Is Cold Emailing Illegal in the US? CAN-SPAM Rules (2026)
Short answer
No. Cold email is legal in the United States. The rules sit in the CAN-SPAM Act, and they apply to commercial email whether it is a first contact or the tenth. Breaking them is what makes cold email illegal, and the penalties are high enough to matter: one guide puts the cost of wrong execution at $53,088 per email under CAN-SPAM.
What CAN-SPAM requires
The FTC's CAN-SPAM compliance guide for business sets out the core duties. In practice, a compliant cold email needs:
- Accurate sender information. The From name, the From address, and the reply-to address must identify who is actually sending the message.
- A subject line that matches the content. Misleading subject lines are a violation.
- A clear marker that the message is an ad, where the law requires one.
- A valid physical postal address for the sender.
- A working opt-out. Every message must give the recipient a way to stop future emails, and you must honor that request.
- No deceptive routing. Headers, domains, and sender details must not hide who is behind the message.
If each email meets these points, a cold email to a business contact is generally legal. The law does not require prior consent for B2B cold email in the US, which is the main difference from several other countries.
What the law does not ban
CAN-SPAM does not stop you from:
- Emailing someone you have never met.
- Writing a persuasive pitch or asking for a meeting.
- Sending a sequence of follow-ups, as long as each email is compliant and opt-outs are honored.
- Emailing a business role, such as a VP of Sales, at a company you target.
Some commentators argue that a long, pushy first email is a bad idea, but that is a practice problem, not a legal one. The law is about how the email is sent, not how good the pitch is.
Where cold email goes wrong in practice
Most cold email problems in 2026 are about deliverability, not legality. Inbox providers filter senders that look like bulk mail. Some reference points from the ZoomInfo guide:
- Spam complaint rates above 0.30% risk throttling, and above 3% can get you blocked by Gmail entirely.
- A common setup error is an SPF record with more than 10 DNS lookups, which causes failures even when the record exists.
- Since February 2024, Google and Yahoo require all three authentication standards for bulk senders: SPF, DKIM, and DMARC.
- A typical warm-up follows a ramp of about 5 emails per day in week 1, 15 in week 2, 30 in week 3, and 40 or more by week 4, per the same guide.
None of these is a legal requirement. They are how inbox providers decide whether your mail reaches a person. A campaign can be fully legal and still land in spam if the domain is new, the lists are stale, or volume jumps overnight.
Tracking and list quality
The ZoomInfo guide also notes that tracking pixels that load third-party domains can trigger spam filters. Open rates have been less reliable since Apple's Mail Privacy Protection launched in 2021, so judge a campaign on replies and meetings, not opens.
Outside the US
If your list includes contacts outside the US, the rules change. The EU's GDPR has penalties of up to EUR 20 million or 4% of global revenue, and several countries require consent for B2B email. Check the rules for each country on your list before sending, and do not assume the US position applies everywhere.
Compliance checklist for any cold email program
| Area | What to check |
|---|---|
| Sender identity | Real name, company, and reply address in every email |
| Subject line | Matches the body and does not mislead |
| Postal address | Included in every message |
| Opt-out | Visible, working, and honored in your system |
| Domain setup | SPF, DKIM, and DMARC configured |
| Sending volume | Ramped gradually, spread through the day |
| Lists | Verified contacts, removed when they opt out |
| Sending domain | Separate from your main brand domain, where possible |
Ask any outbound provider how they handle each row. A good answer names the tools and the process, not just a promise.
Working with an outbound partner
Agencies and outbound partners carry the same legal duties as you do. Before you hire one, ask who sends from which domain, who owns the opt-out process, and where the postal address comes from. Scale Blueprint runs outbound for growth-stage B2B teams, and the first step is a free 30-minute pipeline plan call with the founder, Chris Irving. You can book it here. Whether or not you work together, you leave with a 90-day plan.
FAQ
Is cold emailing illegal in the USA?
No. Cold emailing is legal in the US as long as it follows CAN-SPAM. The main requirements are accurate sender information, a non-deceptive subject line, a valid postal address, and a working opt-out that you honor.
Are you allowed to send cold emails?
Yes, in the US, to business contacts, provided each email meets the CAN-SPAM rules. Other countries, including EU and UK members, have stricter consent rules for some contacts, so check the country before you send.
Do cold emails still work in 2026?
They can, but deliverability is the limit. Inbox providers now require authentication for bulk senders, and volume must ramp gradually. Campaigns that follow those basics are the ones that reach people.
What is a B2B lead generation agency?
A B2B lead generation agency finds and contacts prospects for a business customer, usually through email, phone, or both, and passes qualified interest to the customer's sales team. Ask what it sends, from which domain, and how it handles opt-outs and replies.