The short answer
In the US, you can send a cold sales email without prior consent, to consumers and businesses alike, as long as you follow CAN-SPAM: an honest sender and subject line, a postal address, a clear way to opt out, and opt-outs honored within 10 business days. There is no exception for B2B email. Gmail adds its own bar: authenticate your domain and keep spam complaints under 0.3%.
We make Extra, an AI agent platform, so this article is written by an interested party. Facts about other tools and about the law come from the sources listed at the bottom, as of the date shown.
Is cold email legal in the US?
Yes. Cold email is legal in the US without prior consent, for consumers and businesses alike, as long as each message follows the CAN-SPAM Act. That is the big difference with Europe, where emailing a consumer who never opted in is banned. The US model is opt-out: you may send the first message, and you must stop when the person says no.
CAN-SPAM covers every commercial email, and the FTC is explicit about one common myth: “The law makes no exception for business-to-business email.” A message to a plumbing company’s owner follows the same rules as a message to a homeowner.
What does CAN-SPAM require in every email?
The FTC’s compliance guide lists eight requirements. Here they are, with what they mean for a small business sending sales emails:
| Rule | What it means in practice |
|---|---|
| Accurate header information | The From, To and Reply-To lines name your business, not a fake person or a borrowed domain |
| Honest subject line | No fake “Re:” on a first message, no fake order update |
| Say it is an ad | A sales email must be identifiable as an advertisement |
| Physical postal address | A street address, a registered PO box or a private mailbox, in every message |
| A way to opt out | A clear link or reply that works, including an option to stop all marketing email |
| Subscribers keep the right to opt out | Even members and customers can stop marketing email |
| Honor opt-outs fast | Within 10 business days, and keep the opt-out working for at least 30 days after sending |
| You are responsible for vendors | Hiring an agency or tool to send does not move the legal risk off you |
The penalty is the reason to take this seriously: each separate email in violation can cost up to $53,088, according to the FTC. For a campaign of a few hundred messages, that is a number no small business wants to test.
Do B2B and B2C emails follow different rules?
No, not under federal law. CAN-SPAM treats both the same way. The difference that matters is between commercial messages and transactional ones. A receipt, an invoice, a shipping notice or a reply to a question the customer asked is transactional: it is exempt from most CAN-SPAM rules, as long as it does not slip in a sales pitch as its main content.
State laws can add rules on top, and texts are a separate world. Sending marketing texts or calls with an artificial or AI-generated voice falls under the TCPA, which requires prior consent. In February 2024, the FCC confirmed that AI-generated voices count as “artificial” under the TCPA. So email is the channel where outreach without prior consent is allowed; texts and robocalls are not.
What does Gmail require from senders?
Gmail has enforced its own sender rules since February 1, 2024, and they are stricter in practice than the law. For every sender: authenticate your domain with SPF or DKIM, send over TLS, and keep your spam complaint rate in Google Postmaster Tools under 0.3%, with 0.1% as the recommended target. Above 5,000 messages a day to Gmail, you also need SPF, DKIM and DMARC, and one-click unsubscribe on marketing email.
A small business rarely sends 5,000 emails a day. The 0.3% line still applies to you. On 300 cold emails, one spam report puts you right at the edge. If your domain loses its reputation, your quotes and invoices start landing in spam too, and that hurts more than a failed campaign.
- Send from your own domain, not a free address, and check SPF, DKIM and DMARC.
- Start with a few dozen emails a day, not hundreds.
- Write a short first message with one question.
- Stop after two or three follow-ups with no reply.
- Process every opt-out the same day, not within the legal 10 days.
What should a compliant cold email look like?
A compliant cold email is short, specific and easy to refuse. Here is an example for a landscaping company writing to a property manager:
Subject: Spring cleanup for the Oak Street buildings
Hi Ms. Patel, I run Green Edge Landscaping in Columbus. We maintain three properties on your block, and I noticed your buildings changed management in September. Would a quote for spring cleanup and weekly mowing be useful? If not, reply “no” and I won’t write again. Mark Lewis, Green Edge Landscaping, 120 Main St, Columbus, OH 43215.
It names the sender and the business, has an honest subject line, gives a reason for writing to this person, includes a postal address and offers a simple way out. It is also clearly a sales message, which covers the “identify it as an ad” rule without a banner.
The friendly opt-out line (“reply no and I won’t write again”) is not only polite. It cuts spam reports, because people who can say no in one word rarely bother to click “report spam.”
Does AI change the rules for cold email?
No. An email written or sent with AI follows exactly the same rules as one typed by hand. The FTC looks at the message, the header and the opt-out, not the tool. What AI changes is volume: it is easy to send a thousand personalized emails in an hour, and therefore easy to blow through Gmail’s complaint limit in a single afternoon.
The useful way to use AI here is the opposite of volume: find the right companies at the right moment (a new location, a hiring push, a change of owner), write a message about their situation, and stop quickly. Our guide to AI sales prospecting covers the method.
At Extra (hello-extra.com), the AI agent platform for small businesses, that is the job of Jim, the prospecting agent: he checks the source of each contact and your sending domain, writes from your own Gmail address, and runs a campaign you approve once. For LinkedIn, the rules and limits are different: see AI LinkedIn outreach without getting restricted.
When is cold email the wrong channel?
Cold email is the wrong channel in three cases. First, when you sell to consumers who do not know you: it is legal, but it rarely works, and local ads, Google reviews and referrals bring better leads for a dental office or an HVAC contractor. Second, when you cannot say in one sentence why you are writing to this specific company: the message will be generic and it will be reported. Third, when your main domain carries your invoices and you cannot risk its reputation: use a separate subdomain, or start on LinkedIn.
Extra is also not the right tool to send a newsletter to thousands of subscribers: an email marketing platform does that better. Our post on writing a small business newsletter with AI explains how.
Frequently asked questions
Do I need consent to email a business contact I found on LinkedIn?
No, not under CAN-SPAM. You can email them without prior consent, as long as the message has an honest header and subject, your postal address and a working opt-out. LinkedIn’s own rules on scraping and messaging are a separate matter: copying contact data out of the platform can break its terms even when the email itself is legal.
Can I buy an email list for cold outreach?
It is legal, but it is a bad idea. Bought lists are full of stale and trap addresses, which push your complaint and bounce rates up quickly. Build a short list yourself, from companies you can explain in one sentence why you are writing to.
Key takeaways
- Cold email is legal in the US without prior consent, for B2B and B2C.
- Every message: honest header and subject, identified as an ad, postal address, working opt-out.
- Honor opt-outs within 10 business days; fines reach $53,088 per email.
- Gmail: authenticated domain, spam complaints under 0.3%.
- AI does not change the law; it makes sending too much easier, and riskier.
Read next: what an AI agent does for a small business, and Extra pricing, from $99 per month.
