Cold email compliance checker

Checks your cold email against CAN-SPAM, GDPR, PECR and CASL and tells you what to add for each. Not legal advice.

SubjectRe: Northwind's warehouse expansion

To United States, CAN-SPAM Act and FTC Act, sample email

Recipient in

Paste the whole email with the signature. Start with Subject: to include it.

Sample email, checkedRules for United StatesRules run in your browser, the AI check runs only if you ask

4to fix

Fix before sending

Recipient in United States

CAN-SPAM ActFTC Act1 check only you can do

3 rules are missing from the email. The fix for each one is below, with the rule it comes from.

3 missing1 to review1 passed

This is not legal advice. It checks the email against the rules as written. It can't see your consent records, your list source or your headers, so ask a lawyer about your own case.

What to change

Checked against CAN-SPAM Act and FTC Act for a recipient in United States.

Honest subject lineCAN-SPAM Act

The subject starts with Re: or Fwd: on a first email, which pretends there was an earlier thread.

Fix: Drop the prefix and name the topic.

Subject: “Re:”

The subject line must not mislead about what the message is. CAN-SPAM Act, 15 U.S.C. 7704(a)(2)

Way to opt outCAN-SPAM Act

No way to opt out found.

Fix: Add a plain line such as "If this isn't relevant, reply and I'll stop emailing you."

Every commercial email needs a clear way to opt out that works for at least 30 days after sending. Requests must be honored within 10 business days (7704(a)(4)). CAN-SPAM Act, 15 U.S.C. 7704(a)(3) and (a)(5)(A)(ii)

Postal addressCAN-SPAM Act

No postal address found.

Fix: Add your business address under your signature. A registered PO box works.

The email must include the sender's valid physical postal address. A street address, a registered PO box or a private mailbox all count. CAN-SPAM Act, 15 U.S.C. 7704(a)(5)(A)(iii)

Claims you can back upFTC Act

Check you can prove: "guarantee", "40%".

Fix: Keep only claims you can back with a named source.

“guarantee”

Claims in marketing must be truthful and backed by evidence. FTC Act, 15 U.S.C. 45(a)

Only you can check

The text can't show these: consent records, your list source, your headers.

Clear it's a sales emailCAN-SPAM Act

Can't be checked from the text. A plain one-to-one email that says who you are and what you offer usually makes clear it is a sales email.

A commercial email must be clearly identifiable as a solicitation, unless the recipient gave prior consent. The law names no required wording. CAN-SPAM Act, 15 U.S.C. 7704(a)(5)(A)(i)

1 passed

Nothing to do here.

Says who is sending

ShowHide

Says who is sendingCAN-SPAM Act

Signed "Tom".“Tom”

Header and sender information must not be false or misleading. CAN-SPAM Act, 15 U.S.C. 7704(a)(1)

Check the claims

Ken AI

The rules can't tell a fair claim from a misleading one. Ken AI reads the email for guarantees, unverifiable numbers, fake urgency and implied prior contact.

Cold email grader

Then

Spam word checker

Email me this report

Every rule for the recipient's country, what to change with the rule it comes from and, if you ran it, the claims Ken AI would change. Your full email isn't included.

The fix for every missThe rule behind each oneYour cold email is never stored

Write and send cold email with Ken.

Ken writes a personalized email for every lead and checks each one against its spam and copy rules before it sends.

Start free - 1,000 credits, no card

What the compliance checker looks at

Paste a cold email and pick where the recipient is. The checker runs the checklist for that law and marks each item as passed, missing, to review or one only you can check, with the rule it comes from:

Sender identity: a real name in the sign-off, and for Canada the business you send for.
A physical postal address in the email, for the US and Canada.
A way to opt out.
A subject line with no fake "Re:" or "Fwd:" and no account-notice wording.
Claims in the body that could mislead, checked by an AI pass.
For the EU and UK, a line telling people where you got their data. Legitimate interest and CASL consent show as checks only you can confirm, because the text can't prove them.

It isn't legal advice. It catches the common mistakes, and each check links to the law it comes from.

The four laws, in short

CAN-SPAM (United States) doesn't require consent, and it covers B2B email too. It requires honest headers and subject lines, a valid physical postal address, a clear way to opt out, and a message that is identifiable as an advertisement. You must honor opt-outs within 10 business days, and the opt-out has to keep working for at least 30 days after you send. Penalties run past $50,000 per violating email.
GDPR (EU) covers named work addresses like [email protected], because they identify a person. B2B outreach usually rests on legitimate interest under Article 6(1)(f), with a balancing test you can show. Article 14 says you must tell people where you got their data, and when you contact them, that has to happen in your first message at the latest. Article 21 gives them an absolute right to object to direct marketing. National ePrivacy laws add a layer. Germany generally requires prior consent even for B2B email, while France allows B2B email that relates to the recipient's job.
PECR (UK) lets you email corporate subscribers, such as limited companies and LLPs, without prior consent, as long as you say who you are and give a valid address for opt-outs. Sole traders and some partnerships count as individuals and need consent. UK GDPR still applies to the named person.
CASL (Canada) requires consent before you send. For cold B2B email that usually means implied consent: the person published their address, on a company website for example, without saying they don't want messages, and your email relates to their role. Every message needs your name, a mailing address and a phone, email or web contact, plus an unsubscribe that works for 60 days and takes effect within 10 business days.

How to fix the warnings

Missing address: add your company's postal address under the signature. For CAN-SPAM a PO box registered with USPS also counts.
No opt-out: add one plain line, such as "If this isn't relevant, reply and I'll stop emailing you." Then make sure someone actually stops.
Deceptive subject: drop "Re:" and "Fwd:" from first emails and make the subject describe the email.
No data source for EU or UK recipients: add a short line on how you found them, and keep a written record of your legitimate interest assessment.
Overclaims: replace "guaranteed results" and numbers you can't source with what you can back up.

A reply-based opt-out works under CAN-SPAM and CASL as long as it's clearly shown and you act on it.

Why compliance matters for cold email results

The law and good cold email point the same way. A real name, a real address and an easy way out make the email look like it came from a person, and that's what gets replies. People who can't find a way out click "report spam" instead, and complaints hurt delivery for the rest of your list. Google asks every sender to keep the spam rate reported in Postmaster Tools below 0.1% and never reach 0.3%.

Fines are the rarer risk. They are counted per email, though, so a campaign that gets it wrong gets it wrong thousands of times.

Questions

Is cold email legal?

In most markets, yes, with conditions. The US allows B2B cold email under CAN-SPAM if you follow its rules on headers, subject lines, address and opt-out. The UK allows it to corporate addresses under PECR. In the EU it depends on GDPR plus each country's ePrivacy law, and Canada's CASL requires consent, which can be implied for published business addresses. This tool checks one email against those rules. It isn't legal advice.

Does CAN-SPAM apply to B2B emails?

Yes. The FTC says the law makes no exception for business-to-business email. Every commercial email to a US recipient needs honest headers, a subject that doesn't mislead, a valid postal address, identification as an advertisement, and a clear opt-out that you honor within 10 business days.

Do I need consent to cold email someone in the EU?

Under GDPR you need a lawful basis, and for B2B outreach that is usually legitimate interest, not consent. You still have to tell people where you got their data and stop when they object. Some countries add consent rules through their ePrivacy laws. Germany, for example, generally requires prior consent for email marketing, including to businesses. Check the country before you send.

What does CASL require for cold emails to Canada?

Consent first. For B2B, implied consent covers an address the person published, for example on their company site, without a note refusing messages, as long as your email relates to their job. Each message must identify you with a mailing address and one other contact method, and include an unsubscribe that works for 60 days and takes effect within 10 business days. Penalties reach $10 million per violation for businesses.

Is this legal advice?

No. The checker flags common gaps against the published rules and cites each one, but it can't see your data sources, your consent records or the rules of your industry. For a large campaign or a regulated industry, ask a lawyer who knows the countries you send to.