Mailwarm Email Warmup

CAN-SPAM Act Compliance for Cold Email

The CAN-SPAM Act applies to every commercial email you send in the US, cold B2B outreach included. Here are its 7 requirements, the penalties, and how to keep your cold email compliant.

Start Email WarmupGet a Deliverability Audit

This page summarizes the FTC's CAN-SPAM compliance guide (last checked October 2026) for cold email senders. It isn't legal advice; talk to a lawyer about your specific situation.

The 7 CAN-SPAM requirements

  1. 1

    Don't use false or misleading header information

    Your From, To, Reply-To and routing information must be accurate and identify the person or business sending the email.

    For cold email: Send from a real person at your company, on a domain you own.

  2. 2

    Don't use deceptive subject lines

    The subject line must accurately reflect what the message is about.

    For cold email: Skip fake "Re:" or "Fwd:" prefixes on a first email.

  3. 3

    Identify the message as an ad

    You must disclose clearly that the message is an advertisement. The law gives you flexibility in how you do it.

    For cold email: A plain, honest sales email with a clear offer usually makes its purpose obvious.

  4. 4

    Tell recipients where you're located

    Include a valid physical postal address: a street address, a registered PO box or a private mailbox.

    For cold email: Add your company address to the signature of every outreach email.

  5. 5

    Tell recipients how to opt out

    Explain clearly how to stop future emails from you, in a way an ordinary person can easily recognize and use.

    For cold email: A simple line such as "Not interested? Reply and I won't email again" plus a working unsubscribe link.

  6. 6

    Honor opt-out requests promptly

    Process opt-outs within 10 business days, keep the opt-out working for at least 30 days after you send, and don't charge a fee or ask for more than an email address.

    For cold email: Sync unsubscribes across every inbox and tool you send from.

  7. 7

    Monitor what others do on your behalf

    If you hire an agency or tool to send for you, both of you can be held legally responsible.

    For cold email: Check that agencies and SDRs sending for you follow the same rules.

Does CAN-SPAM apply to cold B2B email?

Yes. The FTC is explicit that the law makes no exception for business-to-business email. Any email whose primary purpose is to advertise or promote a product or service is commercial, whether it goes to a consumer or to a work address.

What CAN-SPAM doesn't require is permission. It's an opt-out law: you can send a first cold email to someone you don't know, provided it follows the seven rules above and you stop as soon as they ask. Recipients outside the US may be covered by stricter laws such as GDPR or CASL.

CAN-SPAM penalties

Up to $53,088

per email that violates the law

The FTC adjusts this maximum for inflation every year. Because each email counts separately, one non-compliant sequence can mean thousands of violations. Both the company whose product is promoted and the company that sends the email can be held responsible, and practices such as harvesting email addresses or sending through open relays can also bring criminal penalties.

CAN-SPAM vs Gmail and Yahoo bulk sender rules

CAN-SPAM is the legal minimum. Since 2024, Gmail and Yahoo have added their own technical rules for anyone sending around 5,000 or more emails a day, and they decide whether you reach the inbox at all.

TopicCAN-SPAM ActGmail and Yahoo bulk sender rules
UnsubscribeA clear opt-out, honored within 10 business daysOne-click unsubscribe for marketing and subscribed messages
AuthenticationNot required; headers must not be misleadingSPF, DKIM and a DMARC record, with the From domain aligned
Spam complaintsNo thresholdKeep the spam rate below 0.3%
Enforced byThe FTC, with fines per emailThe mailbox providers, by filtering or rejecting mail

Check your authentication with the DMARC checker and SPF checker, and build sender reputation gradually with cold email warmup.

CAN-SPAM Act: Common Questions

The CAN-SPAM Act sets the rules for commercial email in the United States. It doesn't ban unsolicited email, but it requires honest headers and subject lines, a clear opt-out, a physical address, and prompt handling of unsubscribe requests. It also gives recipients the right to stop you emailing them, and lets the FTC penalize senders who break the rules.

According to the FTC, each separate email that violates the CAN-SPAM Act can be fined up to $53,088, so a single campaign can add up quickly. The FTC adjusts the amount for inflation every year. More than one company can be held responsible for the same email, and some practices, such as harvesting addresses, can also bring criminal penalties.

CAN-SPAM prohibits commercial emails that use false or misleading header information, deceptive subject lines, or no working way to opt out, and emails sent to people who have already unsubscribed. It also penalizes sending to addresses harvested from websites or generated automatically. Transactional and relationship emails, such as receipts, are mostly exempt from the rules.

Yes, the CAN-SPAM Act is still in effect. It was passed in 2003 and is enforced by the Federal Trade Commission, which keeps its compliance guide for businesses up to date and adjusts the maximum penalty for inflation each year. Gmail and Yahoo's newer bulk sender rules apply on top of it, not instead of it.

No, CAN-SPAM doesn't require prior consent for commercial email in the US. It is an opt-out law: you can email someone you don't know, as long as the message follows the rules and you stop when they ask. Other countries are stricter, so check the rules where your recipients are, such as GDPR in the EU or CASL in Canada.

Ready to Land in Every Inbox?

Stop losing opportunities to spam folders. Boost your sender reputation and watch your outreach thrive.

Start Email Warmup Talk to an Email Expert