CAN-SPAM compliance for cold outbound: what actually applies to you

CAN-SPAM applies to your cold B2B email. There is no business-to-business exception, and sending one message at a time instead of blasting a list of 10,000 does not change which rules apply. The list of what a compliant cold email needs is short: real header information, a subject line that matches the message, your valid physical postal address, and a clear way to opt out that still works 30 days later. Opt-outs have to be honored within 10 business days. Earlier parts of this series covered DNS records, copy, subject lines, personalization and bounces. This one is about the part that carries a fine.

One caveat up front. We build sending software, we are not lawyers, and this is not legal advice. If your outbound touches regulated industries or recipients outside the US, talk to someone qualified.

Does CAN-SPAM apply to B2B cold email?

Yes. This is the single most common misunderstanding in outbound, and the FTC's own guidance closes the door on it: "The law makes no exception for business-to-business email."

What decides it is the primary purpose of the message, not who receives it or how many people got it. If the main job of the email is advertising or promoting a product or service, it is a commercial message. A cold outreach email is squarely that. So is a one-to-one email from a rep's own Gmail, which catches people out because a personal mailbox feels like personal correspondence.

There is a real exception, and it is narrow. Transactional or relationship messages: order confirmations, shipping notices, warranty and recall information, account statements, changes to terms, employment and benefits information. Five categories, read strictly. A password reset is transactional. "Following up on my last email" is not.

So assume every step of every sequence you run has to comply in full.

What does a compliant cold email actually need?

The law has eight main requirements. Here is each one against what it means for a cold outbound email specifically.

Requirement	What it means for cold outbound
No false or misleading header info	Your From, Reply-To and routing data must identify you honestly. Sending as a real person at a domain you control is fine. Inventing a sender is not.
No deceptive subject lines	The subject must reflect the message. "Re: our conversation" when there was no conversation is the exact thing this prohibits.
Identify the message as an ad	Must be disclosed clearly and conspicuously. The law gives you latitude in how.
Include your valid physical postal address	A street address, a registered PO box, or a registered private mailbox. On every commercial message.
Explain how to opt out	Clear, conspicuous, and easy for an ordinary person to find and understand.
Keep the opt-out working for 30 days	The mechanism must still process requests for at least 30 days after you send.
Honor opt-outs within 10 business days	And you cannot charge a fee, demand extra personal information, or make them do more than reply or visit one web page.
Monitor what others do on your behalf	You cannot contract the liability away. Hiring a tool or an agency does not move the obligation off you.

Two of those are things you put in the email. The rest are things you either don't do, or do afterward when someone asks you to stop.

Do you have to say "this is an advertisement"?

This is the requirement people argue about, and the honest answer is that it is less settled than the others.

The law says you must disclose clearly and conspicuously that the message is an advertisement, but it deliberately does not prescribe wording or placement. The common reading is that a plainly commercial email, sent by a named person at a named company, offering a named product, discloses its own nature by being obviously what it is. A subject line and a body that read as a sales pitch are not hiding anything.

The cautious reading is that you put a line in the footer anyway. "You're getting this because we think our product is relevant to your work at Acme" costs you nothing and sits right next to your address and your opt-out link, where a regulator would look for it.

The real risk sits with the email that dresses itself up as something else. A subject line implying a prior conversation, a From name that reads like a colleague, a body pretending to be a support ticket. Those break the deceptive-subject-line rule and the advertisement-disclosure rule at once, and that pattern is what enforcement actions actually go after.

What counts as a valid physical postal address?

A current street address, a post office box registered with the USPS, or a private mailbox registered with a commercial mail receiving agency. That is the whole list.

For a two-person company working from a kitchen table this is the requirement that stings, and not wanting to publish your home address to a cold list is a perfectly reasonable position. A registered PO box is the usual answer, roughly $20 to $40 a month depending on where you are. A virtual mailbox works too, as long as it is a registered CMRA and not just a forwarding arrangement with nothing filed behind it.

What does not count: your website URL, a phone number, "Remote / United States", or leaving it out on the theory that anyone can find you on LinkedIn.

In SEMAOS the address is a structured tenant setting, not a free-text blob. Line one, city and country are required, and the country is validated against real ISO country codes so a placeholder cannot pass. Onboarding will not advance past step one without it. It renders into your email through the {{system.mailing_address}} merge field, which composes to a single line: 123 Main St, Springfield, IL 62704, US.

How fast do you have to honor an unsubscribe?

The law gives you 10 business days. That is the outer limit, not a target.

Ten business days is about two calendar weeks. That is long enough for a contact sitting in a five-step sequence to get two more emails after asking you to stop. Legally defensible, and a reliable way to turn an unsubscribe into a spam complaint. The complaint costs you far more than the unsubscribe did.

SEMAOS does not use the 10-day window. An opt-out is written to your suppression list synchronously, inside the same request that processes it, before the confirmation page renders. The suppression list is checked before every single send, so the very next step of any sequence that contact is in will refuse to send. Same for broadcasts, same for one-off emails.

Two details about how the opt-out link itself behaves, because they matter for the "single page on a website" rule:

A human clicking the link gets a confirmation page rather than an instant opt-out. That is on purpose. Security scanners and link-preview bots follow every URL in an email, so a GET request that unsubscribes people would quietly opt out contacts who never touched the link. One click, one confirmation button, done. Still a single page, which is what the law permits.

A mail provider gets a faster path. On the SES channel, SEMAOS sends List-Unsubscribe and List-Unsubscribe-Post: List-Unsubscribe=One-Click, the RFC 8058 headers that put a native "Unsubscribe" control in Gmail and Outlook. Those go straight to processing without the confirmation page.

The connected-mailbox channel leaves those headers off on purpose. A one-to-one email from your own Gmail carrying bulk-sender headers gets filed as bulk, which defeats the point of sending it from your mailbox in the first place. The opt-out link in the body is still there and still works.

What about GDPR, CASL, and state privacy laws?

CAN-SPAM is the floor, not the ceiling, and it is the most permissive of the major regimes.

Regime	Consent model	Notable difference from CAN-SPAM
CAN-SPAM (US)	Opt-out. You may email first.	No B2B exception, but no prior consent required
GDPR / ePrivacy (EU/UK)	Consent or legitimate interest, documented before you send	B2B cold email is possible under legitimate interest in some member states, but the bar is real and varies by country
CASL (Canada)	Opt-in, with narrow implied-consent windows	Much stricter, and penalties reach into the millions
US state privacy laws	Vary	Mostly about data rights rather than message content, but a few add opt-out obligations

If your list has EU, UK or Canadian addresses in it, CAN-SPAM compliance alone is not enough and the right move is to segment those contacts and get advice before sending. Country is a field on your contact records for a reason.

What does SEMAOS enforce, and what does it not?

None of this is a checkbox you tick at the end. The gates run at send time and they refuse.

A send without an unsubscribe link is refused. SEMAOS looks for the {{system.unsubscribe_url}} token in the template's HTML body and returns a 412 if it is missing, on both the SES channel and the connected-mailbox channel. The check runs before quota reservation, so a blocked send does not burn a send off your plan.

The same check runs at three earlier points, so you find out at authoring time rather than at 2am mid-campaign. Activating a sequence whose template lacks the footer is blocked. Creating a broadcast without one is blocked, including each A/B variant separately. And if a live sequence's template loses its footer while enrollments are running, the sequence pauses itself rather than sending the next step.

A send with an empty mailing address is refused. Same 412 treatment, checked independently of the unsubscribe link.

Bounces and complaints suppress themselves. A hard bounce or a spam complaint adds the address to your suppression list automatically, which is the same mechanism that keeps a bounce rate from compounding.

You can manage the list directly. Settings has a suppression page with search, a reason breakdown across bounced, complained, unsubscribed, manual and imported, a manual add form, and CSV import for a do-not-contact list you are bringing with you. Removing an address is admin-only on purpose. The help article on unsubscribes and compliance walks through the screens.

Now the limits, because you would rather read them here than discover them:

The address is checked in the body, not just on your account. Two separate gates: SEMAOS refuses to send when your account has no mailing address set, and it refuses again when the template body has no {{system.mailing_address}} merge field. Delete it from your footer and the send is blocked with an error naming the field, rather than going out without a postal address. Broadcasts are checked before they fan out, so a footerless template fails once at creation instead of once per recipient. This second gate shipped on 24 August 2026 — an earlier version of this post described its absence, which is what prompted it.

The unsubscribe check reads the HTML rendition only; the address check reads both. That asymmetry is not an oversight. The unsubscribe token lives inside an href attribute, and the plain-text version generated from your design drops it, so requiring it in the text part would block templates that are perfectly compliant in the part every graphical client renders. The address token is ordinary text and survives, so it is required in both — a plain-text reader gets the postal address too. A template with no plain-text part at all passes, since it cannot omit an address from a body it does not have. If you hand-write your plain-text body, put the opt-out line in it yourself.

It looks for the merge token, not any link. A hand-written mailto:unsubscribe@ line will not satisfy the gate, and it also will not put anyone on your suppression list when someone uses it.

An unsubscribe does not unenroll the contact. The enrollment stays open and walks its remaining steps, refusing at each one. Nothing is ever delivered, but if you are reading enrollment counts as an audience size, the opted-out contacts are still in there.

Test sends skip the mailing-address gate, so a clean test send is not proof the real one will pass.

Where to start

If you have not sent yet, three things, in this order. Put your registered postal address into onboarding, since you cannot send without it anyway. Build one base template with {{system.unsubscribe_url}} and {{system.mailing_address}} in the footer, and clone every future template from that one. Then write subject lines that describe the email you actually wrote. That last rule costs nothing and is the one broken most often.

If you are already sending, open a template you use and read the footer. The unsubscribe link will be there, because SEMAOS would not have let the sequence activate without it. The address is the part worth checking.

Every plan includes the suppression list, the unsubscribe endpoint and both send-time gates, down to the free mailbox-only tier. Compliance is not a paid feature here, because a product that lets you send illegal mail on the cheap plan is not a cheaper product. Start a 30-day trial and the footer is already in the default template.