Cold email laws
CAN-SPAM Act: What It Means for Cold Email
Yes. CAN-SPAM is an opt-out law with no B2B exception: you can email US businesses without consent if headers and subject lines are honest, the email says it is an ad, and it carries your postal address and a working opt-out. Each violating email can cost up to USD 53,088.
Not Legal Advice
Not legal advice. We checked this page against the law's text and the regulator's guidance on October 17, 2026; it has not been reviewed by a lawyer.
Can You Send B2B Cold Email Under the CAN-SPAM Act?
In short Yes: you need no prior consent, but every commercial email needs honest headers and subject lines, an ad disclosure, your postal address and a working opt-out you honor within 10 business days.
CAN-SPAM does not require consent before you send. It sets rules for every commercial email, meaning any email whose primary purpose is to advertise or promote a commercial product or service (15 U.S.C. 7702(2)), and the FTC says the law makes no exception for business-to-business email.
Every commercial email needs accurate header information, a subject line that does not mislead, a clear notice that the message is an advertisement (unless the recipient gave prior affirmative consent), a valid physical postal address and a working way to opt out. Once someone opts out, you have 10 business days to stop, and you may not sell or transfer their address.
CAN-SPAM overrides state laws that expressly regulate commercial email, except where they prohibit falsity or deception (section 7707(b)). Hiring an agency or a sending tool does not move the responsibility: the company whose product is promoted and the company that sends the email can both be liable.
What Do You Need to Do Under the CAN-SPAM Act?
In short 8 rules apply to a cold email program under the CAN-SPAM Act.
| Requirement | What it means | How to do it | Section |
|---|---|---|---|
| Accurate header information | No header information that is materially false or materially misleading. | Use real From names and domains you control, and make sure the routing and reply-to identify your company. | 15 U.S.C. 7704(a)(1) |
| Honest subject line | No subject line likely to mislead a reasonable recipient about the content of the email. | Make each subject line match the body. No fake Re: or Fwd: threads. | 15 U.S.C. 7704(a)(2) |
| Identify the email as an ad | The email must clearly and conspicuously say it is an advertisement or solicitation, unless the recipient gave prior affirmative consent. | Add a plain disclosure to each cold email, for example in the footer. | 15 U.S.C. 7704(a)(5)(A)(i) and (a)(5)(B) |
| Physical postal address | Include a valid physical postal address of the sender. | Put your company's postal address in the footer of every email, on every sending domain and inbox. | 15 U.S.C. 7704(a)(5)(A)(iii) |
| Working opt-out | Give a clear way to opt out by reply email or a web page that keeps working for at least 30 days. You cannot charge a fee or ask for more than an email address and preferences. | Offer reply-to-unsubscribe or a one-click link, keep it working for 30 days after each send, and never ask for a login. | 15 U.S.C. 7704(a)(3)(A) and (a)(5)(A)(ii); 16 CFR 316.5 |
| Honor opt-outs within 10 business days | You may not email someone more than 10 business days after their opt-out, or sell, lease, exchange or transfer their address. | Sync unsubscribes and remove-me replies to one suppression list across every inbox and domain, and never pass those addresses on. | 15 U.S.C. 7704(a)(4) |
| Responsibility stays with you | Hiring another company to send does not move legal responsibility. The company whose product is promoted and the company that sends can both be liable. | Write CAN-SPAM duties into your contracts with agencies and sending tools, and check their work. | FTC compliance guide; 15 U.S.C. 7702(16) |
| No harvested or guessed addresses | Sending to addresses harvested from sites that prohibit it, or generated by combining names, letters or numbers into permutations, is an aggravated violation. | Do not scrape sites that prohibit it, and do not blast permutation-guessed addresses. | 15 U.S.C. 7704(b)(1) |
What Are the Penalties Under the CAN-SPAM Act?
In short Maximum penalty: USD 53,088 per email.
| Penalty | Maximum | In USD | Section |
|---|---|---|---|
| FTC civil penalty, per violating email | USD 53,088 per email (the 2025 level, kept for 2026) | USD 53,088 | 15 U.S.C. 7706(a); 16 CFR 1.98(d) |
| State attorney general action | USD 2,000,000 in total (up to USD 250 per email), up to 3 times more for willful or aggravated violations; no cap for false header violations | USD 2,000,000 | 15 U.S.C. 7706(f)(3) |
| Internet access provider action | USD 1,000,000 in total (up to USD 100 per email for false headers, USD 25 for other violations), up to 3 times more for willful violations; no cap for false header violations | USD 1,000,000 | 15 U.S.C. 7706(g)(3) |
The FTC enforces CAN-SPAM, and the Department of Justice files civil penalty cases on its referral. Other federal agencies, state attorneys general and internet access providers harmed by the emails can also sue (15 U.S.C. 7706). Individual recipients cannot sue under CAN-SPAM. Some conduct, such as hijacking computers or registering accounts with false information to send email, is a crime.
What Enforcement Has There Been Under the CAN-SPAM Act?
In short 3 cases from regulator and court records, newest first.
| Date | Company | What happened | Outcome | Source |
|---|---|---|---|---|
| 2024-08-30 | Verkada Inc. | Sent more than 30 million commercial emails over three years with no unsubscribe option and no postal address, and did not honor opt-outs; the case also covered data security. | USD 2.95 million civil penalty, which the FTC called its largest for a CAN-SPAM violation | FTC press release |
| 2023-08-14 | ConsumerInfo.com, Inc. (Experian Consumer Services) | Sent consumers unsolicited marketing email without offering a way to opt out. | USD 650,000 civil penalty | FTC press release |
| 2006-11-06 | Yesmail Inc. (@Once Corporation) | Its spam filter blocked reply-to unsubscribe requests, so it kept sending commercial emails more than 10 business days after people opted out. | USD 50,717 civil penalty | FTC press release |
Cold Email Checklist for the CAN-SPAM Act
- Send from a domain you control, with a real From name and reply-to address.
- Write subject lines that match the body; no fake Re: or Fwd: threads.
- Add a plain line saying the email is an advertisement or solicitation.
- Put your company's valid physical postal address in every footer.
- Offer reply-to-unsubscribe or a one-click link that needs no login and works for at least 30 days.
- Suppress every opt-out across all inboxes and domains within 10 business days, and never share those addresses.
- Do not use harvested addresses or permutation-guessed lists.
- Put CAN-SPAM duties in your contracts with agencies and sending tools.
How Ken Helps
In short Ken Campaigns handles opt-outs, suppression and sending limits; it does not make your emails lawful, and the law stays your responsibility.
- Campaign emails must include a legally appropriate opt-out or unsubscribe mechanism unless Ken approves another lawful approach in writing, and Ken can run the unsubscribe links, reply-based opt-outs and suppression for you (Ken Terms of Service, section 7.3).
- Ken's anti-spam policy puts opt-outs, abuse complaints, spam-trap notices and hard bounces on a suppression list that applies across every domain and mailbox Ken operates, and never expires it.
- Ken tracks every bounce, unsubscribe and spam report, and every campaign rotates across several inboxes to stay under daily send limits.
- You give Ken your legal entity name and mailing address for the email footer, and Ken will not knowingly use materially false or misleading headers, sender details or subject lines (Terms, section 7.2).
- Ken's anti-spam policy bars purchased and scraped lists, and accounts found sending unsolicited bulk email are suspended (section 6).
- Ken's terms leave the legality of your offer, audience and data, and any consents and notices the law requires, with you (section 7.1). Under the CAN-SPAM Act, that includes the ad disclosure, honest subject lines and the postal address you supply.
FAQ
Is B2B cold email legal under CAN-SPAM?
Yes. CAN-SPAM is an opt-out law: it requires no prior consent, but every commercial email must meet the rules in 15 U.S.C. 7704(a). The FTC says the law makes no exception for business-to-business email.
What is the CAN-SPAM fine per email in 2026?
Up to USD 53,088 per violating email. The FTC said in the Federal Register on September 15, 2026 that its 2025 civil penalty levels stay in place for 2026.
How fast do I have to process unsubscribes?
Within 10 business days (15 U.S.C. 7704(a)(4)). The opt-out must keep working for at least 30 days after you send, and you cannot ask for more than the email address and preferences, a reply email or one web page (16 CFR 316.5).
Can a prospect sue me under CAN-SPAM?
No. Section 7706 lets the FTC, other federal agencies, state attorneys general and internet access providers harmed by the emails sue. It gives individual recipients no right to sue.
Do I have to label a cold email as an ad?
Yes, clearly and conspicuously, unless the recipient gave prior affirmative consent to receive it (15 U.S.C. 7704(a)(5)(A)(i) and (a)(5)(B)).
The new Ken opens to the waiting list in batches.
Related
- Cold email laws by country
All 12 laws compared
- CCPA and CPRA: What They Mean for Cold Email
Allowed; privacy rights apply to covered businesses
- CASL (Canada): What It Means for Cold Email
Consent first; implied consent for published work addresses
- UK GDPR and PECR: What They Mean for Cold Email
Allowed to companies, opt-out; sole traders need consent
- Ken anti-spam policy
Sources
Changelog
- Page published.