Is Cold Emailing Local Businesses Legal? A CAN-SPAM Guide (2026)

Quick answer: Yes, cold emailing local businesses is legal in the United States under CAN-SPAM, provided you don't use false or misleading headers or subject lines, you clearly identify the message as an ad when applicable, you include a valid physical postal address, and you honor opt-out requests promptly. CAN-SPAM does not require prior consent to send a first B2B email. This is general information, not legal advice.

If you've ever hesitated before hitting send on a batch of cold emails to local businesses, you're not alone: "is this even legal" is one of the most common questions from freelancers and agencies doing outbound for the first time. The short answer is that cold emailing businesses is legal in the US, and CAN-SPAM is a permission-based system, not a consent-based one, which surprises a lot of people. This guide walks through exactly what the law requires, what it doesn't, and where it stops applying (outside the US).

This is general information about how CAN-SPAM works, not legal advice. If you're running outreach at real volume or you're unsure how a rule applies to your specific situation, talk to a lawyer familiar with email marketing law.

Is cold emailing businesses actually legal in the US?

Yes. The CAN-SPAM Act (Controlling the Assault of Non-Solicited Pornography And Marketing Act), enforced by the FTC, permits unsolicited commercial email as long as it follows a specific set of rules. Unlike some people assume, CAN-SPAM does not require the recipient to have opted in or given prior consent before you send a first message. It's an opt-out law: you can email a business you have no prior relationship with, but you must honor their request to stop if they make one.

This is different from what many people expect, and it's the reason cold email remains a legitimate, widely used channel for B2B and local-business outreach in 2026.

What does CAN-SPAM actually require?

The rules break down into a handful of concrete requirements:

1. No false or misleading header information

The "From," "To," and routing information in your email must accurately identify who is sending it. You can't spoof a domain or disguise the sender to make the email look like it came from someone else.

2. No deceptive subject lines

The subject line must reflect the actual content of the email. A subject line like "Re: our call yesterday" when there was no call, or "Invoice attached" for a sales pitch, is exactly the kind of deception CAN-SPAM prohibits.

3. Clear identification as an advertisement (when applicable)

If the message is a commercial advertisement, it needs to be reasonably clear that it is one. This doesn't mean stamping "ADVERTISEMENT" across a B2B outreach email, but the content shouldn't disguise its commercial intent.

4. A valid physical postal address

Every commercial email must include your valid physical postal address: this can be your current street address, a registered post office box, or a private mailbox registered with a commercial mail-receiving agency. This is one of the most commonly missed requirements in cold email tools and templates.

5. A clear, working opt-out mechanism

Recipients must be able to opt out of future emails easily. This can be as simple as a reply instruction ("reply STOP to opt out") or an unsubscribe link. You cannot require the recipient to pay a fee, provide more than a name and email address, or take steps beyond a simple opt-out request.

6. Opt-outs must be honored within 10 business days

Once someone opts out, you have up to 10 business days to stop emailing them, and you cannot sell or transfer their email address to anyone else after that request (with narrow exceptions for compliance purposes).

7. You're responsible even if someone else sends on your behalf

If you hire a third party or use a tool to send your cold email campaigns, you (and potentially the sender) can still be held responsible for CAN-SPAM violations. Using an outreach tool doesn't transfer the compliance obligation away from you.

What CAN-SPAM does NOT require

This is where a lot of confusion comes from:

• It does not require prior opt-in consent to send a first commercial email. Cold outreach itself is legal.
• It does not ban outreach to personal-sounding addresses at a business, like an owner's name @ their company domain.
• It does not set a cap on how many businesses you can email, though poor targeting and low relevance will hurt your deliverability and reply rates long before any legal issue arises.
• It is not a data-scraping law. CAN-SPAM governs the content and mechanics of the email itself (headers, subject lines, opt-outs, physical address), not how you sourced the contact information in the first place. Whether it was legal to collect a given business's public contact details is a separate question from whether your email complies with CAN-SPAM once you send it.

How does this differ from GDPR and CASL?

CAN-SPAM only governs email sent to recipients in the United States, and it's meaningfully more permissive than two other major frameworks you'll hear about:

• GDPR (EU) generally requires a stronger legal basis to email individuals in the EU, and for many kinds of marketing email, that basis is closer to opt-in consent rather than CAN-SPAM's opt-out model. If you're emailing businesses based in the EU, GDPR's stricter standard is what applies, not CAN-SPAM.
• CASL (Canada) is also generally consent-based and stricter than CAN-SPAM, with its own rules about implied versus express consent for commercial electronic messages sent to recipients in Canada.

If your prospecting is limited to US-based local businesses, CAN-SPAM is the relevant framework. The moment you're reaching outside the US, check the rules for that jurisdiction specifically. This is exactly the kind of question worth a quick check with a lawyer if you're scaling outreach internationally.

Practical compliance checklist for local-business cold email

• Sender name and domain in headers accurately identify who's emailing.
• Subject line reflects the actual content of the email.
• A valid physical postal address is included somewhere in the email or footer.
• There's a clear, simple way to opt out (a reply instruction or unsubscribe link).
• You have a process to honor opt-outs within 10 business days and stop emailing that address.
• You're not using deceptive or spoofed sender information.
• If sending to non-US recipients, you've checked whether GDPR, CASL, or another local framework applies instead.

Building this into your process is straightforward once it's a checklist rather than a fear. For the actual writing side (subject lines, opening lines, structure), see how to write cold emails that get replies, and for how to find well-qualified local prospects in the first place, see how to find local businesses without a website.

Frequently asked questions

Is it illegal to cold email businesses I've never talked to before?

No. CAN-SPAM is an opt-out law, not an opt-in law, so sending a first commercial email to a business you have no prior relationship with is legal in the US as long as the email follows CAN-SPAM's rules on headers, subject lines, a physical address, and an opt-out mechanism. This is general information, not legal advice for your specific situation.

Do I need permission before sending a cold email under CAN-SPAM?

No. Unlike GDPR in the EU or CASL in Canada, CAN-SPAM does not require prior consent before you send a first commercial email to a US recipient. You do need to honor an opt-out request once someone makes one, and stop emailing that address within 10 business days.

What has to be in every cold email to stay CAN-SPAM compliant?

A valid physical postal address, accurate (non-deceptive) header and subject line information, and a clear way for the recipient to opt out of future emails. These four elements are the core of CAN-SPAM compliance and the ones most commonly missed by people new to cold outreach.

Is scraping business contact information the same legal question as CAN-SPAM compliance?

No, they're separate questions. CAN-SPAM governs the email itself once you send it: headers, subject lines, opt-outs, and a physical address. Whether it was permissible to collect a business's publicly listed contact details in the first place is a different question, generally involving terms of service and data-privacy law rather than CAN-SPAM.

Does CAN-SPAM apply if I'm emailing businesses outside the US?

No, not directly. CAN-SPAM governs commercial email under US jurisdiction. If you're emailing businesses in the EU, GDPR's stricter, generally consent-based standard applies instead, and Canada has its own framework in CASL. If you're prospecting internationally, check the rules for each region rather than assuming CAN-SPAM covers it.