[Guides](https://defrostmail.com/blog) # Is cold email legal in the United States? Updated November 9, 2026 Yes. In the United States it is legal to email a company you’ve never met, provided the message follows the CAN-SPAM Act. The Act applies to business-to-business email too. It does not require that the person agreed to hear from you first: it sets rules for the message and gives the reader the right to make you stop. This is general information, not legal advice. ## What does the CAN-SPAM Act require? The Federal Trade Commission publishes a compliance guide for businesses. These are its main requirements as they apply to a first email to a company, in our words: - **Be honest about who is sending.** Don’t use false or misleading header information. The header is the part of an email that says who it is from and where it came from. - **Don’t use a deceptive subject line.** The subject has to match what the email is about. - **Identify the message as an ad.** Don’t dress a commercial email up as something else. - **Say where you are.** Include a valid physical postal address. - **Say how to opt out.** Tell the reader how to stop future email from you. - **Honor opt-outs promptly.** You have 10 business days. The way to opt out must keep working for at least 30 days after you send the message. You can’t charge a fee or ask for anything beyond an email address. Once someone has opted out, you can’t sell or pass on their address, except to a company you’ve hired to help you comply. - **Watch what others do in your name.** If you hire someone to send for you, you are still responsible. The guide says you can’t contract away your legal responsibility. We read the guide on November 9, 2026. Read it yourself before you rely on any of this. It is linked under Sources. ## Does the law treat email to a business differently? No. The FTC’s guide says the law makes no exception for business-to-business email. A message to a company about what you sell is covered in the same way as a message to a consumer. ## Do you need permission before you write? Not under the CAN-SPAM Act. It works by opt-out: you may write, and the reader may tell you to stop. Once they do, you have to stop. ## What happens if you break the rules? Each separate email that breaks the Act can bring a penalty of up to $53,088, as stated in the FTC guide when read on November 9, 2026. The amount is adjusted for inflation, so check the guide for the current figure. ## What about other countries, and US states? The CAN-SPAM Act is United States federal law. Canada, the United Kingdom and the European Union have stricter rules. Some US states also have their own privacy laws. If you write to people outside the United States, check the rules where they are before you send, and ask a lawyer if you’re unsure. ## What does this mean in practice for a founder? - **Send as yourself.** Your real name, your real business, a subject line that says what the email is about, and your postal address at the bottom. - **Keep one list of everyone who has asked you to stop.** Check every new name against it before you write. The law allows 10 business days. The same day is better. - **A bought list doesn’t move the responsibility.** Whoever sold you the addresses, the emails are yours. There is more in [Should a small firm buy a lead list?](https://defrostmail.com/blog/should-you-buy-a-lead-list) - **Send few.** Every email in violation counts separately, and mail providers have rules of their own: see [How many cold emails should a small firm send a day?](https://defrostmail.com/blog/how-many-cold-emails-per-day) Legal is a low bar. An email can follow every rule and still be one the reader didn’t want. Whether it is worth sending is a separate question, covered in [Does cold email work for a consultancy, agency or service firm?](https://defrostmail.com/blog/does-cold-email-work-for-service-firms) ## How do you check someone who sends in your name? The responsibility stays with you, so ask anyone who sends for you: - Can I see each email before it goes? - What name and address is it sent from, and where do my postal address and the way to opt out appear? - How is an opt-out recorded, and how quickly is it honored? - Is every new name checked against the people who have opted out, and do I get that list if we stop working together? - Where did the addresses come from? Plain answers to all five are what you’re looking for. With Defrost, you approve every email before it goes. [Here is what we do](https://defrostmail.com/how-it-works). ## Questions people ask ### Do I need consent to email a business in the United States? Not under the CAN-SPAM Act. The Act doesn’t require prior consent for a commercial email to a business. It requires an honest sender and subject line, a postal address, a way to opt out, and that you stop when asked. Other countries have stricter rules, and some US states have their own privacy laws. ### Is it legal to email a list I bought? In the United States, the CAN-SPAM Act doesn’t make it illegal to email a bought list of business contacts. You remain responsible for every email sent in your name and for honoring every opt-out, whoever sold you the list. ### What is the penalty for breaking the CAN-SPAM Act? Each separate email in violation can bring a penalty of up to $53,088, as stated in the FTC guide when read on November 9, 2026. Hiring someone else to send the email doesn’t remove your responsibility. ### Is this page legal advice? No. It is general information about United States federal law, taken from the Federal Trade Commission’s compliance guide. For your own situation, ask a lawyer. ## Sources - [Federal Trade Commission, CAN-SPAM Act: A Compliance Guide for Business](https://www.ftc.gov/business-guidance/resources/can-spam-act-compliance-guide-business), read November 9, 2026. ## Short on time for this? Tell us what you do. It takes about three minutes and no card. If you’re a fit, we’ll tell you where we’d start. [Apply to Defrost](https://defrostmail.com/apply)