Is cold email legal? CAN-SPAM, CASL, and where the rules change

Start with the recipient’s location, not yours

Where the recipient is often matters more than where you are. CASL, for example, applies when a computer system in Canada is used to send or access the message, so a U.S. company emailing a prospect in Toronto is in scope. Map each segment to the recipient’s jurisdiction before anyone writes copy. [1]

This guide covers the United States and Canada in some depth, because those are the only markets Actually Agentic serves, and summarizes the UK and EU for comparison. It is a starting map, not legal advice. Laws change, penalty amounts are adjusted, and the facts of a specific program matter. [2]

United States: CAN-SPAM is an opt-out law

The FTC says CAN-SPAM makes no exception for business-to-business email. Commercial messages must follow its rules whether they go to a consumer or to a company address. The FTC’s guide lists these requirements: [3]

• Accurate header information: the From, To, Reply-To, and routing details must identify the sender truthfully.
• Subject lines that accurately reflect the content of the message.
• A clear and conspicuous disclosure that the message is an advertisement.
• A valid physical postal address.
• A clear explanation of how to opt out of future messages.
• Opt-out requests honored within 10 business days.
• Oversight of anyone sending on your behalf; you cannot contract away responsibility for compliance.

Sources [3][4]

What the U.S. model does and does not require

None of the FTC’s listed requirements is prior consent. The obligation is to identify yourself honestly, give people a working way out, and stop when they use it. That is why a narrow, relevant U.S. B2B program can be lawful without an opt-in, and why sloppy suppression is one of the fastest ways to make it unlawful. [3]

The penalties are not trivial. The FTC’s guide currently lists penalties of up to $53,088 for each separate email in violation, and the statute adds aggravated violations for addresses harvested from sites that post no-transfer notices and for dictionary attacks that generate addresses from permutations. [3][4]

Canada: CASL starts from consent

CASL prohibits sending a commercial electronic message unless the recipient has consented, and each message must identify the sender, include contact information, and carry an unsubscribe mechanism. Unsubscribe requests must take effect without delay and no later than 10 business days, and the contact information must remain valid for at least 60 days after the message is sent. [1]

The person relying on consent carries the burden of proving it, which is why provenance matters: record where each published address came from and what the page said. CASL’s maximum administrative monetary penalty for a violation is $1 million for an individual and $10 million for any other person. [1]

Sources [1]

United Kingdom and EU: corporate addresses versus people

The UK’s PECR distinguishes corporate subscribers, such as limited companies and LLPs, from individual subscribers. The ICO says the consent rule for marketing email does not apply to corporate subscribers, but sole traders and some partnerships count as individuals, and every message must identify the sender and provide a valid address for opting out. [5]

That is not the end of the analysis. When an address identifies a named person, the ICO says UK GDPR applies, and that person has an absolute right to object to direct marketing. The ICO also advises honoring opt-outs from corporate subscribers. [5]

In the EU, the ePrivacy Directive requires prior consent for direct-marketing email to subscribers who are natural persons and leaves the protection of other subscribers to national law, so member states differ on B2B email. Where personal data is processed, GDPR Recital 47 says direct marketing “may be regarded” as a legitimate interest—a possibility to assess, not an automatic permission—and Article 21 gives people the right to object, after which their data can no longer be used for that purpose. [6][7]

Actually Agentic does not serve UK or EU recipients. If you do, get advice for each country you target. [2]

Provider policy is a separate gate

Being lawful does not oblige any platform to carry your mail. An email provider can prohibit prospecting outright, require a stricter permission standard than the law, or set lower complaint and bounce limits. Read the acceptable-use policy of every provider in the chain, and get written approval where the use case matters.

Receivers apply their own standards too. Google’s sender guidelines ask every sender to authenticate mail and keep spam rates low, with additional requirements for bulk senders, regardless of what the law in your country permits. [8]

A practical compliance checklist for a cold B2B campaign

Actually Agentic asks the customer’s agent for a jurisdiction-specific compliance note for human review, appends the approved postal address and opt-out text to every message, and stops future sends on replies, permanent bounces, complaints, and unsubscribes. Its terms make the customer the sender, responsible for the lawful basis of each campaign; the compliance note is an operational aid, not legal advice. The product is prelaunch. [9][2][10]

• Map every recipient segment to a jurisdiction, and exclude any you cannot support.
• Record the basis for each segment: CAN-SPAM compliance in the U.S., a specific CASL consent route in Canada, and the applicable PECR or GDPR analysis elsewhere.
• Keep provenance for every address, including the page it came from and any notice on that page.
• Use a truthful sender name, a real postal address, and subject lines that match the message.
• Include a working, plain-language opt-out in every message, and suppress opt-outs across all future campaigns well inside the 10-business-day limits.
• Stop on replies, complaints, and permanent bounces, not only on unsubscribes.
• Review vendor and provider terms, and document who approved the campaign and when.