Is cold email legal?

Read this first

This page is general information written by a software company. It is not legal advice, and laws differ by country, state and industry. If you send at scale, work in a regulated field, or have a specific doubt, ask a lawyer who knows email and privacy law. What follows is the plain-language shape of the rules.

United States: CAN-SPAM in plain words

The CAN-SPAM Act sets the rules for commercial email. It does not ban cold email, and it does not require permission before you send the first one. It requires that you:

1. Do not use false or misleading sender names or routing details.
2. Do not use a deceptive subject line.
3. Make clear that the message is an ad if it is one.
4. Include your valid physical postal address.
5. Give a clear way to opt out, and honor opt-outs promptly (the FTC says within 10 business days).
6. Be responsible for what anyone sending on your behalf does.

Penalties apply per message, so a mistake repeated across a big list adds up quickly. The FTC publishes the current figure. Check it rather than relying on a number from an article.

Two things CAN-SPAM does not cover: text messages and automated calls fall under other rules (the TCPA in the US) that generally need prior consent. Do not treat email rules as texting rules.

EU and UK: GDPR and "legitimate interest"

In Europe and the UK, an email address that names a person is personal data, even at work. To use it you need a lawful reason. For B2B outreach, many senders rely on "legitimate interest": you have a real business reason to write, the message is relevant to the person's role, and the person's rights are not overridden. In practice that means:

1. Write only to people in a role that makes your offer relevant.
2. Say who you are and where you found their details.
3. Make it easy to say stop, and stop.
4. Keep a record of what you hold and delete it when asked.

Some countries add their own rules. Germany, for example, is known for being stricter about unsolicited email, and some places treat sole traders and personal addresses differently from companies. If you are writing into Europe in volume, take advice.

Industries with extra rules

Financial advisors, insurance agents, lawyers, healthcare providers and anyone handling regulated data often face rules about solicitation and record-keeping on top of the general ones. If that is you, check with your regulator or compliance contact before you start.

A practical checklist

1. Real sender name and a reply-to you read.
2. Honest subject line.
3. Postal address in every email.
4. A visible way to opt out, honored fast.
5. A suppression list so no one is emailed again after saying stop.
6. Relevance: write to the people who would plausibly want what you sell.

Following these also helps deliverability. Complaints are what get an inbox in trouble, and relevant, easy-to-leave email draws fewer of them. See <A href="/answers/how-to-send-cold-email-without-going-to-spam">how to send cold email without landing in spam</A>.

What Rocketship does, and what stays with you

Rocketship sends from your own Gmail account, turns on one-click unsubscribe by default, and stops sequences when someone replies, books or unsubscribes. It does not add an open-tracking pixel unless you choose to. Legal compliance is still your responsibility: you decide who to write to and what you say, and Rocketship does not give legal advice.

Plans are on the pricing page, and Launch is $24.99 a month with a 7-day free trial, card required. For a more practical walkthrough, see how to get customers without a sales team.