CAN-SPAM for Cold Email: The 8 Rules, the Penalty and What B2B Senders Get Wrong

Does CAN-SPAM apply to B2B cold email?

Yes. The FTC's compliance guide says the law makes no exception for business-to-business email. A cold email pitching your software to a company is commercial email.

CAN-SPAM is also an opt-out law. The FTC's guide does not require you to get permission before the first commercial email. It requires you to give people a clear way to stop future ones and to honour that. That is the opposite of the UK's PECR, which requires prior consent for sole traders and some partnerships, so a campaign that is lawful in the US can be unlawful if it reaches those UK recipients.

What are the eight CAN-SPAM requirements?

The numbering follows the FTC's guide, which lists the requirements in this order. The statute text is in 15 U.S.C. 7704: the opt-out mechanism and the 30-day working period are in (a)(3), the 10-business-day deadline and the ban on selling or transferring an opted-out address are in (a)(4), and the ad identifier, opt-out notice and postal address are in (a)(5). The statute lets you send a menu of choices, such as fewer emails, but it must include an option to opt out of everything. For the suppression list behind rule 6, see our guide to unsubscribe law and suppression lists.

What is the CAN-SPAM penalty?

The FTC's guide says each separate email in violation is subject to penalties of up to $53,088 (the figure shown on the page on 3 November 2026). Because the unit is the email, a 2,000-contact campaign with a missing postal address is 2,000 potential violations, not one. The guide also says the law provides criminal penalties, including prison, for aggravated conduct such as sending spam through someone else's computer without permission, harvesting email addresses, and misusing open relays or proxies.

Enforcement is not only the FTC. Section 7706 also gives state attorneys general a civil action, with statutory damages of up to $250 per violation, capped at $2 million for most violations and increased up to three times for willful and knowing violations or aggravated conduct. Internet access providers can sue too. The enforcement section we read does not give individual recipients a right to sue.

What do B2B cold senders usually get wrong?

• Assuming B2B is exempt. It is not. The FTC says so directly.
• Leaving out the postal address because the email is "from a person". The address is a legal requirement, and a registered private mailbox is acceptable to the FTC.
• Disguised follow-ups. A subject line implying a prior conversation that never happened is a deceptive subject line under the statute.
• Honouring the opt-out in one inbox only. If you send from five inboxes, the opt-out has to reach all five. The statute says the sender and anyone acting for it must stop.
• Letting an agency or tool take the risk for you. The FTC says you cannot contract away responsibility, and that both the company promoted and the company that sends can be held liable.
• Harvesting. Section 7704(b)(1) treats sending to addresses scraped from sites that prohibit it, or generated by combining names and letters, as an aggravated violation. For list-building rules by country, see is buying an email list legal.

What does CAN-SPAM not settle?

Three things. It does not decide whether Gmail, Yahoo or Microsoft will deliver your mail; they set their own rules, covered in our post on bulk sender requirements, and those can be stricter than the statute (Yahoo asks for opt-outs within 2 days against CAN-SPAM's 10 business days). It does not govern calls or texts; the US has separate rules for those, which we have not covered here. And it does not apply to your recipients in other countries.

We are building cold email into MAJ Leads now, so this page is the checklist we are building against, not a report on live campaigns. Where the product stands today is on how it works, and plans are on pricing.