Is B2B cold email legal in the US? The CAN-SPAM checklist for small firms
Yes, sending unsolicited commercial email to US businesses is legal under federal law, as long as each message follows CAN-SPAM. The rules are short. Breaking them is expensive.
B2B is not exempt
The FTC's compliance guide is direct: the law covers "any electronic mail message the primary purpose of which is the commercial advertisement or promotion of a commercial product or service," and it "makes no exception for business-to-business email." Every cold email in a sequence, including follow-ups, is a commercial message.
The seven requirements
- Accurate headers. From, To, Reply-To and routing must identify who sent it. A separate sending domain is fine; a domain that disguises who you are is not.
- Honest subject lines. The subject must reflect the content. Google's sender guidelines add: don't start a subject with "Re:" or "Fwd:" unless the message really is a reply or forward.
- Identify the message as an ad. Clear and conspicuous; the FTC leaves the wording to you.
- A valid postal address: a street address, a USPS box, or a registered private mailbox.
- A clear opt-out by reply or a single web page.
- Opt-out rights apply to everyone, including existing customers.
- Honor opt-outs within 10 business days, keep the mechanism working 30 days after the send, and never sell or transfer the addresses of people who opted out.
The guide also says you can't contract away responsibility: "both the company whose product is promoted in the message and the company that actually sends the message may be held legally responsible." Each violating email can cost up to $53,088 (16 CFR 1.98; the FTC kept 2025 amounts for 2026).
What CAN-SPAM doesn't cover
- Other countries. Canada (CASL) and the EU and UK (GDPR and PECR) use consent-based rules. Many US outbound programs simply exclude non-US recipients.
- Inbox providers. Gmail and Yahoo set their own sender requirements on top of the law. See our guide to Gmail and Yahoo sender requirements.
- Your data source's terms. Licensed B2B data providers restrict how their data may be used; read the license before you load a list.
A checklist for every sequence step
| Item | Pass if |
|---|---|
| From name and address | Real company name; replies reach a monitored inbox |
| Subject | Describes the email; no fake Re: or Fwd: |
| Ad notice | Present in the body or footer |
| Postal address | Valid, in the footer |
| Opt-out | Works by reply and by link; suppression list checked before each send |
| Recipients | US business addresses only, from a licensed source |
| Follow-ups | Stop automatically when someone replies or opts out |
Written by AI agents for Reply Garden and checked against the sources below on October 27, 2026. General information, not legal advice. Spotted an error? Email hello@replygarden.com.
Sources
- FTC: CAN-SPAM Act, A Compliance Guide for Business
- FTC civil penalty amounts unchanged for 2026 (Federal Register)
- 16 CFR 1.98
- Google: Email sender guidelines
Rather have it run for you? Reply Garden runs compliant outbound email for small US B2B firms: licensed data, separate sending domains, copy you approve, and interested replies forwarded within a business hour. No promises about meetings or revenue.