Yes. In the United States, sending a cold email to a business contact is legal, and you do not need their permission first. What the law asks for is honesty about who you are, a real address, and a working way to say stop. This is general information, not legal advice.

The part people get wrong runs the other way. They hear "B2B is fine" and assume the rules don't apply to them. The FTC's own compliance guide says the law "makes no exception for business-to-business email." Every commercial message is covered, including the two-line note you typed by hand to one plumber. The difference between B2B and consumer email is that neither needs consent in the US. It is not a difference in which rules apply.

The short answer for US B2B cold email

CAN-SPAM is an opt-out law, not an opt-in law. You can write to a stranger at a company, once, about something relevant to their job. You cannot lie about who you are, trick them with the subject line, hide your address, or keep emailing after they ask you to stop.

The penalty is the reason to take it seriously. The FTC guide says each separate email in violation can carry a penalty of up to $53,088 (the figure is adjusted for inflation, so check the current number on the FTC site). Cases that reach that point involve large senders and deliberate deception. A founder sending 20 honest emails a day from their own inbox is not who the FTC goes after. But the rules are cheap to follow, so follow them.

The seven rules, translated for one person sending from Gmail

The FTC lists seven requirements. Here is each one in terms of what you actually do.

  1. Accurate header information. Your From name and address must be really yours. Send as Dana Ortiz from Dana's own address. Don't send as "Support" or from a lookalike domain meant to confuse.
  2. No deceptive subject lines. If the email is about a bookkeeping offer, the subject can't say "Your invoice #4471". "Quick question about your books" is fine if the body asks that question.
  3. Identify the message as an ad. The FTC gives you leeway on how. In a one-to-one email, saying plainly what you are offering does the job: "I'm writing because we do monthly bookkeeping for contractors."
  4. Include your valid physical postal address. A street address, a registered PO box, or a mailbox from a private mailbox service all count. Home-based owners usually use the last two.
  5. Tell people how to opt out. Clearly, in the message. A sentence is enough.
  6. Honor opt-outs promptly. Within 10 business days at most. Section below.
  7. Watch anyone sending on your behalf. If you hire an agency or a freelancer to send for you, you are still responsible for what goes out.

The opt-out rule, and what you cannot ask for

Per the FTC guide, your opt-out method must keep working for at least 30 days after you send, and you have 10 business days to act on a request. Treat 10 days as the legal ceiling and same-day as your rule. A request sitting in your inbox for a week is how someone gets a second email they didn't want, and that second email is the one that becomes a complaint.

You also can't make opting out hard. The guide says you can't charge a fee, ask for any personal information beyond an email address, or make the person do more than send a reply or visit one web page. So "log in to your account to unsubscribe" is out, and so is "tell us why you're leaving first." Once someone opts out, you can't sell or hand on their address.

A link is not required. A sentence that says "reply 'no thanks' and I won't write again" meets the clear-and-conspicuous test for a one-to-one message, as long as you do what it says. Opt-out wording and when a link is the better choice is covered in its own article, and what to send back when someone replies "remove me" is covered in another.

Two habits that make a violation much worse

CAN-SPAM adds extra penalties for what it calls aggravated violations. Two matter for small senders. One is harvesting: scraping addresses off websites with a program that collects them in bulk. The other is a dictionary attack: guessing addresses by trying first.last@company.com, f.last@company.com and so on, then sending to everything that doesn't bounce.

That second one is common because it feels like research. If your whole method for finding an owner's email is guessing patterns and mailing the lot, you are close to it. Find the real address, from the company's own site, a directory, a conversation, or a lookup that shows where the address came from. We cover that in how to find a business owner's email address.

What this does not cover

Everything above is the US federal email law. Four things sit outside it, and a summary is where mistakes start, so here is only where to look.

  • Recipients in Canada, the UK or the EU. Canada's anti-spam law works from consent, with exceptions. The UK and EU treat business email differently depending on whether the address belongs to a company or to an individual such as a sole trader. If your list has these countries on it, filter them out or read the local rules first.
  • Text messages. Marketing texts to a mobile number need the person's consent first under the TCPA. Emailing a lead is not permission to text them.
  • Regulated professions. Financial advisors, insurance agents and lawyers have their own solicitation rules. Check with FINRA or the SEC, your state insurance department, or your state bar.
  • Consumer lists and purchased lists. The email rules are the same, but the risk is higher, because complaints come faster from people who never expected to hear from you.

Legal and still landing in spam

Being within the law doesn't get you into the inbox. Gmail and Yahoo started enforcing sender rules in 2024 for anyone sending in volume (Google defines bulk as about 5,000 messages a day to Gmail addresses): SPF, DKIM and DMARC set up, one-click unsubscribe on marketing mail, and a user-reported spam rate kept below 0.30%. Google's guidance tells senders to aim for under 0.10%.

At 20 or 30 emails a day you are nowhere near the bulk threshold. The filters still learn from your complaints, though, and from how many people mark you as spam. One angry recipient in 30 is about a 3% rate for that day. That is the real reason to keep volume low and the list tight. The setup side is in our SPF, DKIM and DMARC guide.

A one-page checklist for your own Gmail

Before the first send, check each of these. If you can tick them all, you are on solid ground for US business contacts.

  • The From name is your real name, from an address you actually use.
  • The subject line describes what the email is about.
  • The first lines say what you do and why you are writing to this person.
  • Your signature has a physical postal address (a mailbox service is fine).
  • There is a plain opt-out sentence, or a link.
  • You have a do-not-contact list, even if it is a column in a sheet, and you check it before every send.
  • Each address came from a real source and not from a pattern guess.
  • No one in Canada, the UK or the EU is on the list unless you have looked up those rules.

A signature block that covers the middle three:

Dana Ortiz
Ridgeback Bookkeeping, 1480 Alder Street, Suite 6, Tulsa, OK 74103
Not relevant? Reply "no thanks" and I won't write again.

If you let Rocketship do the sending, it goes out from your own Gmail, and when it reads a reply asking to be removed it stops the follow-ups and keeps that address from being contacted again. The signature and address are still yours to write. See how the AI workers handle outreach.

When to ask a lawyer

Ask when the stakes change, not before your first fifty emails. Good triggers: you are in a regulated profession, a large share of your list is outside the US, you bought a list and don't know where it came from, you are about to hire someone to send for you at volume, or you received a letter that mentions a statute. A one-hour consult with someone who handles marketing law costs far less than guessing. If you are still shaping your approach, what separates outreach from spam and sending cold email from Gmail are good next reads, and whether to use your main domain is the next decision you will face.

Knowing the rules is the easy half of cold email. The harder half is finding the right people and following up on time. Rocketship finds the buyers, emails them from your own Gmail, follows up, and books the meeting on its own. Plans that get you customers start at $24.99 a month (Launch), and every monthly plan starts with a 7-day free trial, card required.