Is Cold Email Legal? CAN-SPAM Rules for Web Designers
If you plan to email local business owners about a website, you may wonder if that is even allowed. Short answer: in the United States, yes, you can send a cold marketing email to a business, if you follow the rules. This guide explains them in plain words, using the Federal Trade Commission's own guidance.
I have run a marketing agency for 15 years and worked with 100+ agency clients. I am not a lawyer, and this is not legal advice. It is a plain-English summary of public rules, so you know what to check before you send.
The law in one paragraph
The main U.S. law is the CAN-SPAM Act. The FTC publishes a guide called the CAN-SPAM Act: A Compliance Guide for Business. The law covers commercial email, which means email whose main purpose is to advertise or promote a product or service. The FTC says the law makes no exception for business-to-business email. So an email to a plumber about your web design service counts.
CAN-SPAM does not ban cold email. It sets rules for how you send it.
The rules, in plain English
The FTC lists eight main requirements. Here they are, with what each means for you.
1. Do not use false or misleading header information
Your "From," "To" and "Reply-To" details must be accurate. They must identify the person or business who sent the message. Use your real name and a real email address that you can receive replies at.
2. Do not use deceptive subject lines
The subject must match what is inside. Do not write "Re: our call" if there was no call. Do not write "Your invoice" when it is a pitch.
3. Identify the message as an ad
You must make clear that the message is an advertisement. The FTC says you must disclose it "clearly and conspicuously." There is no required magic phrase. A simple line such as "This is a marketing message about a website preview" is a plain way to do it. If you are unsure how to do it, ask a lawyer.
4. Tell recipients where you are located
Include a valid physical postal address. The FTC says this can be your current street address, a post office box you have registered with the U.S. Postal Service, or a private mailbox registered with a commercial mail receiving agency. Many solo operators use a registered mailbox so they do not have to publish a home address.
5. Tell recipients how to opt out
Give a clear, easy way to stop future marketing emails from you. A line such as "Reply 'stop' and I will not email you again" works. The FTC says you cannot charge a fee, cannot require more than an email address, and cannot make the person take any step other than sending a reply email or visiting a single web page.
6. Honor opt-out requests promptly
The FTC says you must honor an opt-out request within 10 business days. You also may not sell or transfer the person's email address after they opt out, even as part of a mailing list. The one exception is giving it to a company you hired to help you comply.
My advice: do it the same day. It is easier, and it is kinder.
7. Remember that others can opt out too
The FTC notes that subscribers and members of any list you run can opt out of marketing emails too. If you keep a list of past contacts, honor their requests the same way.
8. Monitor what others do on your behalf
The FTC says you cannot dodge the rules by hiring another company to send for you. You and the company that makes the product are both responsible. If a tool sends emails for you, you are still on the hook. That is one reason I prefer tools where you can read each email before it goes.
What happens if you break the rules
The FTC says the maximum penalty is 53,088 dollars for each separate email that breaks the law. That number can change, so check the FTC guide for the current figure. In practice, the bigger risk for a small operator is a damaged sender reputation: your emails stop reaching inboxes, and your own email provider may suspend your account.
A send checklist you can copy
Before you press send, check each line.
- [ ] My real name is on the email, and the From address is mine.
- [ ] The subject line is honest and matches the email.
- [ ] The email says clearly it is a marketing message.
- [ ] A valid postal address is in the footer.
- [ ] There is an easy opt-out, such as "Reply 'stop'."
- [ ] I have a list of people who opted out, and I will not email them again.
- [ ] I am sending to businesses where I can see a real reason, such as an old or missing website.
- [ ] I have not made promises I cannot keep, like "more customers."
- [ ] I am sending slowly, one at a time, from my own mailbox.
Here is a simple footer you can adapt:
Alex Smith, Smith Web Studio, 100 Example Street, Springfield, ST 00000. This is a marketing message about a website preview I made for your business. Reply "stop" and I will not email you again.
The name and address are made up. Use your real ones.
What this guide does not cover
- Other countries. CAN-SPAM is a U.S. law. Canada, the UK and the EU have different rules, and some are stricter, especially for personal email addresses. If you email outside the U.S., get advice for that place.
- State laws and phone rules. Some states have their own rules. Calling and texting follow different laws.
- Your email provider's rules. Gmail, Outlook and others set their own limits on bulk sending. Breaking them can get your account closed even if you follow the law.
How to keep it good, not just legal
The law sets a floor. Good practice sits above it.
- Send to a small number of well-chosen businesses, not a huge list.
- Make every email about one specific business.
- Stop after two follow-ups. See web design follow-up email.
- Keep a log of every message and every "stop."
- Be honest about what you are offering, and say a preview is a preview.
For the wording of the email itself, read web design cold email. To pick businesses that have a real gap, see how to find businesses with bad websites. For how the whole path works, read how to sell websites to local businesses.
Where SiteRevive fits
SiteRevive takes the owner's email from the business's own website, so you are writing to a real contact and not guessing. With Run with your AI, Claude drafts or sends a short note from your own inbox. You can choose "drafts only" and read each email before you send it.
That does not make you compliant on its own. You are still the sender. You still need your real name, a valid postal address and a working opt-out in every message, and you still must honor "stop" requests. SiteRevive's servers never send email; your own AI sends from your own account, or saves drafts.
SiteRevive plans start at $97 a month, plus your own AI plan. There is no setup fee, and there is a 7-day money-back guarantee, no questions asked. It covers local U.S. businesses only, and it does not promise replies or sales. See the SiteRevive home page for details. If you also plan to build the sites with AI, read how to build websites with Claude.
Frequently asked questions
Is cold email legal in the United States?
Yes, if you follow the CAN-SPAM Act. That means honest sender details and subject line, a clear ad label, a valid postal address, and an opt-out you honor within 10 business days. This is general information, not legal advice.
Does CAN-SPAM apply to emails sent to businesses?
Yes. The FTC says the law makes no exception for business-to-business email.
Do I need to include my address in a cold email?
Yes. You need a valid physical postal address. The FTC says it can be a current street address, a post office box registered with the U.S. Postal Service, or a private mailbox registered with a commercial mail receiving agency.
How fast must I honor an unsubscribe request?
Within 10 business days, according to the FTC. Doing it the same day is better.
Am I responsible if a tool sends the email for me?
Yes. The FTC says you cannot avoid responsibility by hiring another company to send on your behalf. Check what any tool sends in your name.
Do these rules apply outside the U.S.?
No. CAN-SPAM is a U.S. law. Other countries have their own rules, some stricter. SiteRevive covers local U.S. businesses only.