Is Cold Emailing Illegal? CAN-SPAM Rules, Penalties, and Enforcement

Cold emailing is not illegal in the United States. Federal law lets you send a commercial email to someone who has never heard of you, with no prior consent required, as long as the message meets the rules in the CAN-SPAM Act. The catch is in the details: each email has to carry accurate header information, an honest subject line, a clear ad disclosure, a real postal address, and a working way to opt out, and you have to honor those opt-outs on time. Skip any of those, and every message you sent is a separate violation.

That opt-out model is what sets U.S. law apart. Europe and Canada require consent before you send. The U.S. lets you email first and requires you to stop when asked.

The Six Rules Every Cold Email Has To Follow

CAN-SPAM covers any email whose primary purpose is advertising or promoting a product or service. A cold sales pitch, a demo request, a partnership proposal — if it’s fundamentally a sales message, the Act applies no matter how personalized it looks. The FTC has confirmed you do not need the recipient’s permission before sending.¹ What you do need is compliance on six points:

Truthful header information. Your “From,” “To,” “Reply-To,” originating domain, and email address have to accurately identify who sent the message. No spoofing sender names, no routing through misleading domains.¹
Honest subject lines. The subject has to reflect what’s actually in the email. “Your invoice is ready” on a sales pitch is deceptive and illegal.¹
Clear disclosure that the message is an ad. The law does not dictate exact wording, so you have room to phrase it naturally.¹
A valid physical postal address. Your street address works, so does a USPS-registered P.O. box, and so does a private mailbox registered with a commercial mail receiving agency under Postal Service rules. That last option covers a registered virtual office, which is useful if you run the business from home.¹
A working opt-out mechanism. That can be a reply-to email address or a single web page. You cannot force people to log into an account, answer questions, or take any step beyond one reply or one webpage.¹
Prompt honoring of opt-outs. Once someone asks you to stop, you have 10 business days to stop sending them commercial email. You cannot charge a fee or demand personal information beyond their email address.¹

One rule surprises people: after someone opts out, you cannot sell, lease, or transfer their address to anyone, even as part of a larger list. The only exception is sharing it with a vendor you’ve hired specifically to help you comply with CAN-SPAM.¹

How You Build the List Matters Too

Some list-building methods are illegal on their own, separate from anything in the email itself. Address harvesting — using automated software to scrape addresses from websites that prohibit sharing user contact information — is specifically banned. So are dictionary attacks, where a sender generates addresses by cycling through predictable combinations like asmith@company.com, bsmith@company.com, and so on, hoping some hit real inboxes.² Either technique moves you out of civil penalty territory and into potential criminal liability.

Accessing someone else’s computer without authorization to send commercial email, or registering for email accounts using false information to send bulk messages, also crosses into criminal conduct.

What Violations Cost

Each individual email that violates CAN-SPAM can trigger a civil penalty of up to $53,088.¹ The figure is adjusted for inflation from time to time, so check the FTC’s current guidance for the latest number. The arithmetic is unforgiving: a batch of 1,000 noncompliant emails puts you on the hook for tens of millions of dollars in potential exposure.

Liability spreads. Both the company whose product is promoted in the email and the company that actually sent it can be held responsible.¹ Hiring an agency or a freelancer to run your outreach does not shift the risk off your company. The FTC’s position is that you cannot contract away your legal responsibility to comply.

Who Can Come After You

The FTC is the primary enforcer. State attorneys general can also bring civil actions in federal court on behalf of their residents when they believe someone is violating the Act.³ A range of other federal agencies, from the SEC to the FDIC, hold enforcement authority over the entities they regulate.

Individual recipients cannot sue you under CAN-SPAM. The Act reserves its private right of action for internet access service providers, and even they must show they were adversely affected by specific violations, like false routing information or the prohibited techniques above.⁴

That does not mean state law is out of the picture. CAN-SPAM does not preempt every state statute. State laws that specifically target material falsity or deception in commercial email survive federal preemption, and a handful of states maintain their own email marketing laws, some of which give recipients a private right of action that federal law does not. Treat CAN-SPAM compliance as the floor.

Email Platforms Enforce Stricter Rules Than the Law

Legal compliance alone will not keep your outreach running. Gmail, Yahoo, and the major marketing platforms apply rules that go beyond CAN-SPAM, and their enforcement is faster than any government action.

Gmail and Yahoo expect bulk senders to keep spam complaint rates below 0.1 percent. If more than 1 in 1,000 recipients marks your messages as spam, your sender reputation drops and deliverability follows it down. Both providers also require authenticated email with SPF and DKIM records, plus one-click unsubscribe headers for higher-volume senders. Fail those technical checks and your messages can get blocked regardless of how clean your content is. Google can permanently disable an account after five suspensions within a single calendar year.

Marketing platforms like Mailchimp and HubSpot prohibit purchased or scraped lists under their terms of service. Your sending can be technically legal and still get your account suspended if the platform decides your practices generate too many complaints.

Emailing People Outside the U.S.

CAN-SPAM’s opt-out approach does not travel. If your recipients are in Europe or Canada, you are subject to stricter consent-based laws, and not knowing where a prospect lives is not a defense.

European Union

Email marketing in the EU is governed by both the GDPR and the ePrivacy Directive. The GDPR recognizes direct marketing as a potential “legitimate interest,” but the ePrivacy Directive specifically requires consent before sending marketing emails.⁵ In practice, cold emailing European individuals without prior consent violates EU rules. GDPR penalties can reach €20 million or 4 percent of global annual turnover, whichever is higher.⁶ Even where you have consent, recipients keep the right to object to direct marketing under Article 21, and once they object you must stop immediately.

Canada

Canada’s Anti-Spam Legislation (CASL) also requires consent before you send a commercial electronic message. CASL recognizes express consent, where the recipient explicitly agrees, and implied consent, which can arise from an existing business relationship or from a recipient publicly publishing their email address without restrictions on unsolicited messages.⁷ Every message must also include sender identification and a working unsubscribe mechanism. Violations carry penalties of up to $1 million per violation for individuals and $10 million for businesses.⁸

If you’re running international outreach, segment your lists by recipient location. What is perfectly legal for a prospect in Dallas can generate six-figure fines for the same message sent to Dublin or Toronto.

1
Federal Trade Commission. CAN-SPAM Act: A Compliance Guide for Business
2
Legal Information Institute. CAN-SPAM Act of 2003: Problematic Spamming Techniques
3
Office of the Law Revision Counsel. 15 USC 7706 – Enforcement Generally
4
Legal Information Institute. CAN-SPAM Act of 2003: Private Right of Action for Internet Access Service Providers
5
GDPR-Info.eu. Email Marketing
6
GDPR-Info.eu. Fines / Penalties
7
Innovation, Science and Economic Development Canada. Getting Consent to Send Email
8
Canadian Radio-television and Telecommunications Commission. Frequently Asked Questions about Canada’s Anti-Spam Legislation