CAN-SPAM Compliance Requirements for B2B Cold Email

CAN-SPAM compliance for B2B cold email rests on a straightforward distinction. The law requires transparency and a reliable way to stop future messages. Those obligations apply to business recipients just as they do to consumers, and outsourcing the send does not remove them.

Why CAN-SPAM applies to every B2B cold email you send

The FTC’s compliance guide states that “The law makes no exception for business-to-business email” and “doesn't apply just to bulk email”. There is no volume floor or industry exception. A single cold email to a single prospect is covered by the same statute as a million-address blast.

The governing model is opt-out. CAN-SPAM regulates how a commercial message is sent and gives the recipient the right to make the sender stop. Under this law, every sender can send US cold outreach without prior permission but still has duties to meet. A missing postal address, a broken opt-out link, or a suppression list limited to one campaign can breach those duties even when the underlying sales approach is otherwise legitimate.

What "commercial email" means and why most cold outreach qualifies

The FTC’s guide defines a commercial message as “any electronic mail message the primary purpose of which is the commercial advertisement or promotion of a commercial product or service”. The primary purpose is the classification test. A cold sales pitch falls within it, as does prospecting that promotes content on a commercial website. The business context does not change the promotional purpose.

Mixed-use messages need the same test because they can include transactional or relationship information alongside a sales pitch. If promotion is the dominant purpose, the commercial-email requirements govern the message. Calling the email a “check-in” or a “resource share” does not settle its classification. A message intended to generate a sale, or a meeting that leads to one, does not become noncommercial merely because its language is informal.

For B2B senders, the practical assessment is what the message principally seeks to accomplish. Purely transactional messages, including order confirmations, contract updates, and account notices with no commercial ask, fall outside these commercial-message requirements. An existing relationship alone does not establish that exception. The FTC’s Experian case illustrates the distinction, with promotional messages presented as transactional or informational but treated as commercial in the enforcement action.

The seven requirements the FTC specifies, taken one at a time

The first requirement is accurate header information. The “From,” “To,” and “Reply-To” fields must accurately identify the parties, and the sender cannot use a fake identity or misleading domain. Truthfulness extends to routing data, the originating domain, and the display name visible in an inbox.

The second requirement prohibits deceptive subject lines. The subject must match what is in the email. “RE: Our conversation” is deceptive on a first contact because it suggests an exchange that did not occur. “Quick question about your pipeline” is consistent with the rule if the message actually contains that question.

The third requirement is to identify the message as an advertisement. The FTC specifies that this identification must be “clear and conspicuous,” but it prescribes no required wording or subject-line label. The format is flexible, but the obligation remains. A pitch in plain language can make clear from the context that the email is commercial, but assuming everyone will recognize a sales email does not count as disclosure. The distinction is between flexibility in presentation and permission to obscure the message’s purpose.

The fourth requirement is to include a valid physical postal address in every commercial email. A street address, a PO Box registered with USPS, or a private mailbox registered with a commercial mail receiving agency qualifies. This is a straightforward template-level obligation. Adding the address to the email signature template makes it part of the message rather than a detail each sales representative must remember separately.

The fifth requirement is a clear, functional opt-out mechanism. Every message must give recipients a way to stop future commercial email, and the FTC’s guide specifies that the mechanism must remain functional for at least 30 days after sending. It must also be simple to use. The sender cannot require a fee, a login, or personal information beyond an email address, and the process cannot demand more than a reply or a single web page.

The sixth requirement is to honor opt-out requests within the set number of business days. The FTC’s guide prohibits fees, extra information, or conditions for honoring the request. That obligation reaches across the sender’s organization. Suppressing an address in one campaign does not satisfy it if another sales representative or campaign continues sending commercial messages to the same recipient. A planned follow-up is not an exception to the obligation to stop.

The seventh requirement is to monitor those sending on the company’s behalf. The FTC’s guide states that a company cannot contract away its responsibility to comply, and both the promoter and the sender can be held liable. An agency, contractor, or platform may perform the sending work, but the company behind the promotion remains responsible for compliance. This matters especially when opt-outs must pass between the partner’s systems and the company’s own suppression list.

What the per-email penalty structure means at real outbound volume

The FTC’s guide specifies that each separate email in violation is subject to substantial penalties, with no stated aggregate cap across a campaign. A missing footer or an opt-out process that fails can lead to more than one penalty even when the flaw comes from a single template. The same defect can affect every message sent from that template.

A campaign to even a modest contact list can reach into the tens of millions in potential penalties, without requiring an unusually complex violation. Maximum exposure is not the same as a settlement. Settlements can be far below the maximum possible total, but the difference gives regulators leverage and senders still have to follow the rules.

The maximum penalty per email is based on the FTC’s inflation adjustment that took effect January 17, 2025. The 2026 annual adjustment was not applied because a government shutdown disrupted the underlying inflation data, leaving the 2025 figure in effect. Repeated failures in how emails are sent can lead to enforcement, and the cases on record show how those failures can lead to large payments.

How enforcement has actually played out: the Verkada and Experian cases

The FTC’s 2024 action against Verkada resulted in a multi-million-dollar monetary penalty under a stipulated order brought through the DOJ. The FTC described it as the highest monetary penalty ever obtained for a CAN-SPAM violation. The agency alleged that Verkada sent tens of millions of commercial emails over three years without unsubscribe links or clear opt-out notices, failed to honor opt-out requests, and left out a valid physical postal address.

Those allegations map directly to the fourth, fifth, and sixth requirements. The missing address was a flaw in what the message contained, the missing opt-out left recipients without a way to stop the emails, and the failure to honor requests came after recipients asked the company to stop. The settlement resolved the allegations at a negotiated figure well below the theoretical per-email maximum.

The FTC’s 2023 action against Experian Consumer Services concerned marketing emails presented as transactional or informational messages. The complaint alleged that the emails lacked both notice of the ability to opt out of further promotional messages and a mechanism for doing so. Classification was therefore central to the alleged failure. Treating the messages as noncommercial did not remove the opt-out obligation when their primary purpose was promotion. The stipulated settlement imposed a civil penalty and provisions prohibiting similar practices in the future.

The two cases show different routes to the same compliance problem. Verkada’s alleged failures involved the content and handling of commercial outreach, while Experian’s involved a classification that left promotional messages without required protections. Both are among the FTC’s most prominent recent CAN-SPAM actions. Their prominence signals renewed enforcement attention.

The third-party liability question when an agency or platform sends on your behalf

For a company outsourcing outbound, the practical question is what the partner’s process actually covers. The FTC’s guide makes liability possible for both the sender and the company whose product is promoted. A service agreement does not end that exposure. The hiring company therefore needs to assess the sending arrangement as part of its own compliance operation, rather than assume the agency’s involvement settles the issue.

Before engaging a third-party sender, the company should verify that the partner’s sequences include a physical address, a working opt-out mechanism, and accurate headers. It should also verify how opt-out requests feed back into its own suppression list. A partner may stop its own sequence but leave the hiring company without the information it needs to stop other commercial sends.

Tools that insert opt-out links and physical address footers, and manage suppression lists, reduce the number of requirements left to individual senders. Automation does not transfer legal responsibility, however. The sender of record still has to verify compliance, including whether the tool or partner handles these requirements in practice. Even a well-configured sending platform addresses only part of the broader legal obligations attached to outbound.

Where CAN-SPAM ends and other legal obligations begin for B2B senders

CAN-SPAM governs commercial-email practices, but it is not a complete framework for recipient data or international outreach. California contacts, Canadian prospects, and EU recipients can bring additional obligations into scope. The US opt-out model is not universally transferable. Compliance with all seven requirements therefore does not, by itself, establish that a company may collect, retain, or use every contact record in its outbound database.

The CCPA’s original exemptions for personal information collected in B2B and employment contexts expired on January 1, 2023, without an extension. California residents’ work contact information consequently falls within CCPA/CPRA rights rather than outside them merely because it is professional data. Unsubscribing and deleting data are different operations. A CAN-SPAM opt-out stops future commercial sends but may leave the contact record in place, while deletion rights cover the data itself. The California Delete Act also means purchased contact lists may bring new compliance obligations upstream to the B2B sender relying on them.

CASL defaults to opt-in for Canadian recipients, while CAN-SPAM uses an opt-out approach. A commonly used route for B2B cold outreach is implied consent based on conspicuous publication, where an address is publicly listed in a professional context and the message is relevant to the recipient’s role. The role-relevance condition distinguishes that route from a general assumption that any published business address is available for unsolicited promotion.

GDPR also applies to EU recipients because a named business email address linked to a person who can be identified is personal data when processed. A lawful basis is required before sending. Legitimate interest requires a genuine relevance test. Rules also vary by country, and Germany requires opt-in even for B2B under its unfair competition law, UWG §7, which establishes this requirement independently of GDPR itself.

Washington State’s Commercial Electronic Mail Act adds rules within the United States. It imposes a per-violation penalty for deceptive commercial email and permits private suits because CAN-SPAM does not preempt state laws addressing fraud or deception. Federal compliance is therefore not the only consideration. The practical foundation for global B2B outbound is a suppression list, a working opt-out, a physical address, and a documented targeting rationale. That stack covers the majority of requirements across the major jurisdictions, but it does not replace consent where required or the separate duties governing personal data.