CAN-SPAM: cold email rules for US web agencies

Does CAN-SPAM apply to B2B email?

Yes. The FTC is explicit that the law makes no exception for business-to-business email. Any email whose primary purpose is to advertise or promote a product or service is a "commercial message" (FTC, CAN-SPAM compliance guide). A message offering a website redesign is commercial.

The main requirements

The FTC's compliance guide lists the core rules:

1. Don't use false or misleading header information. Your "From", "To", "Reply-To" and routing information must be accurate and identify who is sending.
2. Don't use deceptive subject lines. The subject must reflect the content. "Re: our call" when there was no call is deceptive.
3. Identify the message as an ad. The law gives leeway on how, but it must be clear and conspicuous that the message is promotional.
4. Tell recipients where you're located. Include your valid physical postal address: a street address, a PO box registered with the US Postal Service, or a private mailbox registered with a commercial mail-receiving agency.
5. Tell recipients how to opt out. Explain clearly how to stop future emails. A reply address or a one-page unsubscribe link both work.
6. Honor opt-outs promptly. Within 10 business days. You can't charge a fee, ask for more personal information than an email address, or make people do more than reply or visit one page.
7. Monitor what others do on your behalf. If you hire someone to handle your email marketing, you are still legally responsible.

Penalties

Each separate email that breaks the law can lead to a civil penalty. The FTC adjusts the maximum for inflation every year; in its 2025 update the figure was $53,088 per violating email (FTC, 2025 civil penalty amounts). Check the FTC for the current amount.

Beyond the law: deliverability rules

Being legal doesn't mean landing in the inbox. Mailbox providers have their own rules. Google's sender guidelines ask all senders to authenticate with SPF or DKIM, keep spam rates low, and add one-click unsubscribe and DMARC once they send large volumes (Google sender guidelines). For a small agency, that means:

• send from a domain with SPF, DKIM and DMARC set up;
• start with low volumes and increase gradually;
• keep messages personal and relevant so people don't mark them as spam.

State laws and other countries

CAN-SPAM generally preempts state laws on commercial email, except those that prohibit falsity or deception. If your prospects are in Canada, CASL applies instead and requires consent; in the UK and EU, PECR and GDPR apply. Check the rules of the recipient's country before you send.

A practical checklist

1. Use your real name and business in the From field.
2. Write a subject line that matches the email.
3. Make the commercial nature clear, for example "I'm reaching out because we build websites for local businesses."
4. Add your postal address in the footer.
5. Add a one-click unsubscribe link or a clear "reply STOP to opt out".
6. Process opt-outs immediately, well within 10 business days.
7. Keep a suppression list and apply it to every new campaign.

How Closamo handles this

Closamo applies rules per country. For US contacts, every email includes your identity, your postal address and an unsubscribe link; a STOP reply ends the sequence, and opted-out contacts are never contacted again. Messages are drafted around a fact you can verify, and you review them before anything is sent. Details are on our compliance page.

Frequently asked questions

More guides

• PECR and cold email in the UK: a guide for web agencies
• How to find clients for a web design agency