CAN-SPAM cold email rules and GDPR, explained for the people who sign off on outbound
Cold email to businesses is legal in the United States when it follows the CAN-SPAM Act, and it can be lawful in the EU under GDPR when the sender has a sound basis for it. This page explains the rules in plain English for Heads of Sales, founders and agency owners, shows what ColdReach does by default and lists what stays the responsibility of the sender. It is general information, not legal advice.
What the CAN-SPAM Act asks of every commercial email
CAN-SPAM does not require prior consent for commercial email in the United States. It sets rules every message must follow, and it applies to business to business email too.
- Header information is accurate. The from name, from address, reply-to and routing identify the real sender.
- The subject line is not deceptive. It reflects what the message is about.
- The message is identifiable as commercial in nature.
- The email includes the sender's valid physical postal address.
- The email tells the recipient how to opt out, and the opt-out works.
- Opt-out requests are honored within 10 business days, and the address is not sold or transferred afterwards.
- The company whose product is promoted stays responsible, even when an agency or a tool sends for it.
What a violation can cost
Each separate email that breaks the rules can lead to its own civil penalty, so a single bad campaign multiplies the risk. That is why we turn the safe defaults on for every account instead of selling them as an add-on.
Built-in safeguards on every plan
- Every email carries an unsubscribe link. There is no setting to remove it.
- An unsubscribe suppresses the contact at once, across every sequence and every connected mailbox, well inside the 10 business day window.
- Replies the AI classifies as unsubscribe requests suppress the contact automatically.
- Suppression lists can be imported as CSV and are checked before every send.
- Emails go out from your own connected mailboxes, so headers show your real identity. ColdReach never sends from its own mail servers.
- Sending ramps up gradually, respects a daily cap per mailbox and pauses a mailbox when bounces or complaints rise.
- By default a person approves AI-written emails before the first send, so no message goes out unreviewed.
Where the data comes from
Prospect data comes from lawful sources: public company websites, public business registries and licensed business data partners. Every record shows its source and last-checked date in the app, so you can answer the question "where did you get my address" with a fact. Read more on our b2b contact database page.
Your responsibilities as the sender
ColdReach gives you the tools. Some duties belong to the company that sends the email, and no software can take them over.
- Add your valid physical postal address in your signature settings. ColdReach places it in your emails, and the address has to be yours.
- Write subject lines that match the content of the email, and review AI drafts with that in mind.
- Send only to business contacts with a relevant reason to hear from you. Our Terms and Acceptable Use forbid purchased lists of non-business addresses and deceptive subject lines, and abuse leads to account suspension.
- Keep your own records of why you contact each segment.
- Follow the local rules of every country you send to.
Legitimate interest and the sender's assessment
For contacts in the EU, business cold email usually relies on legitimate interest. The sender needs to assess and document that interest, weigh it against the rights of the person, and keep the message relevant to their role. That assessment is the sender's responsibility. Some EU countries also have national rules on electronic marketing to business addresses, so check the rules where your recipients are.
How ColdReach supports GDPR work
- Data subject access requests and deletion requests are supported, and a deleted contact stays suppressed.
- Opt-out and suppression lists apply across all sequences.
- Contacts in the EU are handled with stricter defaults.
- Every record carries its source and last-checked date, which helps you answer a request accurately.
Our cold email software security page explains how we protect the data itself.
Pre-send checks for your team
- Your physical postal address is set in signature settings.
- Your suppression list is imported and up to date.
- Subject lines describe the email honestly.
- Addresses are verified by the email verifier before they enter a sequence.
- Mailboxes have SPF, DKIM and DMARC in place, see email deliverability.
- For EU segments, your legitimate interest assessment is written down.
For a longer version, read CAN-SPAM and GDPR for cold email, a practical checklist.
Questions
Is cold email legal in the United States
Yes, when it follows the CAN-SPAM Act. The law does not require prior consent for commercial email, but every message needs accurate headers, an honest subject line, the sender's physical postal address and a working opt-out.
Does ColdReach give legal advice
No. This page is general information. For decisions about your own campaigns, talk to a lawyer who knows the rules in the countries you send to.
Who supplies the physical postal address
You do. Add your valid physical postal address in your signature settings, and ColdReach includes it in your emails.
How fast does an unsubscribe take effect
At once. The contact is suppressed across every sequence and mailbox in your account as soon as the request arrives.
Start outbound with safe defaults
Create your account and every safeguard on this page is on from the first send. Compare plans on cold email software pricing.