Yes, and the United States is the most permissive major jurisdiction for cold outreach. CAN-SPAM does not require consent before sending — it regulates how you send and what you must do when someone asks you to stop. That permissiveness is real, and it is also the reason American outreach advice travels badly to other countries.
This is not legal advice. It is a plain-language summary of publicly available legislation, written to help you ask better questions. Rules change, enforcement practice varies, and your circumstances may differ. If cold outreach is material to your business, have a lawyer in the relevant jurisdiction review what you are doing.
What CAN-SPAM requires
- No false or misleading header information. The "From", "To" and routing details must accurately identify who sent the message.
- No deceptive subject lines. The subject must reflect what is actually in the message.
- Identify the message as an advertisement, where applicable, in a clear way.
- Include a valid physical postal address. This one surprises people and is genuinely required.
- Provide a clear opt-out mechanism, and honour requests promptly — the Act sets a specific period.
- Monitor what others do on your behalf. Hiring an agency does not transfer your legal responsibility.
What CAN-SPAM does not require
Consent. There is no opt-in requirement before a first commercial message — which is the single largest difference from European rules and the reason a great deal of outreach advice written for the American market is unsafe to apply in the EU or UK.
This asymmetry matters commercially. If you sell internationally, the compliant approach is to apply the strictest applicable regime to each recipient rather than your own local rules. A campaign that is lawful from Texas can be unlawful the moment it reaches Berlin.
State laws are a second layer
CAN-SPAM is federal and largely preempts state anti-spam statutes, but state privacy laws are a separate matter and have expanded considerably.
- California (CCPA/CPRA) gives residents rights over personal information including access, deletion and opting out of sale or sharing. Business contact information receives some accommodation, but the exemptions have narrowed over time.
- Virginia, Colorado, Connecticut, Utah and a growing list of others have enacted comprehensive privacy statutes with varying thresholds and obligations.
- These laws generally regulate how you handle the data rather than whether you may send — but if you hold a prospect database of any size, they apply to you as a data holder.
Penalties
CAN-SPAM provides for civil penalties assessed per violating email, and because each message counts separately, totals in enforcement actions have reached very large figures. The Federal Trade Commission enforces it, and internet service providers can also bring actions.
Practical compliance
1
Put a real postal address in every message. A registered business address or a mailbox service is acceptable; omitting it is a straightforward violation.
2
Keep headers and subject lines truthful. No "Re:" on a first contact, no disguised sender.
3
Make opting out easy and honour it fast. Automate suppression so it cannot be missed.
4
Maintain one global suppression list, not per-campaign settings.
5
Apply the stricter rule when in doubt — particularly if any recipient may be in Europe.
Common questions
Do I need consent to send cold email in the US?
No. CAN-SPAM regulates the conduct of commercial email rather than requiring prior permission, which makes the United States considerably more permissive than the EU, the UK, Australia or New Zealand. That permissiveness applies only to recipients in the US.
Do I really need a physical address in the email?
Yes. A valid physical postal address is an explicit CAN-SPAM requirement, and omitting it is one of the easiest violations to prove. A registered business address or a commercial mailbox service satisfies it.
How fast must I process an opt-out?
CAN-SPAM sets a specific short period, and continuing to send after a request is one of the clearest violations available. The practical answer is to suppress immediately and automatically rather than relying on a manual process that might slip.
Does CAN-SPAM apply if I am outside the United States?
It applies to commercial messages sent to recipients in the United States regardless of where the sender is. Location does not remove the obligation, and enforcement has reached overseas senders.