Cold Email Is Legal. Most Cold Programs Still Break CAN-SPAM.

A founder hired me last spring after a rough quarter. Their reply rate had cratered and one of their sending domains had picked up a blacklist entry. Somewhere in the first call they said the thing I hear constantly: "We're fine on the legal side. It's cold email, it's one-to-one, and we're too small for the FTC to care."

Two assumptions. Both wrong.

Here's the part nobody leads with. Cold email is legal in the United States. CAN-SPAM is an opt-out law, not an opt-in one. It does not require prior consent the way GDPR or Canada's CASL do. You can email someone who has never heard of you, pitching your product, at volume, across as many domains as you want, and stay fully compliant. A clean program is clean whether it runs on one domain or two hundred.

The channel is legal. The plumbing underneath most programs is the problem. It gets built for speed, and speed and compliance pull in different directions.

Let me walk through where programs fall out of bounds, and what "in bounds" actually looks like.

There's no "it's just sales" exemption

CAN-SPAM cares about one thing when it decides whether a message counts: primary purpose. If the main point of the email is to advertise or promote a product or service, it's a commercial message and the rules apply. A one-to-one sales pitch written by a human SDR is advertising a product. It qualifies. There's no carve-out for outbound just because it's personalized or low-volume.

And "too small to notice" isn't the shield people think it is. Enforcement doesn't only come from the FTC. State attorneys general can bring cases, and so can the mailbox and internet-access providers your mail passes through, who have a statutory-damages incentive to sue. The numeric thresholds in these laws (how many accounts, how many domains) were written to catch spammers spinning up throwaway infrastructure. A real program with real volume clears those numbers on day one. Being small was never the plan for staying legal. Being honest is.

1. Opt-outs that never actually get honored

Every commercial email needs a working way to opt out, and that mechanism has to keep working for at least 30 days after you send. Once someone opts out, you have 10 business days to stop emailing them. Those two numbers are the whole game.

Most cold programs skip the unsubscribe link and use "just reply to opt out." That's legal, but only if the reply actually gets captured and the address actually gets suppressed. Here's where it falls apart. Cold outbound runs on rotation. You spin up domains and mailboxes, send from them for a while, then retire them and move to the next batch. When a mailbox gets abandoned before its 30-day window closes, the opt-out replies landing in it go nowhere. Nobody reads them. The address never hits a suppression list. Then the same person gets pitched again from the next domain in the rotation, which is exactly what they asked you to stop doing.

I've audited programs where opt-out replies were sitting unread in three retired inboxes while the same contacts kept getting fresh sequences. Technically they offered an opt-out. In practice they were ignoring it at scale.

The fix is boring and non-negotiable. One suppression system that every domain and every sender checks against before it sends. Not per-mailbox. Not per-domain. Global.

2. Domains and workspaces registered to nobody in particular

Real talk: this is the one that can actually turn criminal, so it's worth slowing down for.

Federal law (18 U.S.C. § 1037) makes it an offense to register five or more email accounts, or two or more domains, using information that materially falsifies who the registrant is, and then send commercial email from them. "Materially falsifies" means the details are altered or hidden enough that a recipient, a provider, or an investigator can't figure out who's actually behind the mail.

Read that against how a modern outbound program is built. Dozens of domains, hundreds of mailboxes. You blow past "two domains" and "five accounts" before lunch on setup day. At that scale, the only thing standing between your program and this statute is that every domain and workspace traces back to a real, identifiable party.

The usual question here is whether WHOIS privacy is a problem. It isn't. A privacy proxy still has a real registrant sitting behind it who can be identified through proper channels. That's legal and normal. What's not fine is registration data that maps to no one. Placeholder names, invented companies, details that dead-end.

This is usually not something the client did on purpose. It comes in through the vendor. A lot of bulk-infrastructure providers provision domains and workspaces under their own generic details instead of the client's, because it's faster on their end. The client thinks they own a clean estate. On paper, a chunk of it is registered to a shrug. If you're buying done-for-you infrastructure, ask exactly whose identity your domains and mailboxes are registered under. It's a fair question, and the answer tells you a lot.

3. Automated provisioning isn't the problem (until it is)

Automated mailbox and domain provisioners are everywhere in outbound now, and using one is not illegal. Let me be clear about that, because the topic attracts a lot of scaremongering.

Two things worth understanding, though.

First, CAN-SPAM treats using scripts or automated means to register for a pile of email accounts as an aggravating factor, one that can triple the damages. But that aggravator only bites when the underlying messages are already unlawful. Automation pointed at a clean program adds nothing to worry about. The multiplier attaches to a violation you already committed. No violation, nothing to multiply.

Second, and this is the real risk, provisioning tools make it effortless to fabricate senders. Spinning up a mailbox for a person who doesn't exist, or who doesn't actually work at your company, used to take enough manual effort that most people didn't bother. Now it's a checkbox. And a fabricated sender is precisely the falsified-registrant problem from the last section. The tool doesn't create the violation. It removes the friction that used to keep people from committing it.

4. The smaller gaps that add up

Plenty of programs get the big structural pieces right and still trip on the basics. The common ones:

• No physical postal address in the message. CAN-SPAM requires a valid one. It gets dropped constantly because a street address or P.O. box feels too "salesy" for a lean cold email. It's still required.
• No indication the message is a solicitation. The waiver that lets you skip the ad disclosure only applies when you have prior affirmative consent, and cold email by definition doesn't. So the message has to make clear, somehow, that it's a pitch.
• Deceptive subject lines. Fake "Re:" or "Fwd:" prefixes, false personalization, bait subjects that don't match the body. All separate violations.
• Misleading "from" lines and header tricks that disguise the real sending system. If your headers hide where the mail actually originates, that's its own problem.
• Bad data sourcing. Purchased or scraped lists, harvesting addresses from sites that prohibit it, and dictionary or permutation attacks (guessing at john@, j.smith@, jsmith@) are aggravated violations on their own. They often get quietly baked into "we'll bring the data" offers, which means you can inherit the violation without ever touching the list yourself.
• Selling or passing along an address after someone opts out. Once they're out, that address isn't yours to move.

What compliant cold outbound actually looks like

None of this is an argument against cold email. It's an argument for building it on a foundation that happens to be legal, which isn't hard once you know what the foundation is. A compliant program has a short, checkable set of properties:

• Every domain and workspace registered to a real, identifiable party. No placeholders, no vendor stand-ins.
• Every sender a real person who actually exists and actually works there. No fabricated mailboxes.
• One global suppression system, honored across every domain and sender, with opt-outs processed inside 10 business days and the opt-out mechanism live for at least 30 days after each send.
• A valid physical postal address in every message.
• Honest subject lines and honest headers that don't disguise who's writing or where the mail comes from.
• Data you're actually allowed to use.

Get those right and the rest stops being a legal question. The automated provisioners, the sending volume, and the domain rotation that makes cold outbound scale are all legally neutral once the fundamentals are in place. You can run a big program. You just can't run a dishonest one.

This is general information about a federal statute, not legal advice, and I'm a deliverability consultant, not your lawyer. For anything specific to your setup, talk to counsel.

If you're not sure which of these your program is quietly getting wrong, that's usually the first thing a deliverability audit surfaces. Happy to look at how your outbound is actually built and where it's exposed.

— Truitt, Formula Inbox