Rules and safety
Is cold emailing legal for a small business?
In the United States, cold emailing other businesses is legal as long as you follow the CAN-SPAM Act: no misleading headers or subject lines, a clear way to opt out that you honor promptly, and a real physical mailing address in the email. Canada and the European Union are stricter and often require consent, so where your recipients are located matters more than where you are. This is general information, not legal advice.
Walk away with a custom outbound plan, whether or not we work together.
The honest answer
The short version is that cold email is not illegal, despite how often people assume it is. In the US, the law that governs it is CAN-SPAM, and it is more permissive than most owners expect. It does not require permission before you email someone. What it requires is honesty and an easy exit.
Concretely, that means your from-line and subject cannot be deceptive, you have to include a genuine physical mailing address, and you must give recipients a clear way to unsubscribe and then actually stop emailing them when they do. Follow those and B2B outreach in the US sits on solid ground. Ignore them and you are exposed to real penalties per email, which add up fast.
Outside the US the picture changes, and this is where owners get caught out. Canada's CASL and the European Union's GDPR are consent-based and considerably stricter, and they care about where your recipient sits, not where your company is registered. If you email people in those regions, their rules apply to you, and the safe assumption is that you need a lawful basis to contact them.
There is also a practical layer beyond the law. Even a perfectly legal email that annoys people generates spam complaints, and complaints wreck your deliverability. So the compliant way to send and the effective way to send point in the same direction: reach people who have a real reason to hear from you, make it easy to opt out, and never pretend to be something you are not.
What to actually do
Tell the truth in headers and subject
Your from name, reply address, and subject line must accurately reflect who you are and what the email is about.
Include a real mailing address
CAN-SPAM requires a valid physical postal address in the message. A PO box or registered agent address is fine.
Offer a clear opt-out and honor it
Give every recipient an obvious way to unsubscribe and stop sending to them promptly once they do.
Know where your recipients are
Emailing contacts in Canada or the EU pulls you under stricter, consent-based rules regardless of where you operate.
Why this is hard to do on your own
The rules themselves are not complicated, but staying compliant at any real volume is a process, not a one-time read. You have to honor opt-outs quickly and reliably, keep suppression lists so you never re-contact someone who left, and adjust your approach when you send into stricter regions. Miss any of that at scale and the exposure grows with every send.
None of it is beyond a careful small business. It just becomes one more system to run correctly, forever, on top of everything else you are already doing.
How Sendful helps
Sendful builds compliance into how campaigns run: honest sender details, required address information, and opt-outs that are honored and suppressed automatically so nobody is ever contacted again by mistake. We also help you target so you are reaching people with a real reason to hear from you, which keeps complaints low and your sending clean.
The math
An outbound team, without the overhead.
Building this in-house means a hire, a stack of tools, and months of setup. We run the whole thing for you from a fraction of the cost.
See full pricingBuild in-house
$8,000+/mo
plus months to set up
Done for you
from$2,200/mo
billed monthly or yearly
Do I need permission before I cold email a business in the US?
No. CAN-SPAM does not require prior consent for commercial email. It requires that you be honest about who you are, include a physical address, and provide a working opt-out that you honor. Consent-based rules like GDPR and CASL are a different story and apply when you email recipients in those regions.
Is cold email against Gmail or Outlook rules?
Mailbox providers do not ban cold email outright, but they aggressively filter mail that generates complaints or looks like spam. So while the platforms will not sue you, they will quietly bury you if your sending is careless. Compliant, well-targeted sending is what keeps you in good standing with them.
What happens if I do not follow CAN-SPAM?
Violations can carry significant penalties assessed per email, so at volume the exposure is not trivial. Beyond the legal risk, ignoring the rules tends to drive complaints, which damages your deliverability. The compliant path and the effective path are the same path.
Is this legal advice?
No. This is general information to help you understand the landscape. Laws vary by jurisdiction and change over time, so if you have specific concerns about your situation, particularly around international recipients, it is worth speaking with a qualified attorney.
More answers
Should I use my main business domain for cold email?
No. Sending cold email from your primary domain risks your real business email landing in spam. Use dedicated sending domains instead. Here is why.
Can cold emailing get my business domain blacklisted?
Yes, careless cold email can blacklist your domain and hurt your normal business email. Here is how it happens and how to run outreach safely.
How do I find email addresses for the businesses I want to reach?
You find business emails with data tools and verification, not cheap bulk lists. Here is how to build a clean, accurate list without wrecking deliverability.
Should I do cold email myself or hire someone to run it?
Do it yourself if you have the time to learn deliverability, data, and copy. Hire it out if you would rather buy the result. Here is an honest way to decide.
Terms worth knowing
CAN-SPAM Act
The CAN-SPAM Act is the United States federal law that sets the rules for commercial email. It does not require prior consent to send, but it requires truthful headers, a non-deceptive subject line, a valid physical postal address, and a working way to opt out that is honored within 10 business days.
GDPR and cold email
GDPR does not ban B2B cold email, but it regulates the personal data behind it, including a prospect's name and work email address. Most B2B senders rely on legitimate interest as their lawful basis, which requires a documented balancing test, clear disclosures, and an easy way to object.
Unsubscribe compliance
Unsubscribe compliance means giving every recipient of commercial email a clear way to opt out and honoring the request within the required window. In the US, CAN-SPAM allows at most 10 business days, and Google and Yahoo's bulk sender guidance requires one-click unsubscribe honored within two days.
Spam complaint rate
Spam complaint rate is the percentage of delivered emails that recipients mark as spam or junk. Google and Yahoo's published bulk sender guidance asks senders to keep spam rates below 0.3 percent, and mailbox providers treat the metric as a core reputation signal.
Book a call
Stop fighting this yourself. We run it for you.
Book a call and leave with a custom outbound plan, your ICP, opening sequences, and a deliverability check, whether or not we work together.