Is cold email legal in the US? B2B rules for 2026

Yes. The CAN-SPAM Act does not require consent for commercial email, to businesses or anyone else; it requires that every message is honest about who sent it, is identified as an ad, includes a valid physical postal address and offers an opt-out that you honour within 10 business days. The FTC says "The law makes no exception for business-to-business email", so the same rules cover info@ addresses, named employees and sole proprietors. For LinkedIn messages there is no formal FTC guidance, but an FTC blog post and some federal district courts treat commercial messages on social networks as electronic mail messages.

Checked on 15 October 2026 against the law text and the regulator's guidance. This is not legal advice.

That is the opposite of Germany, where advertising email needs prior consent even in B2B. Many countries are stricter, and their rules can reach email you send from the US: see cold email laws by country.

The US at a glance

What CAN-SPAM says

The CAN-SPAM Act of 2003 (15 U.S.C. 7701 to 7713) and the FTC's rule in 16 CFR Part 316 cover any email whose "primary purpose" is commercial advertising or promotion. The core is section 7704(a)(5)(A):

"It is unlawful for any person to initiate the transmission of any commercial electronic mail message to a protected computer unless the message provides" ... "(i) clear and conspicuous identification that the message is an advertisement or solicitation; (ii) clear and conspicuous notice of the opportunity under paragraph (3) to decline to receive further commercial electronic mail messages from the sender; and (iii) a valid physical postal address of the sender."

After an opt-out request, sending more is unlawful "more than 10 business days after the receipt of such request" (7704(a)(4)(A)(i)), and you may not charge a fee or ask for "any information other than the recipient's electronic mail address and opt-out preferences" to process it (16 CFR 316.5). CAN-SPAM overrides state laws on commercial email, "except to the extent that any such statute, regulation, or rule prohibits falsity or deception" (7707(b)(1)). Sources: 15 U.S.C. 7702, 7704, 7707, 16 CFR Part 316.

What the FTC says

The FTC's compliance guide also rules out "false or misleading header information" and "deceptive subject lines". On timing:

"Any opt-out mechanism you offer must be able to process opt-out requests for at least 30 days after you send your message. You must honor a recipient’s opt-out request within 10 business days."

On B2B: "The law makes no exception for business-to-business email." Source: FTC compliance guide (archived copy, 11 October 2026; key sentences checked against the live page on 15 October 2026).

Named employees, sole proprietors and scraped lists

CAN-SPAM regulates the message, not the recipient: an "electronic mail message" is "a message sent to a unique electronic mail address" (7702(6)). Nothing in the law treats a company inbox, an employee's work address or a sole proprietor differently, and we found no FTC text that does (our reading).

Scraping matters in one way: sending unlawful commercial email to addresses harvested from a website that promised not to share them, or generated "by combining names, letters, or numbers into numerous permutations", is an aggravated violation (7704(b)(1)). By our reading, that raises the penalty for an email that already breaks 7704(a), but does not make a compliant email unlawful.

LinkedIn and social media messages

There is no formal FTC guidance. Answering a reader who asked about "social media platforms like Facebook, LinkedIn, etc.", an FTC business blog post said:

"some federal courts have ruled that CAN-SPAM’s definition of “electronic mail message” includes commercial messages transmitted to a social network user’s inbox, news feed, wall, etc. So if you’re thinking of marketing on social media, keep that in mind."

(FTC blog, 18 August 2015). The rulings we found are California district court decisions from 2007 and 2011; the latest, Facebook v. MaxBounty, was only at the pleading stage. We found none on LinkedIn, though our search was cut short. In practice, write LinkedIn messages as if CAN-SPAM applies.

Privacy law

The US has no general federal data protection law like the GDPR. That is our assessment; the nearest official source we could read, a 2022 Congressional Research Service brief, says federal protections "are not comprehensive in nature and primarily regulate certain industries and subcategories of data" (CRS IF11207, mirror). State laws such as California's CCPA are not covered here.

Enforcement and real cases

The FTC enforces CAN-SPAM; state attorneys general and internet access providers can also sue (section 7706), but recipients cannot (our reading). The FTC's guide: "Each separate email in violation of the law is subject to penalties of up to $53,088, and more than one person may be held responsible for violations." The amount is the FTC's adjustment of 17 January 2025 (16 CFR 1.98); we found no 2026 adjustment, and it is adjusted yearly.

The B2B case is Verkada, which "sold security cameras and other surveillance products to businesses". In 2024 it agreed to a $2.95 million penalty, which the FTC then called "the largest penalty obtained by the FTC for a CAN-SPAM violation". The FTC said Verkada "inundated prospective customers with commercial emails", more than 22 million in 2021 alone, while "failing to include the option to unsubscribe or opt-out, honor opt-out requests, and provide a physical postal address in the emails" (FTC, 30 August 2024; complaint). The sources do not say every recipient was a business address.

Checklist for B2B email to the US

1. Use accurate header information and an honest subject line.
2. Identify the message as an ad (unless the recipient gave prior affirmative consent) and include a valid physical postal address.
3. Offer a clear opt-out that works for 30 days after sending, and honour it within 10 business days, with no fee and no extra questions.
4. Keep a suppression list, and check anyone who sends for you.
5. Do not use harvested or generated addresses.
6. Hold LinkedIn messages to the same standard.

How Leo handles the US

Leo, the buying-signal agent Revexa builds, blocks only Germany automatically. For leads in the US you read and approve every draft in review mode, so you decide whether each message meets CAN-SPAM before it is sent. Leo writes to each lead in the lead's own language when your website exists in that language, and in English otherwise.

Common questions

Is B2B cold email legal in the US?

Yes. CAN-SPAM requires no consent, and the FTC says it makes no exception for business-to-business email. Each commercial email needs accurate header information, a non-deceptive subject line, identification as an ad, a valid physical postal address and a working opt-out honoured within 10 business days.

How fast must I honour an unsubscribe under CAN-SPAM?

Within 10 business days. Your opt-out mechanism must work for at least 30 days after you send, and you may not charge a fee or ask for more than the email address and opt-out preferences.

What is the penalty for violating CAN-SPAM?

Up to $53,088 per email (the FTC's January 2025 adjustment), and more than one company can be liable. In 2024 Verkada, a seller of security cameras to businesses, agreed to a $2.95 million penalty, which the FTC called its largest for CAN-SPAM.

Does CAN-SPAM apply to LinkedIn messages?

Possibly. There is no formal FTC guidance, but a 2015 FTC blog post notes that some federal courts have treated commercial messages to a social network user's inbox as electronic mail messages. We found no ruling on LinkedIn itself.