Nerdy Joeby Koldify

Cold Email in the USA: CAN-SPAM, State Privacy Laws and B2B Lead Generation

Some links on this page are affiliate links. If you sign up through them, we may earn a commission at no extra cost to you. How we make money

B2B cold email into the USA is legal without prior consent, as long as every message follows the federal CAN-SPAM Act and you respect the state privacy laws that now reach business contacts. The harder parts are practical: a huge, competitive market, four main time zones and buyers who get a lot of cold email. Koldify runs done-for-you cold email campaigns for companies selling into the US, and this page explains the rules and the playbook.

Yes. The US is an opt-out market: you may send a commercial email to someone who has not agreed to receive it, but you must follow the rules in every message and stop when they ask. The Federal Trade Commission (FTC) enforces the CAN-SPAM Act and publishes a compliance guide for business.

This section summarizes the FTC's guidance and the relevant statutes. It is not legal advice, and a lawyer should review any large or unusual program.

CAN-SPAM covers B2B email

A common myth is that business email is exempt. The FTC's guide is direct: "The law makes no exception for business-to-business email." A cold email to a director's work address is a commercial message and must comply.

What counts is the message's primary purpose. If the content advertises or promotes a product or service, it is commercial. Pure transactional or relationship messages, such as an order confirmation, have fewer obligations, but a cold sales email is never one of those.

The requirements in plain terms

The FTC lists these core rules:

Requirement What it means for a cold email
Honest header information The "From," "To," "Reply-To" and routing must be accurate and identify the business that sent it.
Honest subject line The subject must reflect the content of the message. No fake "Re:" threads or invented meeting confirmations.
Identify it as an ad You must clearly and conspicuously disclose that the message is an advertisement. The FTC allows flexibility in how.
Say where you are Include a valid physical postal address (a street address, a registered post office box or a registered private mailbox).
Explain how to opt out Give a clear, easy way to stop future marketing emails.
Honor opt-outs quickly Process requests within 10 business days, and keep the opt-out working for at least 30 days after you send.
Monitor others Hiring an agency does not transfer your responsibility. The FTC says you "can't contract away your legal responsibility."

The FTC also says you cannot charge a fee, demand personal information beyond an email address, or make people do more than reply to an email or visit one web page to opt out. You also cannot sell or transfer the addresses of people who opted out.

Penalties

Each separate email in violation can carry a penalty of up to $53,088. That figure dates from the January 2025 inflation adjustment, and in September 2026 the FTC announced it would keep 2025 penalty levels for 2026 because the 2026 adjustment was cancelled.

The statute also treats certain practices as aggravating, including harvesting addresses from websites and generating addresses through dictionary attacks. If your list provider cannot explain where its data comes from, that is a legal risk as well as a deliverability one.

Do state anti-spam laws apply?

Mostly not to the email itself. CAN-SPAM supersedes state laws that specifically regulate commercial email, with an exception for state rules that prohibit falsity or deception. Honest, clearly identified emails sit comfortably under the federal rules.

State privacy laws and B2B data

State privacy laws are a different question, because they regulate the personal data on your list, not the email.

  • California. The CCPA, as amended by the CPRA, had temporary exemptions for business-to-business and employee data. Those exemptions expired on January 1, 2023. A business that meets the CCPA's thresholds now owes California business contacts the same rights as consumers, including privacy notices and the right to opt out of the sale of their data.
  • Virginia and similar states. Virginia's Consumer Data Protection Act defines a consumer as a resident "acting only in an individual or household context" and excludes anyone "acting in a commercial or employment context." Several other state laws follow this model, so B2B contact data is largely outside them, but check each state that matters to you.

In practice: keep a public privacy policy, honor deletion and do-not-contact requests from anyone, and know where your data came from. If you buy data, ask your vendor how it handles California opt-out requests.

What's different about selling into the USA

Market size and competition

The US is the largest B2B market most companies will ever sell into. The SBA Office of Advocacy's 2026 FAQ counts 36,207,130 small businesses, 99.9% of all US businesses, employing 62.3 million people.

Size cuts both ways. US decision makers, especially in software, marketing and finance, receive a steady stream of cold outreach, so generic emails disappear. Tight targeting and a specific reason for writing matter more here than anywhere.

Tone and titles

American buyers generally accept a direct, short email that gets to the point in the first two lines. Overly formal openings read as filler.

Titles are more specialized than in smaller markets. A 200-person US company may have a VP of Revenue Operations, a Director of Demand Generation and a Head of Sales Enablement, each owning a different problem. Map your offer to the person who owns the problem, not just the most senior title.

Time zones and sending windows

The Department of Transportation lists nine US time zones including territories: Atlantic, Eastern, Central, Mountain, Pacific, Alaska, Hawaii-Aleutian, Samoa and Chamorro. Hawaii and most of Arizona do not observe daylight saving time, so their offset from the East Coast changes twice a year.

Our practical advice (not a study): segment campaigns by time zone and schedule sends for the prospect's local business morning. A single batch sent at 9:00 Eastern lands at 6:00 in California, buried under everything that arrives overnight.

Holidays

In 2026, federal holidays include Memorial Day (May 25), Juneteenth (June 19), Independence Day (observed Friday, July 3), Labor Day (September 7), Thanksgiving (November 26) and Christmas Day (December 25), per OPM. Many private companies also slow down the week of Thanksgiving and the last two weeks of December. Pause or lighten sends around those dates and plan a strong restart in early January.

Data coverage and inbox providers

Apollo is a US company, and the US is where sales databases generally give you the most contacts to choose from. Data still decays as people change jobs, so verify every list and watch bounce rates on the first sends.

Most US B2B prospects sit on Google Workspace or Microsoft 365, and both filter aggressively. Google's sender guidelines require bulk senders to set up SPF, DKIM and DMARC, and tell all senders to keep user-reported spam rates below 0.1% and never reach 0.3%. Authentication and low complaint rates are the minimum.

Want a second opinion? If your US campaigns are getting opens but no replies, or replies but no meetings, book a 30-minute call with David at Koldify to look at your targeting, offer and setup.

How we run cold email into the USA

Koldify's core process applies everywhere, with US-specific choices built in.

  1. Our infrastructure, not your domain. We own and operate our sending infrastructure and send from separate domains, never your main domain. Inboxes warm up for about three weeks, and campaigns typically launch around week four.
  2. Narrow segments. Because the US is so large, we build lists with you around tight segments (industry, size, title, region, trigger) instead of one national list.
  3. Offer and copy approved by you. You approve the list, offer and copy before launch.
  4. CAN-SPAM footer on every email. Each message carries your business name, a valid postal address, an advertising disclosure and a simple opt-out that is honored quickly.
  5. Time-zone scheduling. Sends go out in each prospect's local business hours, with US holidays blocked.
  6. Replies routed to you. Interested replies go straight to your team for the conversation, booking and closing.

Engagements are month-to-month with no long-term contract, and you can book a call with David at Koldify to scope a US campaign. See what's included on our cold email services page, or read how a cold email agency works week by week.

Sample cold email for a US prospect

Subject: Question about [Company]'s new Dallas location

Hi [First name],

Congrats on opening the Dallas office last month. Expansions like that usually mean the field team doubles before the scheduling process catches up.

We help multi-location service companies cut no-shows with automated reminders that sync with [their scheduling tool]. [Similar company] used it during their own expansion.

Worth a quick call next week to see if it fits?

[Your name]
[Title], [Your company]

This is a commercial message from [Your company].
[Your company], [Street address or registered PO box], [City], [State] [ZIP]
Not relevant? Reply "no thanks" or opt out here: [opt-out link]

Keep the subject line literal, because CAN-SPAM requires it to reflect the content. Run drafts through our spam word checker before launch.

Proof

These figures cover Koldify's work across all markets. They are not specific to the US.

  • 10M+ cold emails sent, 50K+ leads generated, $10M+ in pipeline and $2M+ in revenue generated for clients.
  • Vidsec: 160+ ready-to-buy leads in 2 months and $12,000+ closed.
  • Black Stone Funding Group: 120+ leads in 60 days.
  • Skrapper: 140+ interested leads.
  • Koldify's own outbound: about 500 leads from about 250,000 sends in 3 weeks.

David Tile, who takes the intro calls, is a partner at Koldify. Nerdy Joe is a certified Apollo.io Managed Services Partner and a PlusVibe Certified Silver Partner. To compare other providers, see our list of lead generation companies in the US.

DIY instead?

Many US teams run cold email in-house. Some tool links here are affiliate links (disclosure).

  • Data: Apollo pairs a large contact database with email verification. As of October 2026, third-party sources list the Basic plan at $49 per user per month on annual billing, with a free plan.
  • Sending and warmup: Instantly starts at $47 a month on Growth (5,000 emails), Smartlead at $39 a month on Base (6,000 sends) and PlusVibe at $37 a month on Personal (25,000 emails), all as of October 2026.
  • Domains and inboxes: Smartlead lists fresh Google inboxes at $4.50 a month with domains at $13 a year, and PlusVibe lists done-for-you Google Workspace inboxes at $4 an inbox per month (both as of October 2026).

Use our cold email cost calculator to estimate what your volume will cost. Expanding north as well? Our cold email Canada guide explains why CASL needs a different approach.

Talk to us about the US market

CAN-SPAM makes US cold email legal; it does not make it easy. If you want a team to run infrastructure, lists and copy while your people handle the conversations, book an intro call with David at Koldify.

Other markets we cover

How to set up a cold email campaign: the tools you'll need

Some tool links here are affiliate links (disclosure). Prices are as of October 2026.

  1. Get your data (who you'll email). Build your list in Apollo by title, industry, company size and location, then export contacts with verified emails. Nerdy Joe is a certified Apollo Managed Services Partner.
  2. Buy 2 to 3 sending domains. Never send cold email from your main domain. Use lookalikes (for example, getyourbrand.com). The simplest route is buying them inside your sending tool: Instantly sells done-for-you domains (about $15 a year), Smartlead sells them through SmartSenders, and PlusVibe offers a done-for-you setup. Before you buy, check whether domains bought in a tool can be moved out later; some Instantly users report they can't.
  3. Create 2 to 3 inboxes per domain. Google Workspace or Microsoft 365 inboxes, not one big inbox. Instantly sells done-for-you Google inboxes (about $5 a month, or $10 pre-warmed), Smartlead sells pre-warmed Google and Outlook inboxes (about $9 a month), and PlusVibe can set them up for you. Done-for-you setups configure SPF, DKIM and DMARC for you.
  4. Warm up for about 3 weeks. Warmup is built into Instantly, Smartlead and PlusVibe. Keep it running after launch.
  5. Write and check your sequence. Three to five short emails. Run each one through our free Spam Word Checker.
  6. Launch slowly. Start at about 20 to 30 emails per inbox per day in Instantly, Smartlead or PlusVibe, and watch bounces and replies. Use our Cold Email Cost Calculator to size domains, inboxes and spend.

Rather not run it yourself? Koldify, the done-for-you cold email agency where David Tile is a partner, builds and runs all of this on infrastructure it owns. Book a 30-minute call with David.

Sources

  • Federal Trade Commission, CAN-SPAM Act: A Compliance Guide for Business: https://www.ftc.gov/business-guidance/resources/can-spam-act-compliance-guide-business
  • 16 C.F.R. 1.98, Adjustment of civil monetary penalty amounts: https://www.federal-regs.com/title/16/part-1/1.98/
  • Federal Trade Commission, notice that 2026 civil penalty amounts will not be adjusted (Federal Register, Sept. 15, 2026): https://public-inspection.federalregister.gov/2026-18853.pdf
  • 15 U.S.C. 7704, Other protections for users of commercial electronic mail (Cornell LII): https://www.law.cornell.edu/uscode/text/15/7704
  • 15 U.S.C. 7707, Effect on other laws (Cornell LII): https://www.law.cornell.edu/uscode/text/15/7707
  • Foley & Lardner, CCPA Business-to-Business and Employment Information Exceptions Ending (Sept. 2022): https://www.foley.com/en/insights/publications/2022/09/ccpa-b2b-employment-information-exceptions-ending
  • Code of Virginia, 59.1-575 Definitions: https://law.lis.virginia.gov/vacode/title59.1/chapter53/section59.1-575/
  • SBA Office of Advocacy, Frequently Asked Questions About Small Business 2026: https://advocacy.sba.gov/2026/02/03/frequently-asked-questions-about-small-business-2026/
  • US Department of Transportation, Uniform Time: https://www.transportation.gov/regulations/time-act
  • US Department of Transportation, Daylight Saving Time: https://www.transportation.gov/regulations/daylight-saving-time
  • US Office of Personnel Management, Federal Holidays: https://www.opm.gov/policy-data-oversight/pay-leave/federal-holidays/
  • Google, Email sender guidelines FAQ: https://support.google.com/mail/answer/14229414?hl=en
  • Koldify, results and client case studies: https://koldify.io
  • Apollo pricing, as reported by Saleshandy (Sept 2026) and Valley (Oct 2026): https://www.saleshandy.com/blog/apolloio-pricing/ and https://www.joinvalley.co/blog/apollo-pricing-and-credits-explained-2026
  • Instantly, Plans overview: https://help.instantly.ai/en/articles/10273259-instantly-plans-overview
  • Smartlead, Pricing: https://www.smartlead.ai/pricing
  • PlusVibe, Pricing: https://plusvibe.ai/pricing

Frequently asked questions

Is cold email legal in the USA?

Yes. The federal CAN-SPAM Act does not require prior consent for commercial email, but every message must follow its rules: honest headers and subject lines, a clear disclosure that it is an advertisement, a valid physical postal address and a working opt-out honored within 10 business days.

Does CAN-SPAM apply to B2B emails?

Yes. The FTC states that the law makes no exception for business-to-business email, so a cold email to a work address must meet the same requirements as one sent to a consumer.

What is the fine for violating CAN-SPAM?

Each separate email in violation can carry a civil penalty of up to $53,088. The FTC kept its 2025 penalty levels in place for 2026 because the scheduled inflation adjustment was cancelled.

Do state privacy laws like the CCPA apply to B2B cold email?

California's law does: its temporary exemption for business-to-business data expired on January 1, 2023, so covered businesses owe California business contacts the same privacy rights as consumers. Several other state laws, including Virginia's, exclude people acting in a commercial or employment context.

Can US states have their own anti-spam rules?

Mostly no. CAN-SPAM supersedes state laws that specifically regulate commercial email, except for state rules that prohibit falsity or deception in commercial messages.

What time should I send cold emails to US prospects?

There is no single answer because the US spans several time zones. Schedule by each prospect's local time and treat Eastern, Central, Mountain and Pacific as separate sending windows rather than blasting one batch for the whole country.