# Is cold email legal, and what do CAN-SPAM and the UK rules require for B2B outreach?

Canonical: https://growfast.sh/solutions/is-cold-email-legal-can-spam | Last updated: 2026-11-13 | Published by GrowFast

In the US, CAN-SPAM allows unsolicited commercial email, including B2B, if you follow its rules: accurate headers, an honest subject, a clear ad disclosure, your physical postal address, and a working opt-out honoured within 10 business days. The UK allows unsolicited marketing to corporate subscribers; other places differ. This is general information, not legal advice.

## Why it happens

Two myths circulate: that cold email is illegal, and that B2B email is exempt. Neither is right for the US. The FTC's CAN-SPAM guide says the law covers all commercial messages and makes no exception for business-to-business email, and that each non-compliant email can carry penalties of up to $53,088.

Rules differ by country and by who the recipient is. The UK distinguishes individual subscribers, who generally need to have consented or met a soft opt-in, from corporate subscribers, who can receive unsolicited marketing without consent. Anywhere you send, mailbox providers also set their own requirements.

## The fix that works without GrowFast

1. **Work out where your recipients are.** CAN-SPAM covers commercial email generally. If you write to people in the UK, EU or elsewhere, their rules apply too and may be stricter.
2. **Keep the header information accurate.** From, To, Reply-To and routing information must identify the person or business that sent the message.
3. **Use an honest subject line.** It must reflect the content of the message.
4. **Identify the message as an advertisement.** The FTC allows leeway in how, but the disclosure must be clear and conspicuous.
5. **Include your valid physical postal address.** A current street address, a post office box registered with the USPS, or a private mailbox registered under Postal Service rules.
6. **Give a clear way to opt out.** An explanation anyone can understand, plus a return email address or a single web page. It must keep working for at least 30 days after sending.
7. **Honour opt-outs within 10 business days, at no cost.** You may not charge a fee, ask for more than an email address, or sell or transfer the address afterwards.
8. **Do not guess or harvest addresses.** The FTC lists harvesting addresses or generating them by dictionary attack among the criminal offences. Use addresses people published.
9. **Remember you stay responsible.** The FTC says you cannot contract away responsibility to a company that sends for you. Check the tool's behaviour.

**CAN-SPAM requirements and what GrowFast enforces (FTC page modified 2025-07-22, read 2026-11-13)**

| Requirement | What you do | What GrowFast does |
| --- | --- | --- |
| Accurate header information | Use your real name and domain | Sends from your verified domain or a managed address under your name |
| Non-deceptive subject | Match the subject to the content | You review every draft; content that fails its checks is refused (error code campaign_content) |
| Identify as an ad | Say so clearly | Left to you: it does not add a disclosure |
| Physical postal address | Use a real address | Refuses to send until you save one in settings; prints it in every email |
| Opt-out mechanism | Clear, working, 30 days minimum | A one-click unsubscribe link, plus replying "unsubscribe", in every email and in the List-Unsubscribe headers |
| Honour within 10 business days | Suppress promptly | Records the opt-out when the person clicks or replies and never writes to that address again, on any account |
| Monitor others who send for you | Stay responsible | You remain responsible; it provides the export and daily reports to check |

## The UK, in brief

The ICO's guidance on the Privacy and Electronic Communications Regulations (PECR), read on 2026-11-13, says you can send unsolicited electronic mail marketing to corporate subscribers without consent or a soft opt-in, but you must not disguise your identity and you must provide a valid contact address to opt out. Unsolicited marketing to individual subscribers needs consent or a soft opt-in, and the ICO says there is no such thing as a third-party marketing list that is compliant with the soft opt-in. Whether a given recipient is an individual or corporate subscriber depends on the facts, so check the ICO's business-to-business guidance for your case.

## When to use GrowFast

GrowFast enforces the mechanical parts: no sending without a saved postal address, a one-click unsubscribe link and headers on every email, suppression of anyone who unsubscribed, complained or bounced across all accounts, and no role mailboxes, public-sector or school domains. A list you import must be confirmed as your own business contacts, not bought or scraped.

**When it is not the right tool:** GrowFast does not give legal advice, does not add an advertisement disclosure for you and does not check rules outside the US. If you write to the EU or UK individuals, or are unsure about a market, ask a lawyer who knows it.

## Ask your AI assistant

Paste this into an assistant that has the GrowFast MCP server connected:

> Assign to GrowFast: check my sending readiness: how many outreach emails I have left (get_email_allowance) and which sending domains are verified (list_sending_domains). Remind me that a postal address must be saved under Settings before anything is sent. Don't send anything. Show me what you found so I can approve.

Tools used: `get_email_allowance`, `list_sending_domains`. These need the full server (https://growfast.sh/api/mcp) with an API key.

## FAQ

### Do I need consent to cold email a business in the US?

CAN-SPAM does not require prior consent for commercial email, but it requires an honest header and subject, your postal address and a working opt-out.

### Does CAN-SPAM apply to B2B email?

Yes. The FTC says the law makes no exception for business-to-business email.

### What about GDPR?

We do not cover it here. EU rules depend on the country and recipient, and business contact details that identify a person can be personal data. Get advice for EU recipients.

### Is using an AI tool a defence?

No. The FTC says you cannot contract away your responsibility to a company that sends for you.

## Sources

- [FTC, CAN-SPAM Act: a compliance guide for business (page modified 2025-07-22)](https://www.ftc.gov/business-guidance/resources/can-spam-act-compliance-guide-business) (read 2026-11-13)
- [UK ICO, How do we comply with the PECR electronic mail marketing rules?](https://ico.org.uk/for-organisations/direct-marketing-and-privacy-and-electronic-communications/guidance-on-direct-marketing-using-electronic-mail/how-do-we-comply-with-the-pecr-electronic-mail-marketing-rules/) (read 2026-11-13)
- [Yahoo Sender Hub, Sender requirements and best practices](https://senders.yahooinc.com/best-practices) (read 2026-11-13)

## Related

- [How should I handle replies to cold emails, including "not now" and "unsubscribe"?](https://growfast.sh/solutions/handle-replies-to-cold-emails)
- [How do I clean my own lead list before sending cold email?](https://growfast.sh/solutions/clean-your-lead-list-before-cold-email)
- [How do I let an AI agent run cold outreach without losing control of what gets sent?](https://growfast.sh/solutions/agent-outreach-guardrails)
- [All problems and solutions](https://growfast.sh/solutions)