Cold outreach that follows CAN-SPAM
What the U.S. CAN-SPAM Act and the FTC compliance guide say about commercial email, quoted from the sources, with questions to bring to counsel.
Cold outreach means writing to someone who has not asked to hear from you. For a first product it is often the most direct way to start a conversation, and it is also the channel with the clearest written rules. In the United States, the CAN-SPAM Act sets them for commercial email, and the Federal Trade Commission publishes a plain-language compliance guide. This article walks through what those two primary sources say, quoting them, and ends with questions to take to a lawyer. It describes the law and does not tell you what to do about your own messages.
General information, not legal or financial advice, current as of 2026-10-10. Laws and agency guidance change, and this article covers one country’s email law.
What the law is and who enforces it
CAN-SPAM is a U.S. federal statute. The FTC guide describes what it covers, and several of its operative rules sit in 15 U.S.C. 7704, which is the statute text quoted below. The Cornell Legal Information Institute publishes that section online, and it is a better place to start than a summary written by someone else.
Two points from the guide matter before anything else. The first is about who is covered. It says: “The law makes no exception for business-to-business email.” A message is not exempt because it goes to a company’s founder or buyer instead of a consumer.
The second is about which messages are covered. The guide describes the law as applying to commercial messages, defined as “any electronic mail message the primary purpose of which is the commercial advertisement or promotion”, and the definition continues in the guide. Whether a particular message has a commercial primary purpose can be a judgment call, for example when an interview request also mentions your product. That is a question for counsel, not for a blog post.
The requirements, in the agency’s words
The FTC guide lists the main requirements as headings. The table pairs each one with the short quoted passage that states it. The headings are quoted from the guide, and the passages from the guide or from the statute as noted.
| Requirement in the guide | What the source says |
|---|---|
| Header information | “Don’t use false or misleading header information.” The statute, 15 U.S.C. 7704(a)(1), refers to “header information that is materially false or materially misleading”. |
| Subject lines | “Don’t use deceptive subject lines.” The statute, 7704(a)(2), refers to a subject heading that “would be likely to mislead a recipient”. |
| Identify the message as an ad | “Identify the message as an ad.” The statute, 7704(a)(5)(A), calls for “clear and conspicuous identification that the message is an advertisement or solicitation”. |
| Your location | “Your message must include your valid physical postal address.” The statute asks for “a valid physical postal address of the sender”. |
| Opt-out notice | “Tell recipients how to opt out of receiving future marketing email from you.” The statute asks for “clear and conspicuous notice” of the opportunity to decline further messages. |
| Honor opt-outs promptly | “You must honor a recipient’s opt-out request within 10 business days.” |
| Monitor others | “Monitor what others are doing on your behalf.” |
Two details in the opt-out rules are worth reading in full. The guide says: “Any opt-out mechanism you offer must be able to process opt-out requests for at least 30 days after you send your message.” The statute, 7704(a)(3)(A), speaks of a “functioning return electronic mail address or other Internet-based mechanism”. Whether a given setup meets that wording is a question for counsel.
After someone opts out, the guide adds that “you can’t sell or transfer their email addresses, even in the form of a mailing list.” Anyone who builds a list from several sources, or who passes names to a partner, will want counsel’s view on how that sentence applies.
Lists, tools and other people’s hands
Most cold outreach for a first product runs through a tool and sometimes through a contractor. The guide speaks to both directly. Under its last heading it says: “even if you hire another company to handle your email marketing, you can’t contract away your legal responsibility”. The practical reading is that an agency or a software vendor does not take the legal weight of your messages off you, which is a reason to ask counsel what a contract should say.
On lists, the statute separately treats addresses collected in certain ways as an aggravating factor. Section 7704(b)(1)(A)(ii) refers to addresses “obtained using an automated means that generates possible electronic mail addresses”. Guessing addresses by pattern is the kind of practice that text describes, so a list built by hand from named people is a different situation from one produced by a generator.
The earlier article on choosing your first channels notes a further point from the guide: when a seller pays or gives a benefit for traffic or referrals, “the seller is likely to have compliance obligations under the CAN-SPAM Act.” A referral program that rewards forwarding, which is a common growth idea, therefore needs the same review as direct sending.
What it can cost
The guide states the penalty exposure: “Each separate email in violation of the CAN-SPAM Act is subject to penalties of up to $53,088”. That is the figure the agency printed on the day this article was prepared, per message. A per-message penalty adds up as a list grows, which is why the rules are worth reading before the first send and not after the hundredth. Because dollar amounts in guidance can be updated, check the current figure with the FTC or with counsel and do not rely on the number here.
A pre-send checklist built from the guide
The checklist below is this publication’s own arrangement of the points above. It is not an official form, and passing it does not mean a message is lawful.
- Does the sender name and address in the header identify who is actually sending?
- Does the subject line describe what is in the message?
- Is the message identifiable as an advertisement or solicitation?
- Is a valid postal address in the message?
- Is there a working way to opt out, and does it keep working after the message is sent?
- Is there a record of who opted out, and does every tool and contractor use it?
- Who is sending on your behalf, and what does the contract say about the rules?
- Where did each address come from?
Keeping a written record of the answers gives counsel something to review. For the content of the messages themselves, the first ten customers sequence shows how to write a specific, personal note. When a reply leads to a call, the sales call structure article picks up from there.
Outside the United States
CAN-SPAM is one country’s law. Two other primary sources show how different the starting point can be.
In the European Union, the ePrivacy Directive, Directive 2002/58/EC, deals with unsolicited communications in Article 13. Article 13(1) says that direct marketing by electronic mail, among other means, “may only be allowed in respect of subscribers who have given their prior consent.” The directive is an EU-level text, and counsel can say how each country’s law applies it, including to business addresses.
In Canada, the Government of Canada’s page on the anti-spam legislation uses the words “requesting amongst other things, that businesses obtain consent before sending commercial electronic messages.”
The quoted wording points to a consent-first approach, which is a different structure from the opt-out rules quoted from the U.S. statute. If your list includes people in the EU, the UK, Canada or anywhere else, ask counsel for each place, and do not assume that a message that follows CAN-SPAM follows their rules. The glossary defines terms such as ICP and CAC if the shorthand in sales writing is new to you.
Questions to take to counsel
- Does my planned message have a commercial primary purpose under the statute?
- What do I need to hold on file about each address and about opt-outs?
- Which countries’ rules apply to the people on my list?
- What should my contracts with an email tool or an agency say about compliance?
- How should a partner or referral arrangement be structured so that responsibility is clear?
What this article cannot tell you
This article cannot tell you whether a specific message, list or program is lawful. It quotes a statute section and an agency guide as read on 2026-10-10, and quotations are selections, not the whole law. It does not cover state laws, telemarketing, text messages, calls, privacy law, data protection, platform rules for social messaging, or how any regulator will apply the rules to your facts. It is general information, not legal or financial advice. A qualified lawyer who knows the countries where your recipients live can answer the questions above, and anything that affects how you collect and store contact details deserves that review before the first send.
In the data
These figures describe U.S. businesses in general, not WE’s results. Each one names its source.
Show the data as a table
| Firm size | Share of employer firms, 2023 |
|---|---|
| 1 to 4 employees | 59.7% |
| 5 to 9 employees | 17.3% |
| 10 to 19 employees | 11.1% |
| 20 to 99 employees | 9.7% |
| 100 to 499 employees | 1.7% |
| 500 or more employees | 0.4% |
Employer firms only: businesses with no employees are not in these data. Firm size is the average of the current and prior year.
Source: U.S. Census Bureau, Business Dynamics Statistics, firm size , 2023
Retrieved 2026-10-16. Shares are published firm counts divided by the sum of the size classes in the firm-size file; the five largest classes are added together.
Sources
- CAN-SPAM Act: A Compliance Guide for Business, U.S. Federal Trade Commission . Accessed October 10, 2026.
- 15 U.S. Code 7704, Legal Information Institute, Cornell Law School . Accessed October 10, 2026.
- Directive 2002/58/EC on privacy and electronic communications, EUR-Lex, Publications Office of the European Union . Accessed October 10, 2026.
- Canada's anti-spam legislation, Innovation, Science and Economic Development Canada . Accessed October 10, 2026.
Spotted an error? Read how we handle corrections in our editorial policy.