CAN-SPAM Act Complete Guide for B2B Cold Email — 2026 Update

The CAN-SPAM Act is the US federal law governing commercial email. It is an opt-out regime — not opt-in — which means prior consent is not required for B2B cold email to US business addresses. This makes the US the most permissive major market for cold email globally. Understanding what CAN-SPAM actually requires is essential for running compliant outbound campaigns to US businesses.

The Six Core CAN-SPAM Requirements

1. No false or misleading header information. Your From, To, Reply-To, and routing information must accurately identify you as the sender. Using deceptive sender information — sending as a fake person, disguising the commercial origin — is a CAN-SPAM violation regardless of any other compliance element.

2. No deceptive subject lines. Your subject line must accurately reflect the content of the email. 'Quick question' sent as a sales email is not deceptive. 'Your account has been suspended' sent as a sales email is deceptive.

3. Identify the message as an advertisement. The commercial nature must be clear — not that you must literally say 'This is an advertisement.' A business cold email that clearly identifies a commercial purpose satisfies this requirement.

4. Tell recipients where you are located. Every commercial email must include a valid physical postal address — either a current street address, a registered PO Box, or a private mailbox registered with a commercial mail receiving agency.

5. Provide a clear opt-out mechanism. Every commercial email must include a clear, conspicuous, and working method for recipients to opt out of future email. This must be functional for at least 30 days after the email is sent.

6. Honour opt-out requests within 10 business days. You cannot charge a fee for opting out. You cannot require any information other than an email address and opt-out preference.

What CAN-SPAM Does NOT Require

Prior consent is not required. CAN-SPAM is explicitly an opt-out law. You do not need permission to send the first cold email to a US business address. Recipients can opt out after receiving it — but prior consent is not a legal requirement. This is the fundamental difference from GDPR (EU) and CASL (Canada).

Cold email is not illegal. Cold email to US business addresses is 100% legal under CAN-SPAM for commercial purposes. Claims that cold email is illegal in the US are simply incorrect.

No word count or frequency limits. CAN-SPAM sets no requirements on email length, frequency of contact, or sequence structure. You may send multiple follow-up emails to the same contact as long as opt-out requests are honoured within 10 business days and the other requirements are met.

Common CAN-SPAM Violations in Cold Email

Missing physical address: the most common CAN-SPAM compliance failure. Every email must include a valid postal address. Add your registered business address to every email signature and template.

Non-functional unsubscribe links: broken links, links that require login to unsubscribe, or links that go to an error page are CAN-SPAM violations. Test unsubscribe links in every template before launching a campaign.

Deceptive from-names: using a generic from-name that hides the commercial origin, or impersonating a known individual or company, violates header requirements. Use a real name and a real email address that reflects your actual company.

Continuing to send after opt-out: the most serious CAN-SPAM violation from an enforcement perspective. Sending any commercial email to someone who has already opted out is an explicit violation. Maintain a global suppression list.

CAN-SPAM Penalties and Enforcement

CAN-SPAM penalties are calculated per email: $51,744 per violation. In theory, a campaign of 10,000 non-compliant emails could generate fines exceeding $500 million. In practice, the FTC has pursued enforcement actions against bulk spam operations, phishing, and repeat violators — not well-intentioned B2B cold email programmes with procedural compliance failures.

B2B cold email programmes that include a physical address, functioning unsubscribe, accurate from-information, and non-deceptive subject lines have essentially zero CAN-SPAM enforcement risk even at significant volume. Individual recipients cannot sue under CAN-SPAM — there is no private right of action for individuals.

CAN-SPAM vs GDPR — Running US and EU Campaigns Simultaneously

CAN-SPAM (US): opt-out basis. No prior consent required. Physical address required. Opt-out must be honoured within 10 days. GDPR (EU): requires a legal basis for processing. For B2B cold email, legitimate interest (Article 6(1)(f)) is the standard legal basis. LIA (Legitimate Interest Assessment) recommended as documentation. Right to erasure (not just opt-out) must be honoured.

Practical approach for dual-market campaigns: maintain separate lists for US and EU contacts. Apply CAN-SPAM compliance elements to all emails (they satisfy GDPR requirements too, as they are a subset). Add legitimate interest documentation for EU campaigns specifically. Use a single suppression list globally — opt-outs from EU contacts processed as GDPR erasure requests. Run US sequences at higher frequency than EU — GDPR proportionality principles mean excessive frequency can undermine legitimate interest justification.