What are the CAN-SPAM rules for cold email?

The federal floor: what US law requires

Cold email to a US recipient needs no prior consent. CAN-SPAM works on an opt-out model: you may send the first message, and you must stop when told. The FTC guide states that the law makes no exception for business-to-business email, so the rules below apply to B2B and B2C messages equally.

The FTC guide lists eight requirements. The statute behind them is 15 U.S.C. 7704.

#	Requirement	What it means in practice
1	Do not use false or misleading header information	"From," "To," "Reply-To" and routing data must be accurate
2	Do not use deceptive subject lines	The subject must reflect the content
3	Identify the message as an ad	Clear and conspicuous disclosure, unless the recipient gave prior affirmative consent
4	Tell recipients where you are located	Include a valid physical postal address
5	Tell recipients how to opt out	A clear, easy method that works for at least 30 days after you send
6	Remember that subscribers and members can opt out too	An existing relationship does not remove the right to opt out
7	Honor opt-out requests promptly	Within 10 business days, with no fee and no sale or transfer of the address
8	Monitor what others do on your behalf	You cannot contract away responsibility for a vendor's sends

The statute (15 U.S.C. 7704(a)(4)) bars the sender from selling, leasing or transferring an opted-out address except to comply with the law.

Cold email rules by country

CAN-SPAM is the most permissive of the four regimes covered here. Canada, the UK and the EU each work differently for B2B cold email. This table summarizes the rule each primary source states.

Regime	Consent model for B2B cold email	Key condition	Source
US CAN-SPAM	None required; opt-out	Eight requirements above	FTC guide
Canada CASL	Express or implied consent required	Implied consent can arise where the recipient conspicuously published the address, with no no-solicitation statement, and the message relates to their business role (s. 10(9)(b))	CASL ss. 9 to 15
UK PECR	No consent for corporate subscribers; consent for individuals	ICO: "You can email or text any corporate body." Sole traders and some partnerships count as individuals	ICO PECR email guide
EU GDPR	Lawful basis needed for personal data; absolute right to object	Art. 21(3): after an objection, personal data may no longer be processed for direct marketing	GDPR Art. 21

Two cautions. First, PECR and GDPR run side by side in the UK: a named person at a corporate address is still personal data. Second, the EU ePrivacy rules are set country by country, and this page does not summarize them. Check the member state before sending.

Google and Yahoo bulk sender requirements

Google defines a bulk sender as one that sends more than 5,000 messages per day to Gmail accounts. Its guidelines require SPF, DKIM and DMARC authentication (the DMARC policy can be set to none), TLS, valid forward and reverse DNS, and a user-reported spam rate below 0.30% in Postmaster Tools. Google advises staying under 0.10%.

Marketing messages must support one-click unsubscribe through List-Unsubscribe headers under RFC 8058, plus a visible unsubscribe link in the body. Yahoo lists the same core items for bulk senders and says to honor unsubscribes within 2 days. Google recommends fulfilling them within 48 hours.

These rules do not replace CAN-SPAM. They add technical and behavioral conditions that decide whether mail reaches the inbox at all. A message can be legal under federal law and still be rejected by Gmail.

Key dates since 2024

• 01/17/2025: The FTC's adjusted civil penalty maximums took effect. The figure for violations of trade regulation rules, which reaches CAN-SPAM through 15 U.S.C. 7706(a) and (c), is $53,088 per violation. It applies to penalties assessed after that date.
• 06/01/2024: Google's deadline for senders who already had an unsubscribe link to add one-click unsubscribe. From June 2024, bulk senders above a 0.3% spam rate lost eligibility for delivery mitigation.
• November 2025: Google began ramping up enforcement. Its FAQ says messages that fail the requirements will see disruptions, including temporary and permanent rejections.
• 06/19/2026: The ICO updated its Data (Use and Access) Act 2025 page to say all data protection provisions are now in force. The Act amends PECR, including a charity soft opt-in. The ICO page does not state PECR fine levels, so this page does not either.
• FTC guide: The guide is dated August 2023 with a January 2024 edit note for inflation-adjusted maximums, and it states $53,088. The 16 CFR 1.98 text checked on 10/10/2026 shows the same figure.

One sending policy that covers these rules

This policy meets the US floor and the Canadian, UK and mailbox-provider tests summarized above.

1. Send from a real domain with SPF, DKIM and DMARC set up, TLS on, and a warmed, separate sending domain.
2. Put your real name, company and a valid postal address in every message.
3. Use accurate headers and a subject line that matches the body.
4. Add a one-click List-Unsubscribe header and a visible unsubscribe link. Process requests the same day, well inside 2 days.
5. Keep a permanent suppression list. Sync it across every tool and vendor that sends for you.
6. For Canada, email only addresses meeting the s. 10(9) test, or with express consent, and keep the evidence.
7. For the UK, email corporate addresses only. Treat sole traders and personal-looking addresses as individuals needing consent.
8. For the EU, document your lawful basis and honor any objection permanently.
9. Watch spam complaints. Pause a campaign before it nears 0.10%.

Penalty exposure

The FTC can seek up to $53,088 per violating email. A campaign of 10,000 noncompliant messages is 10,000 potential violations, so the theoretical ceiling is $530,880,000. Courts set actual penalties, and that ceiling is not a forecast.

State attorneys general can sue under 15 U.S.C. 7706(f) for the greater of actual loss or up to $250 per message, capped at $2,000,000 except for header violations. Willful and knowing violations can triple the award. Internet access providers can sue under 7706(g) for up to $100 per message for header violations or $25 for others, capped at $1,000,000 except for header violations, also subject to trebling. Canada's CASL caps penalties at $1,000,000 for an individual and $10,000,000 otherwise (s. 20). Loss of sending reputation at Gmail and Yahoo is the faster penalty in practice.

Related guidance

Email is one channel. TCPA rules govern calls and texts, SMS marketing rules and 10DLC cover text registration, and consent revocation rules cover opt-outs across channels. The operating steps are in cold email prospecting, and list sourcing is in the B2B contact list guide. Data broker and privacy laws cover state rules on purchased lists, and prospecting penalties compare exposure across channels. The full compliance hub has the rest. For scale, see record counts.

Next step

Check how many records match your target market before you plan send volume. Request counts for your area.

This page is a plain-English summary with sources, not legal advice. Last reviewed 10/10/2026.

Questions people ask

Q01Is cold email legal in the US?

Yes. CAN-SPAM does not require consent before a first commercial email. It requires accurate headers, honest subject lines, ad identification, a postal address and a working opt-out. The FTC guide says the law makes no exception for business-to-business email.

Q02How long do I have to honor an unsubscribe?

Federal law gives you 10 business days from receipt of the request. Yahoo's bulk sender page asks for 2 days, and Google recommends 48 hours. Process opt-outs automatically the same day and you meet all three.

Q03Does CAN-SPAM apply if my email tool sends the messages?

Yes. The FTC guide says you cannot contract away your legal responsibility. A vendor that sends on your behalf does not move the liability. Audit their opt-out handling and suppression list sync before you send.

Q04Can I email a business in Canada the same way?

Not by default. CASL requires consent, express or implied. Implied consent can cover a business address the recipient conspicuously published with no no-solicitation statement, if the message relates to their role. Cold email to a Canadian address needs that test met.

Q05Do Gmail and Yahoo rules apply to small senders?

Google's bulk sender tier starts above 5,000 messages a day to Gmail accounts. Yahoo applies lighter rules to all senders: SPF or DKIM and a spam rate under 0.3%. Cold senders should meet the bulk standard from the first send.

Sources

1. FTC: CAN-SPAM Act, a compliance guide for business (edited January 2024)ftc.gov
2. 15 U.S.C. 7704, CAN-SPAM prohibitions and required contentlaw.cornell.edu
3. 15 U.S.C. 7706, CAN-SPAM enforcementlaw.cornell.edu
4. 16 CFR 1.98, adjusted civil penalty amountslaw.cornell.edu
5. Google: Email sender guidelinessupport.google.com
6. Google: Email sender guidelines FAQ (enforcement dates)support.google.com
7. Yahoo: Sender best practicessenders.yahooinc.com
8. ICO: Electronic mail marketing (PECR)ico.org.uk
9. ICO: The Data (Use and Access) Act 2025, what it means for organisationsico.org.uk
10. Canada: Canada's Anti-Spam Legislation, S.C. 2010, c. 23, ss. 6 to 8laws-lois.justice.gc.ca
11. Canada: Canada's Anti-Spam Legislation, ss. 9 to 15 (implied consent, s. 10(9))laws-lois.justice.gc.ca
12. Canada: Canada's Anti-Spam Legislation, ss. 16 to 24 (penalties, s. 20)laws-lois.justice.gc.ca
13. EU GDPR, Article 21 (right to object to direct marketing) (unofficial mirror of the regulation text; the EUR-Lex copy did not load for verification)gdpr-info.eu