If you email local businesses to sell them something, U.S. law applies to every message, including one-to-one, hand-written emails to a business owner. This checklist turns the FTC’s guidance into concrete steps for cold outreach. It’s practical guidance, not legal advice. If you send at volume or outside the U.S., talk to a lawyer.
The primary source for everything below is the FTC’s CAN-SPAM Act: A Compliance Guide for Business.
First: B2B is not exempt
A common misconception is that CAN-SPAM only covers consumer email. The FTC is explicit: “The law makes no exception for business-to-business email.” An email to [email protected] pitching your SEO service is a commercial message and is covered.
CAN-SPAM does not require prior consent in the U.S. Cold email is legal. It just has to follow the rules. That’s different from Canada (CASL) and the EU/UK (GDPR/PECR), which are stricter. Check before you email businesses outside the U.S.
The requirements, translated for cold outreach
1. Honest headers
Your From, To, Reply-To and routing information must be accurate and identify you.
- Send from a real person at a real company:
Sam at Northside Web <[email protected]>. - Don’t spoof a domain, and don’t impersonate a customer, a platform (Google, Yelp) or a local organization.
- Sending from a secondary domain for deliverability is common. Just make sure it’s clearly your business and replies reach you.
2. Subject lines that match the content
Subject lines must not be deceptive.
- ❌ “Re: your invoice”, “Question about your order”, or a fake “Fwd:”
- ✅ “Missed calls after 6pm at Harbor Pipe?” if the email really is about after-hours call handling
3. Identify the message as an ad
The FTC requires that you disclose clearly and conspicuously that the message is an advertisement. There’s no mandated wording. Many senders make the commercial purpose plain in the body (“I run a small agency and I’m reaching out because…”) and include a short footer line. Don’t disguise a pitch as a personal or transactional message.
4. Include a valid physical postal address
Every commercial email needs your valid postal address. The FTC accepts:
- your current street address,
- a post office box registered with the U.S. Postal Service, or
- a private mailbox registered with a commercial mail receiving agency under USPS rules.
If you work from home and don’t want your address in every email, a registered PO box or private mailbox is the standard solution.
5. Tell people how to opt out
Explain clearly how to stop future emails from you. For one-to-one cold email, a plain line works:
Not relevant? Reply “no thanks” and I won’t email you again.
Many sending tools also add an unsubscribe link. Either way, the FTC rules on the mechanism are specific:
- It must keep working for at least 30 days after you send.
- You can’t charge a fee or ask for anything beyond an email address.
- You can’t require more than a reply email or a visit to a single web page.
6. Honor opt-outs within 10 business days
“You must honor a recipient’s opt-out request within 10 business days.” In practice:
- Keep a suppression list that every tool and every teammate uses.
- Suppress the address. If you cold-email several businesses owned by the same person, consider suppressing related domains too.
- You can’t sell or transfer opted-out addresses, except to a company helping you comply.
7. You’re responsible for anyone sending on your behalf
Hiring an agency, a freelancer or an outreach platform doesn’t remove your legal responsibility. Both of you can be held liable. Check what they send under your name.
What’s at stake
The FTC’s guide states that each separate violating email can bring civil penalties of up to $53,088. The figure is adjusted for inflation, so check the current number on the FTC page. With hundreds of emails in a sequence, the exposure adds up fast.
Beyond the law: deliverability rules you’ll hit first
Google and Yahoo’s sender requirements (in force since 2024) are what usually stop sloppy cold email before a regulator ever would:
- Authenticate your sending domain with SPF and DKIM, and publish DMARC.
- Bulk senders must support one-click unsubscribe and keep spam complaint rates low.
- Send from a domain whose records actually resolve. Our free email domain checker shows a domain’s MX, SPF and DMARC in a few seconds.
On the list side, don’t email addresses you know are bad. LeadMerlin marks every address it finds as verified, catch-all, invalid or unverified, and flags role-based (info@, office@) and free-provider (Gmail, Yahoo) addresses. Sending only to verified addresses keeps bounce rates low.
Pre-send checklist
Copy this into your campaign doc:
- From name and address identify a real person at my business
- Reply-To goes to a monitored inbox
- Subject line describes what the email is actually about
- The email is clearly a business pitch, not disguised as personal or transactional
- Valid postal address (street, registered PO box or registered private mailbox) in the footer
- Clear opt-out instruction, working for at least 30 days after the send
- Suppression list loaded into the sending tool and shared with everyone sending
- Opt-outs processed within 10 business days (we aim for same day)
- Sending domain has SPF, DKIM and DMARC
- List filtered to valid addresses, with invalid ones removed
- Recipients outside the U.S. checked against their local rules
- Every claim in the email is true and checkable
A compliant cold email, end to end
From: Sam Ortiz <[email protected]> Subject: After-hours calls at Harbor Pipe & Drain
Hi Maya,
I run Northside Web, a two-person agency that builds sites for Orange County trades. I’m reaching out because your site lists same-day emergency service, but there’s no way to reach you after hours except the main line.
We set up a simple text-back form for plumbers that forwards to your phone. Happy to show you a two-minute example if useful.
Sam
Northside Web · 1234 Example Ave, Suite 5, Irvine, CA 92614 This is a sales email. Not relevant? Reply “no thanks” and I won’t contact you again.
It’s specific, honest about who’s writing and why, includes the address and opt-out, and makes no claims that can’t be backed up.
For building the list itself, see how to build a local lead list with Claude Code or the n8n → Google Sheets workflow.