow the same rules, since the legal responsibility stays with you.

We keep a longer version in our cold email compliance checklist for teams. The operational side, such as automation workflows that don’t over-send, is also covered in this marketing automation checklist for small businesses.

Our perspective: legal is the start, not the goal

We build cold email software, so people often expect us to say that the law is a formality. We don’t think so, and we don’t think the legal question is the hard one.

The CAN-SPAM requirements fit on an index card. What breaks outbound programs is everything the statute doesn’t cover: sending to the wrong people, sending too much from one domain, ignoring bounces, and treating the unsubscribe as an obstacle. Those behaviors produce complaints, and complaints are what push a domain into the spam folder. Spam Resource’s argument that legal compliance is no defense once engagement drops is one we see play out in practice.

That is why our platform is built around sender reputation: private email warm-up, isolated sending infrastructure, inbox rotation, email verification and deliverability monitoring. Verification removes addresses that would bounce. Isolated infrastructure keeps your reputation from depending on strangers’ behavior. Monitoring tells you when something is going wrong before the whole domain is affected. None of it replaces a good list and a relevant message, and we say so to every new customer.

Our advice is simple. Write to a small, well-matched audience. Make leaving easy. Treat every complaint as a verdict on your targeting. If that rules out some campaigns you were planning, they were probably the ones that would have hurt you.

— Yaro

Run compliant outreach with PlusVibe

If you want the sending side handled properly, PlusVibe offers a free trial so you can set up warm-up, verification and sequencing before you commit. Paid plans on our plans page start with Personal at $37-$58 per month and Business at $77-$220 per month. Agencies managing client campaigns can look at the Agency plan, from $497 per month. If you would rather not configure domains and inboxes yourself, we also offer done-for-you email setup at $1,500 per month. Our email warm-up is private rather than shared, which keeps your sender reputation your own.

FAQ

Is cold emailing illegal in the US?

No. The CAN-SPAM Act permits unsolicited commercial email if you use accurate headers and subject lines, identify the message as an ad, include a valid postal address and honor opt-outs. Violations can lead to civil penalties of up to $53,088 per email, according to the FTC.

Does CAN-SPAM apply to B2B email?

Yes. The FTC guide says the law covers all commercial messages, including those sent from one business to another. A business address does not exempt the recipient from your obligations.

How fast do I have to honor an unsubscribe request?

The FTC allows 10 business days. Your opt-out method must also keep working for 30 days after you send the message. Most senders process requests immediately, since further emails to someone who opted out raise complaint rates.

Can I be compliant and still land in spam?

Yes, and it happens often. CAN-SPAM says nothing about authentication, complaint rates or engagement, which are what Gmail and Yahoo measure. Their published bulk sender guidance points to a spam rate below 0.10% and proper SPF, DKIM and DMARC setup.

Is the rule the same for UK and EU recipients?

No. UK rules under PECR generally require prior consent for marketing email to individuals, with limited exceptions such as the soft opt-in. Consult a data protection lawyer before emailing those markets.

Sources

• CAN-SPAM Act: A Compliance Guide for Business, FTC
• Spamhaus’ take on Cold Emailing
• The truth about cold email, Spam Resource
• Gmail Deliverability Guide: Authentication and Inbox Placement
• Is Gmail Filtering Your Emails? InfoSec Today
• PECR Regulation 22, legislation.gov.uk
• Direct marketing bulletin, UK government publication

Recommended

• Cold email compliance: a simple checklist for teams
• 8 Cold Email Best Practices for 2026: A Deep Dive
• 6 Cold Email Example Templates That Get Replies in 2026
• The Best Cold Email Software of 2026: Features, Pricing & Reviews