Is Cold Email Legal? CAN-SPAM Rules for B2B Outreach (2026)

Is cold email legal, in short: yes, in the US. CAN-SPAM does not require consent before a commercial email, including B2B cold email, but every message must have honest headers and subject lines, identify itself as an ad, include a valid postal address and a working opt-out, and opt-outs must be honoured within 10 business days. Each violating email can cost up to $53,088.

More on this topic: Cold email and deliverability, every guide in one place.

The law is permissive about who you may email and strict about how. The FTC's guidance says CAN-SPAM makes no exception for business-to-business email, so the rules apply in full to a message sent to a company address. Outside the US the picture changes, and some countries require consent first. This guide covers the US rules requirement by requirement, then the main differences abroad.

Key takeaways

Is cold emailing legal in the United States?

Cold emailing is legal in the United States as long as each message complies with the CAN-SPAM Act. The Act regulates commercial email — messages whose primary purpose is to advertise or promote a product or service — and it does not require the recipient's prior consent. It does require that you stop when asked.

That makes the US unusual. In much of the world the default is the opposite: you need consent, or a specific exception, before the first marketing email. So a cold email programme that is fine for US recipients can be unlawful for the same list's Canadian or German contacts.

Does CAN-SPAM apply to B2B cold email?

Yes. The FTC states that CAN-SPAM makes no exception for business-to-business email, so a sales email to a company address must meet every requirement that a consumer marketing email does. What matters is the message's primary purpose, not who receives it.

What does CAN-SPAM require in every cold email?

CAN-SPAM requires eight things of commercial email, listed in the FTC's compliance guide. In practice, five of them are visible in the email itself and three are about how you run the programme.

Requirements and the penalty figure checked against the FTC's CAN-SPAM Act compliance guide on 25 October 2026. This is a plain-English summary, not legal advice — check with a lawyer for your own situation, especially when emailing outside the US.

The FTC's guide also says you cannot charge a fee for opting out, require personal information beyond an email address to process it, or sell or transfer the address of someone who has opted out (except to a company you hired to help you comply). Transactional and relationship messages, such as a receipt or account notice, are mostly exempt, but must still not contain false routing information.

What are the penalties for breaking CAN-SPAM?

Each separate email that violates CAN-SPAM can cost up to $53,088, according to the FTC. Because the penalty is per email, a sequence sent to a list multiplies it quickly. The FTC also notes that more than one party can be held responsible, including the company whose product is promoted and the one that sent the email.

Is cold email legal in Canada, the UK and the EU?

Cold email is more restricted outside the US. Canada's anti-spam law (CASL) generally requires express or implied consent before a commercial email, and the UK and EU countries apply their own electronic marketing rules alongside GDPR. Some allow B2B email to corporate addresses with an opt-out; others, such as Germany, are much stricter.

The rule that matters is where the recipient is, not where you are. If your list mixes countries, segment by country and apply the strictest rule that covers each segment, or leave those contacts out until you have checked. Each region has its own guide: Canada (CASL), the UK (PECR), the EU (GDPR) and Australia (Spam Act).

What makes cold email risky even when it is legal?

Bought or scraped lists, misleading subject lines and ignored opt-outs make cold email risky even where it is lawful, because they drive the spam complaints that mailbox providers act on. Gmail tells senders to keep reported spam under 0.3%.

• Purchased lists. Legal to buy in the US in many cases, but full of stale addresses and people with no reason to hear from you.
• Fake reply threads. A “Re:” on a first email is a deceptive subject line.
• No easy way out. A missing or broken opt-out is the most common CAN-SPAM failure and the fastest way to earn complaints.
• Volume. Too many emails a day from one mailbox — see how many cold emails per day per inbox.

A compliant cold email checklist

A compliant US cold email has a real sender, an honest subject, an obvious commercial purpose, a postal address and a working opt-out, and it is sent to someone with a plausible reason to care.

• Send from a real person on a domain you own, with SPF, DKIM and DMARC set up (our deliverability checklist covers each record).
• Write a subject line that describes the email.
• Make the commercial purpose clear in the body.
• Include your business name and postal address in the footer.
• Include an unsubscribe link or a clear opt-out line, and test it.
• Suppress opt-outs automatically across every campaign and tool.
• Keep records of where each contact came from.
• Check the country of each contact before you send.

Tools can enforce part of this. In Scalry, which publishes this guide, every commercial send carries a working unsubscribe with one-click headers, opt-outs are suppressed across campaigns and agents, and your business name and postal address are added as a footer automatically. Purchased and scraped lists without a lawful basis are prohibited by its acceptable use policy. For how to structure the emails themselves, see our cold email sequence guide.

Frequently asked questions

Is cold emailing illegal?

No, not in the US. CAN-SPAM allows commercial email without prior consent, provided each message meets its requirements, including a postal address and a working opt-out. Other countries, such as Canada, generally require consent first.

Does CAN-SPAM apply to B2B email?

Yes. The FTC says the law makes no exception for business-to-business email.

How quickly must I honour an unsubscribe request?

Within 10 business days, and your opt-out mechanism must keep working for at least 30 days after you send the message.

What is the fine for violating CAN-SPAM?

Up to $53,088 for each separate violating email, according to the FTC's compliance guide.

Do I need a physical address in cold emails?

Yes. CAN-SPAM requires a valid physical postal address: a street address, a post office box, or a private mailbox registered under Postal Service rules.

Is it legal to email someone in Canada without consent?

Generally not. Canada's CASL requires express or implied consent before most commercial emails. Check whether an implied-consent exception applies before you send.

Can I use a purchased email list for cold email?

CAN-SPAM does not ban it outright, but many platforms prohibit it, and bought lists cause the bounces and complaints that get domains blocked. Outside the US it often fails consent rules.

How Scalry applies the unsubscribe and CAN-SPAM footer to every send is described on the cold email page.