CAN-SPAM requirements for cold email come down to seven rules from the Federal Trade Commission: accurate headers, an honest subject line, a clear sign that the message is an ad, the sender's postal address, a working opt-out, opt-outs honored within 10 business days, and responsibility for anyone sending on your behalf. Each violating email can cost up to $53,088. CAN-SPAM asks for no prior consent, so B2B cold email to US prospects is legal when those rules are met. The EU, the UK and Australia set a higher bar. This is practical guidance from an outbound agency, not legal advice.
Key Findings
- CAN-SPAM covers B2B email too. The FTC says "The law makes no exception for business-to-business email."
- The penalty is up to $53,088 for each separate email, and both the company being promoted and the company sending can be held liable.
- A reply-based opt-out is enough under 15 U.S.C. 7704: the statute accepts a working return email address, as long as it keeps accepting requests for at least 30 days.
- In the EU, cold email usually rests on legitimate interest under GDPR Article 6(1)(f), and marketing has to stop the moment a person objects.
- In the UK, PECR lets you email corporate addresses without consent, but sole traders and some partnerships need consent or a soft opt-in.
- Australia's Spam Act needs consent before the first email. Inferred consent from a published work address only covers messages relevant to that person's role.
What is the CAN-SPAM Act?
The CAN-SPAM Act of 2003 is the US federal law that sets the rules for commercial email. It applies to any email whose primary purpose is to advertise or promote a product or service, and it is enforced by the FTC.
It covers one-to-one emails as well as bulk sends. The FTC compliance guide is direct on the B2B point: "The law makes no exception for business-to-business email." A hand-written cold email to a work address is a commercial email if it pitches something.
CAN-SPAM is an opt-out law. You can email someone first and they can tell you to stop. That single design choice is why cold email works in the US and why the same email can break the rules in Europe or Australia.
If you run outbound lead generation services across cold email, LinkedIn and cold calling, compliance belongs inside the workflow: the list, the sending setup and the suppression logic.
What are the CAN-SPAM requirements for cold email?
The statute is 15 U.S.C. 7704, and the FTC boils it down to seven rules. Each one applies to every commercial email you send, including the follow-up.
The seven rules, line by line
| Requirement | What the law says | What it means for cold email | Source |
|---|---|---|---|
| Accurate headers | No false or misleading From, To, Reply-To or routing information | Send from a real domain and mailbox your company controls | 7704(a)(1) |
| Honest subject line | The subject cannot mislead about the content | A short subject line is fine if the email delivers on it | 7704(a)(2) |
| Identify it as an ad | Clear and conspicuous notice that the message is an advertisement or solicitation | Applies to cold email, because there is no prior consent | 7704(a)(5) |
| Postal address | A valid physical postal address of the sender | A street address, a registered PO box or a private mailbox | FTC guide |
| Working opt-out | A return email address or online method, working for at least 30 days after the send | A plain line inviting a reply to opt out meets this | 7704(a)(3) |
| Honor opt-outs fast | Stop within 10 business days; no fee, nothing asked beyond the email address | Suppress the address the day the reply comes in | 7704(a)(4) |
| Monitor senders | You stay responsible for anyone emailing on your behalf | Applies to agencies and their clients alike | FTC guide |
Labeling a cold email as an ad
The ad identification rule only goes away when the recipient gave prior affirmative consent, and a cold prospect never did. The statute does not set any wording for it. Many senders rely on the pitch being plainly commercial and coming from a named company. If your counsel wants it explicit, say what you sell in the first two lines.
What a violation costs
The FTC guide puts the penalty at up to $53,088 for each separate email in violation. A 2-email sequence to 5,000 people is 10,000 separate emails, which is why a broken opt-out is never a small mistake.
Hiring an agency does not move the risk off your desk. The FTC says both the company whose product is promoted and the company that sends the email can be held legally responsible. Reachly sends on behalf of its clients, so the rules above are part of every campaign setup.
Does CAN-SPAM make cold email legal in Europe and Australia?
No. CAN-SPAM is an opt-out regime, and Europe and Australia start from the other end. A US-compliant cold email sent unchanged to an EU or Australian prospect still lacks the legal basis those markets ask for, and the unsubscribe line does not fill that gap.
CAN-SPAM is the floor for US commercial email. If most of your pipeline sits outside the US, the rules for those markets decide what you can send.
What changes under GDPR for EU prospects?
GDPR governs the personal data behind the email: the name, the work address and the notes in your CRM. The legal question starts before the first send, because you need a lawful basis to process an EU prospect's data at all.
Legitimate interest is the usual basis
For B2B cold email the basis is normally legitimate interest under Article 6(1)(f), which allows processing "necessary for the purposes of the legitimate interests pursued by the controller" unless the person's rights override them. Recital 47 adds that processing "for direct marketing purposes may be regarded as carried out for a legitimate interest."
"May be regarded" is doing real work in that sentence. You still have to weigh your interest against the person's, and write that balancing test down. A named head of procurement getting one relevant email about a procurement tool is an easy case. A personal Gmail address scraped from a forum is a weak one.
What the first email has to carry
The European Commission says a company relying on legitimate interest must tell people, at the latest at the first communication, that it is processing their data to send them adverts and that they have the right to object. Under the GDPR Article 21, once a person objects to direct marketing, their data can no longer be used for it. There is no 10-day grace period.
If you rely on consent instead, the Commission says it must be freely given, informed, specific, and given by a clear affirmative act, and it has to be as easy to withdraw as it was to give.
The list source matters as much as the copy
The same Commission guidance says that before buying a contact list from another company, you need to be able to show the data was obtained in compliance with GDPR and that it may be used for advertising. It also says email marketing has to follow the ePrivacy rules, which each member state writes into its own law. Some countries ask for consent even for B2B email, so check the country before you load the list.
That is where many outbound programs break. The copy is fine. The vendor trail is weak.
The UK runs its own version
The UK has UK GDPR plus PECR. The ICO's B2B marketing guidance says PECR's email consent rule does not apply to corporate subscribers such as limited companies and LLPs, so you can email them without consent. You still have to say who you are and give a valid address for opt-outs. Sole traders and some partnerships count as individuals and need consent or a soft opt-in, and the ICO advises treating an address as an individual's when you are unsure.
What changes under Australia's Spam Act for APAC outreach?
Australia is where cold email carries the most risk of the three markets here, and where many US teams get caught.
The Spam Act 2003 needs consent before you send a commercial email. ACMA, the regulator, accepts two kinds: express consent, where the person said yes, and inferred consent, which usually means an existing business relationship. ACMA is clear that consent stays with the business being promoted, even when someone else sends the message for it.
The published-address exception, and its limits
Schedule 2 of the Act says consent cannot be inferred "from the mere fact" that an address was published. It can be inferred when a work address is conspicuously published, the person would reasonably have agreed to that, there is no statement refusing commercial email, and your message is relevant to their work role.
That is a narrow door. An email to a CFO whose address sits on the company's contact page, about a finance tool, may fit. The same email bought from a data vendor, with no publication behind it, does not.
What every Australian email needs after consent
- Sender identification: the name of the business that sent it or authorized it, kept accurate for 30 days after sending
- Contact details: a way to reach that sender
- Unsubscribe: free, clearly presented and working for 30 days, with no login needed
- Unsubscribe handling: withdrawal takes effect within 5 business days
APAC is not one rulebook either. This article covers Australia because its rules are clear and enforced. If you sell across APAC, review each country on its own.
What should a compliant cold email actually include?
Most compliance failures are boring. They come from missing identity details, a sender name that matches no real business, or an unsubscribe process that breaks once replies start coming in.
The parts every email carries
- Sender: a real person's name and the company name
- Subject line: matches the message you actually sent
- Reason for contact: clear enough that the recipient is not misled
- Postal address: visible and valid in every email of the sequence
- Opt-out line: one sentence inviting a reply to stop, or an unsubscribe link
- EU and UK: where the data came from and the right to object, on the first email
How Reachly sets up the send
Reachly runs cold email as plain text. In Thibault Garcia's pre-launch checklist the last line reads "Campaigns are setup plain text, matching ESP, dynamic servers and 0 tracking", which means no open pixels and no tracked links. A plain reply line is the natural opt-out for that format, and the statute accepts a return email address as the mechanism.
Sequences are also short. Reachly sends 2 emails, 5 to 6 days apart, then moves non-repliers to LinkedIn.
Legal compliance and deliverability are two separate checks. A message can be legal and still land in spam, and a message can land in the inbox and still create legal risk.
That is why Reachly keeps the compliance layer inside the send setup, list build and suppression logic. The same system used for cold email outreach has to know which region a lead belongs to before the first message goes out.
How should you handle opt-outs, data and records?
This is the part that decides whether a compliance policy holds up once you send at volume.
Tag every lead by region before enrichment, keep the source record, and push every opt-out into one suppression layer across cold email, LinkedIn and cold calling. If a prospect says no once, every channel should know.
Where opt-outs come from on a plain-text campaign
With no unsubscribe link, opt-outs arrive as replies. On Reachly campaigns a filter in the master inbox catches unsubscribe replies so they never reach the client as leads. Each one should then go on the suppression list for every channel, well inside the 10 business days CAN-SPAM allows.
Records and list age
- Region tagging: separate US, EU, UK and Australia before the first send
- Source records: keep the vendor, the collection source and lawful-basis notes for every EU and UK contact
- Suppression: one opt-out removes the contact from every outbound channel
- List age: Thibault's rule is to re-validate any list older than three months before it is sent to
- Verification cost: in Thibault's cost breakdown, verifying 45,000 leads costs about $500
Teams commonly use Clay, Apollo and LinkedIn Sales Navigator for sourcing and enrichment, then ZeroBounce or MillionVerifier for re-validation. Raw lists on Reachly campaigns come in 10 to 25% catch-all before verification, so every list is verified twice before it enters a sequence. For how Reachly treats personal data on its own site, see Reachly's privacy policy.
When is cold email to a market too risky to run?
When the legal model depends on hope.
If your list source cannot show where the data came from, you do not have a clean EU workflow. If your APAC motion depends on unsolicited volume into Australia, you do not have a clean Australia workflow. If your team removes opt-outs by hand from one tool at a time, you do not have a reliable suppression process.
The deal-size test
There is a business caveat too. Running compliance across several regions takes setup, data work and records. Thibault Garcia's view on who should skip outbound is blunt: "Companies having a ticket size/ACV of $<5k US those companies should do outreach themselves." For them, tighter founder-led outreach to a small list is the saner move.
Where AI fits
AI can write a short signal snippet under tight rules, with a human checking it. It cannot decide which region a lead is in, hold a consent record, or keep a suppression list honest.
What should you do before you send into the US, EU and APAC?
Start with the list, then the copy. Tag the country. Check the source. Decide the legal basis. Add the sender identity, physical postal address and a working opt-out. Then test the suppression flow before a single live email goes out.
If you want a team that already runs this inside a signal-based outbound system, Reachly does that across cold email, LinkedIn and cold calling. You can see how the workflow fits together on the outbound lead generation services page, or review results from Primal and The Great Room before you book the meeting.
In short:
- US: follow the CAN-SPAM rules in every email and honor opt-outs within 10 business days
- EU: confirm a lawful basis, prove where the data came from, and stop when someone objects
- UK: email corporate addresses, and leave sole traders out unless they consented
- Australia: do not send marketing emails without consent
- Keep one suppression layer across every outbound channel
Want outbound that is built for each market before the first send?
Reachly sends plain-text cold email from dedicated secondary domains, verifies every list twice, caps sequences at 2 emails, and follows up on LinkedIn and by phone. One flat retainer from $3,500 a month covers cold email, LinkedIn and cold calling.
Book a call with Reachly →
FAQ
Is CAN-SPAM a law?
Yes. It is a federal statute, the Controlling the Assault of Non-Solicited Pornography And Marketing Act of 2003, codified at 15 U.S.C. 7701 to 7713, in force since January 1, 2004. It overrides most state laws on commercial email, except state rules that target falsity or deception in a message.
Who oversees CAN-SPAM?
The FTC enforces most of it. The FCC wrote the separate rules for commercial messages sent to mobile phone email addresses, and the Department of Justice handles criminal cases. State attorneys general and internet access providers can also sue under the Act. Individual recipients cannot.
Which is not allowed under the CAN-SPAM Act?
On top of the seven rules, 7704(b) treats some tactics as aggravated violations: harvesting addresses from websites, generating addresses by combining names and letters (dictionary attacks), creating email accounts by script to send from, and relaying through computers you have no permission to use. You also cannot sell or transfer the address of anyone who opted out.
What is the penalty for violating the CAN-SPAM Act?
Civil penalties run up to $53,088 per email. Some conduct is also a crime under 18 U.S.C. 1037, such as hijacking someone else's computer to send, or falsifying header information across many messages, and it can carry prison time.
Who is exempt from the Spam Act?
In Australia, government bodies, registered charities, registered political parties and educational institutions can send certain messages without consent, as designated commercial electronic messages. They still have to identify the sender. Messages with only factual information and no marketing are also outside the consent rule. A B2B company selling a product gets no exemption.
How to comply with the CAN-SPAM Act?
Beyond the seven rules, three details trip people up. Your opt-out has to work for at least 30 days after each send. You cannot charge a fee or ask for anything beyond an email address and the opt-out reply. And you can offer a menu of email types to opt out of, as long as one choice is to stop all commercial email from you.
Is unsolicited commercial email legal?
In the US, yes, as long as it follows CAN-SPAM. The law regulates unsolicited email rather than banning it. Australia treats it as spam unless consent exists, and Canada also requires consent, under its own anti-spam law, which this article does not cover.
