SOVE7GN GTM
Is cold emailing illegal in the US? What CAN-SPAM allows, and how the UK, EU and Canada differ
Updated 15 November 2026 · Written by Reyansh Juneja and Naman Dhiman, the co-founders of SOVE7GN, who run inbound, midbound and outbound for founders
Is cold emailing illegal in the US? No: US law lets you email a stranger, including at a business address, without asking first, as long as you follow the CAN-SPAM Act's rules on honest headers, a postal address and a working opt-out. The legal risk starts when you hide who you are, mislead in the subject line, ignore unsubscribes, or harvest addresses with scraping tricks the law treats as criminal.
Short answer: CAN-SPAM is an opt-out law, not an opt-in law. The FTC's CAN-SPAM compliance guide says the law "makes no exception for business-to-business email", requires accurate header information, a subject line that reflects the content, a valid physical postal address and an opt-out honored within 10 business days, and puts each violating email at risk of penalties of up to $53,088 (checked November 2026). Canada is much stricter, and the UK sits in between. This is general information, not legal advice.
What does CAN-SPAM actually require in a cold email?
Everything below is from the FTC's guide, checked November 2026. We have turned each rule into the check you would run on a real message.
| FTC rule | What it means for a cold email | Check before you send |
|---|---|---|
| Header information must be accurate | The From, To, Reply-To and routing details identify the business that sent it | A real person's name at a domain your company owns |
| No deceptive subject lines | The subject must "accurately reflect the content of the message" | No fake "Re:" or "Fwd:", no invented meeting reference |
| Identify the message as an ad | The guide says the message must clearly disclose that it is an advertisement | Ask your lawyer how this applies to a one-to-one sales note |
| Include your location | A valid physical postal address: street address, registered PO box or commercial mail receiving agency | Address in every signature, including follow-ups |
| Tell people how to opt out | A clear way to stop future email, working for at least 30 days after sending | One plain line: "Reply 'no' and I will not email again" |
| Honor opt-outs promptly | Within 10 business days | Remove the same day, across every inbox and tool |
| You stay responsible | "You can't contract away your legal responsibility." The company promoted and the company that sends can both be liable | Ask any agency or AI tool how it handles opt-outs |
Two practical notes. The opt-out and postal address go in every message of a sequence, not only the first. And if an agency or tool sends under your name, the FTC guide is explicit that the duty stays with you, which is the main reason to read how a vendor works before you let it touch your domain.
Can I go to jail for cold emailing?
Not for sending an honest sales email. The FTC guide lists the conduct where "the law provides for criminal penalties", and it is about deception and address theft: accessing someone else's computer to send spam, registering multiple email accounts or domains with false information, relaying spam through a computer to hide its origin, harvesting addresses or generating them through dictionary attacks, and using open relays or proxies without permission.
The harvesting line matters for founders who build lists with scrapers. Buying or building a list from verified business data is normal; running a tool that guesses thousands of address combinations at a domain is the kind of thing that line describes. How to build a clean list is in B2B lead list building.
Is cold emailing legal in the UK, the EU and Canada?
The rules depend on where the recipient is, not where you are. If your list includes people outside the US, check each country.
| Where the recipient is | B2B cold email to a work address | Key rule | Official source |
|---|---|---|---|
| United States | Allowed without prior consent | Follow CAN-SPAM: honest headers and subject, postal address, opt-out within 10 business days | FTC |
| United Kingdom | Allowed to corporate subscribers | The ICO says the PECR email marketing rule "does not apply to corporate subscribers", but sole traders and some partnerships count as individuals and need consent or the soft opt-in. Identify yourself and give a way to opt out. UK GDPR still covers personal data | ICO |
| European Union | Depends on the country | GDPR Recital 47 says direct marketing "may be regarded as carried out for a legitimate interest", weighed against "the reasonable expectations of data subjects". The email consent rules come from each country's ePrivacy law and differ | GDPR Recital 47 |
| Canada | Needs consent, express or implied | CASL implied consent can apply when the person "conspicuously published" their address without saying they do not want messages, and your message is relevant to their business role. Maximum penalty $1,000,000 for an individual and $10,000,000 for any other person | CASL s. 10(9), s. 20(4) |
All sources checked November 2026. The Canadian row is the one US founders miss. A Canadian buyer whose email you found in a database, rather than published on their own site, does not obviously meet the implied consent test. Many US startups simply split Canadian contacts into a separate list and get advice on it.
Is it legal but still risky?
Yes, and the bigger day-to-day risk is not the FTC. It is the mailbox providers. Gmail, Yahoo and Outlook publish their own sender rules on authentication, unsubscribe headers and spam complaint rates, and a domain that breaks them lands in spam whether or not it broke any law. Google, for example, tells senders to keep the spam rate in Postmaster Tools below 0.3% (Google sender guidelines, checked November 2026). We cover all three providers in cold email deliverability.
A compliant cold email is also usually a better one: short, from a real person, about one relevant thing, with an easy way to say no. Our outbound sequence template puts the address and opt-out line in every step.
A one-minute compliance check for each campaign
- Every recipient's country is known, and Canadian and EU contacts are handled separately.
- The From name is a real person at a domain your company owns.
- The subject line describes what is inside.
- A postal address sits in the signature of every step.
- A plain opt-out line is in every step, and removals happen the same day across all tools.
- The list came from a source you can name, not from guessing addresses.
- If an agency sends for you, you have seen its opt-out process in writing.
Who handles this if we outsource outreach?
You do, legally, whatever the contract says. If you hand outreach to SOVE7GN GTM, nothing goes out without your approval and every message is written for one person, so you can see exactly what is sent under your name. Pricing is shared on a call; book 30 minutes and bring your compliance questions for your own lawyer too. More guides are in the GTM guides hub, including when to outsource cold email.
Questions people ask
Do I need permission to send a cold email in the US?
No. CAN-SPAM does not require prior consent. It requires honest headers and subject lines, a postal address, a clear opt-out and removal within 10 business days, according to the FTC's compliance guide.
Does CAN-SPAM apply to B2B emails?
Yes. The FTC says the law makes no exception for business-to-business email, so a message to a work address has the same requirements as one to a consumer.
What is the fine for breaking CAN-SPAM?
The FTC states penalties of up to $53,088 for each separate email in violation, and both the company promoted and the company that sent the email can be held responsible.
Can I cold email people in Canada from the US?
If the person is in Canada, CASL is the law to check, and it requires express or implied consent first. Implied consent can apply when the person conspicuously published their address without refusing messages and your email relates to their role. Get advice before mailing a Canadian list.
Is cold emailing legal in the UK?
To corporate subscribers, generally yes: the ICO says the PECR email marketing rule does not apply to them. Sole traders and some partnerships are treated as individuals and need consent or the soft opt-in, and UK GDPR still applies.
Want calls on your calendar without hiring five people?
Book a 30-minute call. Tell us who buys from you and we'll show you what inbound, midbound and outbound would look like for your startup.
Book a call How SOVE7GN GTM works- Cold email deliverabilityProvider rules in plain words, plus a pre-send checklist for a new domain.
- How to build a B2B lead listLead sources ranked by freshness and legal risk, and how to test a list.
- Outbound sequence templateSix steps over three weeks, what each message does, and a worked example.