CAN-SPAM Penalties and What B2B Cold Email Must Include

CAN-SPAM penalties go up to $53,088 for each email that breaks the law, and the FTC counts every separate violating email, according to the FTC's CAN-SPAM compliance guide. The guide says business-to-business email gets no exception. A cold email asking a US operations director for a meeting falls under the same rules as a retail newsletter.

Those rules fit on one screen: an accurate header and subject line, a clear sign that the email is an ad, a real postal address, and an opt-out that works and gets honored quickly. Miss one in a template and every send of that template counts as its own violation. This is a practitioner's summary, not legal advice.

For most B2B senders, the fine is the smaller risk. The bigger one is a burned sending domain that stops reaching inboxes.

Every sending domain my team uses gets SPF, DKIM and DMARC before the first real batch goes out. Between a few thousand extra sends and a clean reputation, I take the reputation. I would rather have the reputation.

Which emails count, and what are the seven rules?

The test is the primary purpose of the email. Under the CAN-SPAM Rule (eCFR, 16 CFR Part 316), an email whose main job is to sell or advertise something you offer counts as commercial. A first touch that offers your service is commercial. So is every follow-up behind it.

Permission does not switch the rules off. The FTC says people who subscribed or joined a membership program still keep their right to opt out of marketing email. Treat every sales email to a US address as commercial and build it to these seven rules.

1. Accurate header. From, Reply-To and routing details, including the sending domain, must identify the business behind the email. Separate sending domains are not banned, but the From line and the sending domain must still identify your business. The boring setup work behind cold email, domains, inboxes and warm-up, is where that identification is decided.
2. Honest subject line. It must reflect what the email is about. A "Re:" on a first message invents a conversation that never happened.
3. Ad disclosure. Make it clear that the email is an advertisement. The FTC leaves room on the wording.
4. Valid postal address. A current street address qualifies, and so does a USPS-registered P.O. box or a commercial mail receiving agency mailbox.
5. Opt-out explained. "Reply 'stop' and I will not email you again" tells the reader plainly how to stop.
6. Opt-out that keeps working. It must still accept requests on day 30 after every email goes out, with no fee, no data beyond an email address, and nothing harder than a reply or one page visit.
7. Opt-outs honored within 10 business days. Make sure your own spam filter does not swallow the requests, and put one person on the reply inbox so a "stop" never sits unread. Keep one exclusion list for opt-outs, and treat a "stop" sent to one mailbox as a stop for every domain you send from.

How much can one CAN-SPAM violation cost?

Real cases land far below the theoretical ceiling, but they are not small.

In August 2023 the FTC announced that Experian Consumer Services would pay $650,000 over marketing emails with no clear opt-out notice and no unsubscribe link.

In August 2024 Verkada agreed to a $2.95 million penalty. It had sent over 30 million commercial emails in three years, so that is under 10 cents an email, yet the FTC called it the largest penalty it had obtained for a CAN-SPAM violation.

More can stack on the civil penalty. The FTC guide adds deceptive advertising law (Section 5 of the FTC Act) for misleading claims, plus redress for affected people under Section 19.

Some conduct is criminal, with prison possible: harvesting addresses, dictionary attacks, relaying spam to hide its origin, using open relays or other people's computers, and registering several email accounts or domain names with false information. That last one matters for cold senders. The cold setups my team builds usually run on 10 to 20 domains, and every one of them is registered with the client's real company details.

What would the penalty ceiling be on one bad template?

This is a hypothetical, and the figures are statutory ceilings, not what a court would award. A team loads 2,500 US prospects into a four-step cold sequence. The footer has no postal address, so every email in the run is missing a required element.

The statute adds two more routes with their own numbers (15 U.S.C. 7706). For a missing address, both can sue only over a pattern or practice, meaning a repeated habit rather than a one-off slip. A template that repeats the gap on every send is exactly that.

• State attorney general: up to $250 per separately addressed message. At 10,000 emails the $250 rate gives $2,500,000, so the $2,000,000 cap applies. That cap does not apply to false header information. A court can triple the award for willful and knowing violations, to $6,000,000.
• Internet access provider: up to $25 per message here ($100 for header violations), capped at $1,000,000. If all 10,000 emails crossed one provider's network, that is $250,000, and tripling can lift it to $750,000.

Is the CAN-SPAM Act still in effect for B2B email?

Yes. The CAN-SPAM Rule sits in the current eCFR as 16 CFR Part 316, and the FTC guide gives $53,088 as the inflation-adjusted maximum.

Only transactional or relationship email sits mostly outside it, and the FTC reads that narrowly: confirming an agreed deal, warranty or recall notices, account changes, employment information, or delivering something already bought. A cold sales email fits none of them. Where your list comes from is a separate legal question, and scraping LinkedIn for cold email raises its own.

Who enforces the CAN-SPAM Act, and can an agency be liable?

The FTC enforces it and treats a violation like any unfair or deceptive practice. For some sectors the statute hands enforcement to other regulators, including bank regulators such as the OCC, the SEC, the FCC and state insurance authorities. State attorneys general and internet access providers can sue too, as the worked example shows.

Hiring an outside sender, including a cold email agency, does not move the risk. The FTC says you cannot contract away your legal responsibility: the company whose product the email promotes and the company that sends it can both be held responsible.

Before an agency or freelancer sends a single email in your name, get these answers in writing:

• Whose postal address goes in the footer, and is it valid?
• Where do opt-out replies land, and who removes those people before the deadline?
• Which list holds everyone who opted out, and is it checked before every batch?
• Who registered the sending domains, and with whose details?

How does the US compare with the UK, Canada and Australia?

In Australia, you still need each person's consent when an agency or another third party sends for you. In Canada and Australia, "email first, offer an opt-out" does not hold.

Both regulators act on this. In Canada, the CRTC's 2015 notice of violation against CompuFinder, a business training provider, set an administrative monetary penalty of CAD 1.1 million. The Commission reviewed the case in 2017 and cut the fine. Its decision says a lower penalty than the one in the notice of violation would be appropriate.

A 2021 CRTC enforcement update reports a CAD 75,000 penalty issued in March 2021 to one individual sender.

In Australia, ACMA's infringement notices register lists a December 2025 notice against Lululemon Athletica Australia for sending marketing emails without a functional unsubscribe facility. ACMA's media release puts the penalty at AUD 702,000.

This shapes where I point cold email. We mostly send to the US, the UK and Europe, mainly English-speaking markets; for buyers in Germany, Austria and Czechia the first message goes through LinkedIn unless a compliant basis for email exists.

What should a B2B sender check before hitting send?

The seven rules keep you legal. These four keep you in the inbox.

1. Keep cold email off your main domain. My team never sends it from the domain a company's invoices come from, because a burned reputation there hits every customer email too.
2. Authenticate. Gmail requires SPF or DKIM from all senders. Above 5,000 messages a day it wants both, plus DMARC and one-click unsubscribe on marketing mail (Google sender guidelines).
3. Watch complaints. Google asks senders to stay below 0.1% and never reach 0.3%. A bulk sender above 0.3% loses mitigation (Google's support for fixing delivery problems) until it stays under that line for 7 consecutive days (Google bulk sender enforcement).
4. Sync the opt-out list across every mailbox and your CRM, verify the list so bounces stay below 0.5%, then send one test to yourself and read the footer.

Most of the mailbox work comes down to why cold emails land in spam and what you change about the sending setup.

Fix the template first. Then scale. A gap in one footer repeats on every send you add.

Not sure your template passes the seven rules? Book a call and send me the footer and first email. I will tell you what I would fix. I am not a lawyer.