Is cold emailing illegal? CAN-SPAM, CASL and where we choose not to send

Sunny Ray · Sep 8, 2026 · 6 min read

This is not legal advice. I'm a founder who runs outbound, not a lawyer, and you should check your own situation with one. With that said, here's the plain answer: in the United States, cold emailing businesses is legal as long as you follow the CAN-SPAM Act, which sets rules for how you send rather than requiring consent first. In Canada, the anti-spam law, CASL, is much stricter and generally expects some form of consent before you send a commercial email.

That difference is why, when a partner raised European privacy rules with me on a call in September, my answer was simple. About 80% of what we do is US-focused. We avoid Canada, and we largely avoid Europe. I'm based in Toronto, so yes, I'm the Canadian who doesn't cold email Canadians. Here's why.

United States: CAN-SPAM in plain words

The FTC's compliance guide for CAN-SPAM is short and readable, and I'd encourage anyone sending cold email to read it in full. A few points from it matter most for B2B senders.

First, there's no exception for business email. The FTC states plainly that the law makes no exception for business-to-business email. A lot of founders assume B2B is a free zone. It isn't.

Second, the penalties are per email. Each separate email in violation can carry penalties of up to $53,088, according to the FTC. Multiply that by a campaign and you understand why this isn't a box to skip.

Third, the rules themselves are reasonable. The ones that come up most in cold outreach:

• Don't use false or misleading header information. The "from" has to be honest about who is sending.
• The subject line has to accurately reflect the content of the message.
• Include a valid physical postal address.
• Tell people how to opt out, and honor opt-out requests within 10 business days.

None of that stops you from sending a relevant, honest email to a business buyer. It stops you from tricking them.

Canada: CASL and implied consent

Canada is a different world. CASL, Canada's anti-spam legislation, is built around consent. In broad terms you need express consent, or one of the forms of implied consent the law recognizes, before sending a commercial electronic message.

One of those implied consent routes is often called conspicuous publication: roughly, when someone has published their business email publicly without saying they don't want messages, and your message is relevant to their role. People lean on that a lot. But a 2020 Federal Court of Appeal decision, summarized by the law firm BLG, made clear that the sender relying on that kind of consent carries the burden of proving it.

And the penalties are in a different league. BLG's summary notes administrative penalties of up to $10 million per violation for an organization and up to $1 million for an individual.

So could you build a compliant Canadian cold email program? Possibly, with a lawyer and careful records. Is it worth it for us, when our buyers and investors are mostly in the US anyway? No. So we don't.

Europe: why we mostly stay out

The question I get most after Canada is about Europe, usually Germany or the UK specifically. When a partner raised GDPR on that September call, she was right to. European privacy and marketing rules differ by country and treat personal data, including a work email that names a person, more strictly than US law does.

I'm not going to summarize European law here, because I'd be guessing, and this is exactly where a guess gets expensive. What I can tell you is our choice: we largely stay out, and we send the rare European campaign only when a client has taken their own advice on it.

The compliance checklist I'd use

This is what I'd run through before any campaign goes live. Again, have your own lawyer review it for your situation.

1. Know where your list lives. Filter by country before you send, not after. If you're not sure where someone is, leave them out.
2. Send from a real, identifiable sender. A real name, at a real company, on a domain that's clearly connected to you.
3. Write an honest subject line. If the email is an invitation to be a guest on your show, the subject should be about that.
4. Put your postal address in every email.
5. Make opting out easy, and remove people well inside the FTC's 10 business days.
6. Keep a suppression list and never re-import people who opted out, even into a new campaign or a new domain.
7. Keep records of where every contact came from.

A side note on separate sending domains. We always send from separate, warmed domains, never from the founder's main domain, so the main domain and inbox stay clean. That's a deliverability and reputation decision, not a legal loophole. Separate domains don't change what the law requires of you. Every rule above still applies.

Why the invitation helps here too

There's one more reason the show invitation sits well with all of this. A message that honestly says "I host a show and I'd love to have you on as a guest" is about as far from deceptive as a cold email gets. The subject line is honest. The sender is real. The ask is clear and easy to decline. When you're not trying to sneak a pitch past someone, a lot of compliance takes care of itself.

That's not a legal argument. It's just how honest outreach tends to look.

Myths I hear every week

A few beliefs come up so often on calls that they're worth taking apart, using only what the regulators and the courts have said.

"B2B email is exempt." Not under CAN-SPAM. The FTC is explicit that the law makes no exception for business-to-business email.

"If I send from a separate domain, the rules don't apply to my company." They do. A separate domain protects your main domain's reputation. It doesn't change who the sender is in the eyes of the law.

"Their email is on their website, so Canada is fine." Maybe, maybe not. That's the conspicuous publication route, and the 2020 Federal Court of Appeal decision summarized by BLG puts the burden of proving it on the sender. If you can't prove it, you don't have it.

"One unsubscribe request doesn't matter." Each email in violation of CAN-SPAM can carry penalties of up to $53,088, per the FTC. Ignored opt-outs are the easiest violation to prove.

"The tool handles compliance." Tools help. But you choose the list, the countries and the words. The responsibility doesn't move to the software.

Questions to ask your lawyer

• Which countries are on my list, and which laws apply to each?
• Does my use case rely on implied consent anywhere, and how do I document it?
• What exactly needs to be in my footer?
• How fast do opt-outs need to be processed in every system that touches the list?
• Who is legally the sender if an agency or tool sends on my behalf?

If you want to see how the sending side is set up, separate domains, warmed mailboxes and every reply in one inbox, the walkthrough of how the system works shows each layer.

Frequently asked questions