CAN-SPAM Act Requirements for Cold Email

This page explains what the CAN-SPAM Act requires of a cold email sender. It's based on the US Federal Trade Commission's CAN-SPAM Act Compliance Guide for Business (edited January 2024, read October 2026) and the rule text in 16 CFR Part 316 in the eCFR. It explains the rules and isn't legal advice. Whether your outreach meets them depends on what you write and how you run your list, and no tool decides that for you.

What does the CAN-SPAM Act require?

The FTC's compliance guide sets out seven main requirements for commercial email. They apply to every message you send, not to the campaign as a whole. So an email that's missing its opt-out notice is a problem even if every other email in the sequence has one. The table lists each requirement and what it means in practice for a cold sender.

Requirement (FTC CAN-SPAM guide)	What it means for a cold email
No false or misleading header information	From, To, Reply-To and routing information must be accurate and identify the person or business that sent the message.
No deceptive subject lines	The subject line has to reflect what the email actually contains. A fake "Re:" on a first touch implies a conversation that never happened.
Identify the message as an ad	A commercial message has to be identifiable as advertising. The guide doesn't prescribe a fixed wording.
Include a valid physical postal address	Your current street address, a post office box, or a private mailbox registered under postal regulations.
Tell recipients how to opt out	A clear and conspicuous explanation of how to stop future marketing email from you.
Honour opt-outs within 10 business days	Once someone opts out, they get no further marketing email from you after that window.
Monitor what others do on your behalf	If someone else sends for you, you're still legally responsible.

CAN-SPAM Act email requirements for headers and subject lines

Two of the CAN-SPAM Act email requirements cover what a recipient sees before opening the message: the header and the subject line. The header rule covers the From name, the From address, Reply-To and the routing information, meaning the domain and servers the message passed through. All of it has to identify who actually sent the email. Sending under a made-up persona, or from a domain that hides your company, conflicts with this rule.

CAN-SPAM doesn't require SPF, DKIM or DMARC. They're technical standards, not legal requirements. At the server level, though, they serve the same purpose: they let a receiving server check that a message signed for your domain came from a server you authorised. If your From domain, your DKIM signature and your DMARC policy all line up, the routing information matches who you say you are. Our guide to DKIM, DMARC and SPF for cold email senders covers the records you need to publish.

For subject lines, the test is whether the subject misleads about the content. "Quick question about your Q3 hiring" over a pitch for recruiting software is defensible. "Re:" or "Your invoice" over a sales pitch isn't. The cold email subject line examples we've collected follow that rule.

CAN-SPAM Act requirements for emails to business recipients

Many B2B senders assume the law only covers consumer newsletters. The FTC's guide says it makes no exception for business-to-business email. A cold message to a purchasing manager's work address needs the same things as a retail promotion: accurate headers, an honest subject line, identification as an ad, a postal address and an opt-out.

Every email in a cold sequence is judged on its own. That has three practical consequences:

• Follow-ups need the opt-out explanation and postal address too, not just the first touch. A follow-up threaded with In-Reply-To headers is still a commercial message.
• Personalisation doesn't make a message non-commercial. A one-to-one email written for a single recipient is still commercial if its purpose is to promote your product.
• The FTC's guide says subscribers and members can opt out too. Having an existing relationship with the recipient doesn't remove the opt-out obligation.

How fast must you honour an opt-out request?

The FTC's guide gives you 10 business days from the opt-out request. After that, the person must not receive any more marketing email from you. The guide also requires the opt-out explanation to be clear and conspicuous, so the recipient can find it without searching. A link buried in grey text below the signature, or an instruction that only appears in the first email of a sequence, makes that harder to argue.

In cold outreach, opt-outs usually fail because the list lives in more than one place. Someone replies "remove me" to your first email, but a follow-up queued in another system goes out anyway. Before you start a sequence, pick one master list and suppress the address there, so every scheduled step skips it. Opt-outs also affect deliverability. Recipients who can't find a way out often hit the spam button instead, and complaints are one of the signals receiving servers weigh. Our article on why emails go to spam covers that side of it.

Who is liable when someone else sends your email?

The FTC's guide says that if you hire someone to handle your email marketing, you can't contract away your legal responsibility. Both the company whose product the message promotes and the company that actually sends it can be held liable. For a B2B team, that includes a freelancer running your sequences, a contractor building lists, or a platform that sends from its own address on your behalf.

You can't just trust whatever goes out under your name. Check the From line, the subject lines, the footer with your postal address and the opt-out handling yourself. You also need to see which domain the mail is sent from. If you can't tell whose domain signs the message, you can't check the header requirement. Your DMARC aggregate reports list the servers sending mail as your domain, and reading a DMARC report lets you spot a sender you didn't authorise.

Where CAN-SPAM stops: recipients in Germany and the EU

CAN-SPAM is a US opt-out law. None of its requirements, as the FTC lists them, is prior consent: you can send the first message as long as you follow the rules and honour opt-outs. That model doesn't carry over to other countries. For recipients in Germany, § 7 (2) no. 2 of the Act against Unfair Competition (UWG) treats advertising by email without the addressee's prior express consent as an unreasonable nuisance. § 7 (3) UWG has a narrow exception for existing customers, which doesn't cover first contact with a prospect.

So don't send cold email to recipients in Germany, even if the message meets every CAN-SPAM requirement. Sort your prospect list by recipient country before you plan a sequence, and check the rules for each country you target. Don't apply the US rules everywhere.

How EmailFlow OS sends, and what stays your job

EmailFlow OS sends personalised video email for B2B cold outreach. You record one video, upload it to EmailFlow OS, connect your own Brevo account and sending domain, and import your prospect list. EmailFlow OS then makes a personalised version of that recording for each recipient, not just each company, and sends every version from your own inbox, through your Brevo account and your sending domain. Nothing goes out from a shared platform sender address.

For CAN-SPAM, what matters is that the header information points to your domain and your Brevo account. You control both and can check them in your own DNS and DMARC reports. The rest depends on how you use the product: an honest subject line, identification as an ad, your postal address, a clear opt-out explanation in every message, and removing anyone who opts out within 10 business days, including from the list you imported into EmailFlow OS. Using EmailFlow OS doesn't make your outreach compliant with CAN-SPAM or any other law. It means the sending path is yours to check.

Questions people ask

? Does the CAN-SPAM Act require consent before sending a cold email?

No. None of the requirements in the FTC's CAN-SPAM guide is prior consent. It's an opt-out model: you can send a first commercial email if it has accurate headers, an honest subject line, identification as an ad, a postal address and an opt-out notice. Germany works the other way: § 7 (2) no. 2 UWG requires prior express consent.

? Does CAN-SPAM apply to B2B email?

Yes. The FTC's compliance guide says the law makes no exception for business-to-business email. A cold email to someone's work address needs the same things as a consumer promotion: truthful header information, a non-deceptive subject line, ad identification, a valid physical postal address and an opt-out you honour within 10 business days.

? Can I use a PO box as the postal address in a cold email?

Yes, according to the FTC's guide. A valid physical postal address can be your current street address, a post office box registered with the US Postal Service, or a private mailbox registered with a commercial mail receiving agency under postal regulations. A made-up or outdated address doesn't count, because recipients have to be able to reach you.

? Do SPF, DKIM and DMARC count as CAN-SPAM requirements?

No. Neither 16 CFR Part 316 nor the FTC's guide mentions these DNS standards. CAN-SPAM requires header and routing information that isn't false or misleading. SPF, DKIM and DMARC are separate technical standards that let receiving servers check that mail for your domain came from servers you authorised, so they serve the same goal at the server level.