CAN-SPAM Act Requirements for Cold Email: A Line-by-Line US Guide
CAN-SPAM Act requirements for cold email are seven federal rules for US commercial email: accurate headers, honest subject lines, ad identification, a postal address, a working opt-out, prompt opt-out handling and oversight of anyone sending for you. Mailbox filters are tightening around the same behavior. Kaspersky found that 44.99% of global email in 2025 was spam (Kaspersky Securelist, 2026). If your SDRs email US prospects daily, one missed line can become a legal and deliverability problem. This guide walks through each element of a compliant message, the opt-out clock, the 2026 penalty level and who is liable. For the first-touch format question, see our guide to video outreach in cold email.
Key Takeaways
The CAN-SPAM Act has no B2B exception: a cold email that mainly promotes a product or service is covered, and every follow-up counts as its own message.
A compliant cold email needs accurate header details, an honest subject line, ad identification, a valid postal address and a working opt-out.
The CAN-SPAM Act allows 10 business days to honor an opt-out, but Google's guidelines point to 48 hours, so internal suppression should be much faster.
The CAN-SPAM Act's per-email penalty ceiling is $53,088, and the FTC said in September 2026 that it keeps applying 2025 levels.
Hiring an agency or SDR tool does not transfer CAN-SPAM responsibility away from the advertiser.
Written by Carlos Agüero, who builds outbound and deliverability tools for B2B sales teams. This guide is general information, not legal advice.
What does the CAN-SPAM Act require in a US cold email, line by line?
A compliant US cold email under the CAN-SPAM Act needs five visible elements: accurate header details, a non-deceptive subject line, a clear ad label, a valid postal address and a working opt-out. Two duties sit outside the message: honoring opt-outs within 10 business days, and monitoring anyone who sends for you. Google adds a 48-hour unsubscribe expectation (Google, 2026).
Flat-lay of a printed email checklist, a brass stamp and an envelope on a pale desk surface
The CAN-SPAM Act is the US federal law that sets rules for commercial email, including opt-outs, accurate headers and penalties. A commercial electronic mail message is an email whose primary purpose is to advertise or promote a commercial product or service. The FTC's compliance guide lists seven requirements, and the table below ties each element of a cold email to that list.
Email element
What to do
FTC guide requirement
From, To, Reply-To, routing
Use your real sender name and a reachable address; never spoof a domain or hide who sent it
1: Don't use false or misleading header information
Subject line
Make it match what the email is about; no fake "Re:" or bait
2: Don't use deceptive subject lines
Opening or footer
State clearly that the message is an advertisement or solicitation
3: Identify the message as an ad
Footer address
Include a valid physical postal address
4: Tell recipients where you're located
Footer opt-out line
Give a clear, free way to opt out
5: Tell recipients how to opt out
After sending
Stop mailing opt-outs within 10 business days
6: Honor opt-out requests promptly
Vendors and SDRs
Monitor what others do on your behalf
7: Monitor what others are doing
An annotated example
The sample below is fictional. Each bracketed note maps to the table.
From: Dana Lee, Northwind Software dana@northwind.example [header: real sender, working Reply-To]
Subject: Question about Acme's onboarding process [subject: matches the body]
Hi Sam, we help support teams cut onboarding time. This is a sales message from Northwind Software. [ad identification]
Worth a 15-minute call?
Northwind Software, 100 Example Street, Albuquerque, NM 87101 [valid postal address]
Not relevant? Reply "no thanks" or click here and we won't email you again. [opt-out]
What counts as a valid postal address?
The FTC guide accepts a current street address, a post office box registered with the US Postal Service, or a private mailbox registered with a commercial mail receiving agency. An unregistered virtual office or a made-up address does not meet the requirement.
Which CAN-SPAM rules do SDRs break most often?
No verified public dataset ranks which CAN-SPAM rules SDR teams break most often, so this is a checklist, not a statistic. The likeliest failures are missing postal addresses, bait subject lines, opt-outs that arrive late or sit in one tool, and unmonitored senders. Google lists unsubscribe requests not honored within 48 hours as a reason delivery mitigation is unavailable (Google, 2026).
Overhead view of a small paper envelope with a blank address label beside a magnifying glass
Review these five spots in your own sequences first:
Missing or fake footer address. Short "plain text" templates often drop the footer. Fix: lock the address into every template and every follow-up step.
Bait subject lines. "Quick question" or "Re: our call" on a first touch that is really a pitch can mislead. Fix: write subjects that describe the actual offer.
No ad identification. Casual, relationship-style openers can hide that the message is a solicitation. Fix: add a plain line such as "This is a sales message."
Slow or siloed opt-outs. A rep notes "unsubscribe" in a CRM, but the sequencing tool keeps sending. Fix: one master suppression list synced across every tool.
Unmonitored senders. Agencies, freelancers and sequencing vendors send in your name. Fix: audit their sample sends and keep the records.
The primary purpose test is the FTC's way of deciding whether an email is commercial, transactional or mixed. A cold email that is a sales pitch fails any "relationship message" argument, however friendly the tone. Video-led first touches are still commercial email, so the same rules apply to personalized videos sent at scale.
Our data: SendPotion's customer case study shows GrowPronto booked 45 meetings and closed 7 accounts with Potion. The result is about outreach performance, not compliance, and it still depended on every message meeting the rules above.
Where does the FTC spell out the official CAN-SPAM requirements for business email?
The FTC spells out the official CAN-SPAM requirements in its business guide, CAN-SPAM Act: A Compliance Guide for Business, which lists seven requirements and states that the law covers B2B email. The binding text sits in the statute at 15 U.S.C. 7701 to 7713 and the FTC's CAN-SPAM Rule at 16 CFR Part 316. Penalty updates appear in the Federal Register (Federal Register, 2026).
Flat-lay of a hardbound law book, a ruler and a stack of index cards on a clean surface
The compliance guide is the plain-English source, and compliance teams should keep it on file next to the legal text. The FTC CAN-SPAM Rule is the set of regulations codified at 16 CFR Part 316 that implement the statute. Use this source map when you brief SDRs or audit a vendor:
Source
What it is
Use it for
FTC compliance guide
Plain-English business guidance with the seven requirements
Training SDRs and writing internal policy
15 U.S.C. 7701 to 7713
The statute passed by Congress
Checking the exact legal duties, including section 7704 on commercial email
16 CFR Part 316
The FTC's CAN-SPAM Rule
Definitions and rules such as the opt-out and sender provisions
Federal Register notices
Official FTC notices on penalty amounts
Confirming the current civil penalty level
How fast must you honor an unsubscribe, and what do Gmail's rules add?
The CAN-SPAM Act gives senders 10 business days to honor an opt-out, but Google's sender guidelines list unsubscribe requests not honored within 48 hours as a reason delivery mitigation is unavailable (Google, 2026). Teams should set an internal suppression deadline well inside the legal maximum.
Flat-lay of an analog desk calendar, a stopwatch and a small stack of paper forms
Why do mailbox providers add stricter rules?
Spam pressure is the reason. Kaspersky measured the share of global email classified as spam at 44.99% for full-year 2025, 49.26% in Q4, 51.8% in December and 52.87% in November (Kaspersky Securelist, 2026). The report counts scam and phishing mail as spam, not only unsolicited marketing.
Lollipop chart: Share of global email traffic classified as spam, 2025. Highest: November 2025 at 52.9%.
B2B senders are judged against targeted scams too. Kaspersky blocked over 80,000 fraudulent "brand partner" recruitment emails in December 2025 alone, aimed at the B2B sector (Kaspersky Securelist, 2026).
How do the opt-out and deliverability thresholds compare?
Rule
Threshold
Source
What it means for SDRs
Honor an opt-out
10 business days
CAN-SPAM Act
Legal maximum, not a target
Honor an unsubscribe
48 hours
Google sender guidelines (2026)
Set an internal suppression SLA inside this window
Spam rate
Above 0.3%
Google sender guidelines (2026)
Delivery support and mitigations become unavailable
A suppression list is a master record of addresses that must never be emailed again, usually because they opted out. Sync it across your sequencing tool, CRM and any agency sender. Count reply-based opt-outs ("stop", "remove me") too, and never charge a fee or ask for more than an email address to process an opt-out. Google's documentation draws one more line: "One-click unsubscribe is required only for marketing and promotional messages." (Google, 2026).
What is the CAN-SPAM penalty per email in 2026, and who is liable?
The CAN-SPAM Act's per-email civil penalty ceiling is $53,088, the 2025 level, and the FTC said in September 2026 that it will keep applying 2025 levels (Federal Register, 2026). Liability can reach both the advertiser whose product is promoted and the company that sends the message.
Flat-lay of two stapled contract pages, a pen and a pink sticky tab on a clean desk
The January 2025 inflation adjustment raised the per-email ceiling from $51,744 to $53,088, so older numbers such as $51,744 or $46,517 are stale. The September 2026 notice states: "The FTC will continue to apply the 2025 civil penalty levels." (Federal Register, 91 FR 58446, 2026). Treat $53,088 as the ceiling per violating email, not as a typical outcome. No verified public data on 2024 to 2026 enforcement counts was found, so this guide makes no claim about how often the FTC acts.
Who is liable when an agency or SDR tool sends for you?
The FTC's guidance says the law applies to both the company whose product is promoted and the company that sends the message, and hiring an outside sender does not shift responsibility. In practice, a compliance lead can:
Put CAN-SPAM duties, address use and opt-out timing into every agency or vendor contract.
Require the vendor to use your master suppression list, or sync with it daily.
Keep audit records: templates, send logs and opt-out timestamps.
Spot-check live sequences each quarter.
Ask data vendors how addresses were sourced, because the statute treats harvested addresses and dictionary attacks as aggravated violations.
Who is the CAN-SPAM Act guide on this page not for?
The CAN-SPAM Act guide on this page covers US federal law for commercial email as of October 2026, so it is not legal advice and does not cover Canada, the UK, the EU or Australia. Teams mailing prospects there should check local rules, which can be stricter. Google's 0.3% spam-rate limit is also a stricter operational ceiling (Google, 2026).
Keep these limits in mind:
Not legal advice. Have counsel review your templates, contracts and suppression process.
US federal law only. The recipient's location can bring other regimes into play, and some require consent rather than an opt-out.
Thin enforcement data. The FTC publishes few cases, so no reliable frequency of enforcement can be given.
Mailbox rules change. The Google guidance cited here is a living help page, so recheck it before you set policy.
Frequently Asked Questions
What does the CAN-SPAM Act require in a US cold email, line by line?
A US cold email must have accurate From, To and Reply-To details, a subject line that matches the content, a clear sign that the message is an advertisement, a valid physical postal address, and a working opt-out. After sending, the sender must honor opt-outs within 10 business days and monitor anyone sending on its behalf.
Where does the FTC spell out the official CAN-SPAM requirements for business email?
The FTC publishes its official guidance in CAN-SPAM Act: A Compliance Guide for Business, which lists seven requirements and applies to B2B email. The binding law is the statute at 15 U.S.C. 7701 to 7713, and the FTC's CAN-SPAM Rule is codified at 16 CFR Part 316.
Does CAN-SPAM apply to B2B cold email?
Yes. The CAN-SPAM Act applies to commercial email messages, and the FTC's compliance guide states that it makes no exception for business-to-business email. A cold email whose primary purpose is to advertise or promote a product or service is covered, even if it goes to one person at a company.
Does every follow-up email in a cold sequence need to meet CAN-SPAM?
Yes. Each commercial email in a cold sequence is a separate message under the CAN-SPAM Act, so every follow-up needs accurate header details, an honest subject line, ad identification, a postal address and a working opt-out. A prospect who opts out of step one must be removed from all later steps.
Does a cold email need an unsubscribe link, or is reply to opt out enough?
A reply-based opt-out can satisfy the CAN-SPAM Act if the reply address works and no fee or extra information is required. Google's sender guidelines separately require one-click unsubscribe for marketing and promotional messages, so adding an unsubscribe link alongside the reply option is the safer setup for Gmail recipients.
Conclusion
CAN-SPAM compliance for cold email comes down to a short list you can build into templates and tooling.
Cover all five visible elements in every message, including follow-ups: header details, subject, ad identification, postal address and opt-out.
Treat 10 business days as the legal limit and aim for suppression within 48 hours.
Remember the ceiling: $53,088 per email, with 2025 levels still applied in 2026.
Hold agencies, SDRs and tools to the same standard through contracts and audits.
Check the recipient's location before you assume US rules apply.
Your next step is to audit one live sequence against the first table and fix any gap this week. If you also use video in first touches, read our overview of video email marketing for B2B sales, then Start Free Trial to generate AI videos in your own face, voice, and gestures at scale.
Written by
Carlos Agüero
Carlos Agüero builds tools that help B2B sales teams sell smarter. As part of TargetGrid.ai, Skale.email, and Potion, he's focused on multi-channel outreach automation, inbox deliverability, and AI-powered video. Berkeley Haas COBE. Based in Santiago, Chile. Passionate about helping sales teams close more, faster, with less manual work.
Carlos AgüeroNov 11, 2026
