Email Marketing Laws for B2B Senders in the US

US email marketing laws rest on the CAN-SPAM Act, which covers every commercial email, including business-to-business messages to lawyers, and requires no consent before the first send. Each message needs truthful headers and subject lines, an advertisement notice, a valid postal address and an opt-out that works for at least 30 days and is honored within 10 business days. Compare that federal baseline with the TCPA for texts and California's privacy law for business contacts. This guide is general information, not legal advice.

Key facts

Federal email law
CAN-SPAM Act, 15 U.S.C. §§ 7701–7713, with the FTC rule at 16 CFR Part 316
B2B exception
None
Opt-out deadline
10 business days after the request
Opt-out mechanism
Works for at least 30 days after the message is sent
Maximum FTC civil penalty
$53,088 per violating email, unchanged for 2026
Texts to mobile numbers
Telephone Consumer Protection Act, 47 U.S.C. § 227

Laws by channel

Which laws regulate email marketing in the US?

The CAN-SPAM Act is the federal law that regulates commercial email, and the Federal Trade Commission enforces it with its rule at 16 CFR Part 316. Marketing texts fall under the Telephone Consumer Protection Act, advertising mail under Title 39 of the US Code, and California residents' personal information under the CCPA.

The FTC's CAN-SPAM compliance guide lists 8 main requirements: no false or misleading header information, no deceptive subject lines, identification of the message as an ad, the sender's location, instructions for opting out, opt-out rights for subscribers and members too, prompt handling of opt-out requests, and monitoring of anyone who sends email on the company's behalf.

State legislatures have less room on email. Under 15 U.S.C. § 7707(b), CAN-SPAM supersedes any state statute that expressly regulates commercial email, except where that statute prohibits falsity or deception, while general state trespass, contract, tort, fraud and computer crime laws keep applying.

Email has the most detailed federal rulebook, and a campaign that also texts and mails the same contacts answers to 3 federal statutes: CAN-SPAM, the TCPA and Title 39.

US laws that govern B2B outreach, by channel
ChannelLawCore rule for sendersCitation
Commercial emailCAN-SPAM ActAccurate headers and subject lines, an advertisement notice, a postal address, and opt-outs honored within 10 business days15 U.S.C. § 7704; 16 CFR Part 316
State commercial email statutesSuperseded in part by CAN-SPAMOnly prohibitions on falsity or deception in commercial email remain enforceable15 U.S.C. § 7707(b)
Texts and calls to mobile numbersTelephone Consumer Protection ActPrior express consent for autodialed or prerecorded calls and texts; written consent when they advertise47 U.S.C. § 227(b); 47 CFR 64.1200(a)
Personal information of California residentsCalifornia Consumer Privacy Act, as amended by the CPRARequests to know, delete, correct and opt out of sale or sharing, including from business contactsCal. Civ. Code §§ 1798.140, 1798.145
Advertising mailTitle 39 postal statutesA notice on bill-like solicitations, no bills for unordered merchandise, and sweepstakes removals within 60 calendar days39 U.S.C. §§ 3001(d), 3009, 3017(d)

State privacy laws

Do state privacy laws apply to B2B email marketing?

California's CCPA applies to B2B email contacts, and Virginia's privacy law excludes them. The CCPA exemption for business-to-business personal information expired on December 31, 2022, so California residents on a prospect list hold full consumer rights. Virginia's statute leaves out people acting in a commercial or employment context.

The California Attorney General describes 3 tests for a covered business: annual gross revenue above the statutory threshold, buying, selling or sharing the personal information of 100,000 or more California residents or households, or deriving 50% or more of annual revenue from selling residents' personal information. The California Privacy Protection Agency raised the revenue threshold from $25,000,000 to $26,625,000 effective January 1, 2025.

A covered business that emails an attorney who resides in California must respond when that person asks to know, delete or correct personal information, or to opt out of its sale or sharing. The Agency's adjusted administrative fines reach $2,663 per violation and $7,988 per intentional violation.

Virginia's Consumer Data Protection Act takes the opposite approach. Va. Code § 59.1-575 defines a consumer as a Virginia resident acting only in an individual or household context and excludes a person acting in a commercial or employment context, so the consumer definition in each state statute decides whether a B2B contact is covered.

Unsubscribes

What does the law require for email opt-outs and unsubscribes?

CAN-SPAM requires a working opt-out in every commercial email and compliance within 10 business days. The reply address or web form must keep accepting requests for at least 30 days after sending, and a sender cannot charge a fee, ask for more than an email address and preferences, or require more than 1 reply or web page.

Section 7704(a)(3) of the Act calls for a functioning return email address or other internet-based mechanism, clearly and conspicuously displayed, and 16 CFR 316.5 sets the limits on what a sender can demand from the person opting out. The FTC allows a menu of message types, provided 1 choice stops all marketing messages, and tells senders to make sure their spam filters do not block incoming opt-out requests.

Once a request arrives, 15 U.S.C. § 7704(a)(4)(A) makes it unlawful for the sender, or anyone sending on its behalf, to email that address more than 10 business days later with a message inside the scope of the request. The same subparagraph bars the sender, and anyone who knows of the request, from selling, leasing, exchanging or transferring the opted-out address for any purpose other than legal compliance. Subparagraph (B) lifts both duties in 1 circumstance: the recipient gives affirmative consent after the opt-out.

These are also the opt-out rules for emailing purchased contacts: the duty follows the sender and the address, not the source of the list, so every later campaign from that sender has to exclude the address.

Mailbox providers set technical rules on top of the statute. Gmail's sender guidelines, in force since February 1, 2024, require anyone sending more than 5,000 messages a day to Gmail accounts to support one-click unsubscribe in marketing messages and to show a visible unsubscribe link in the message body.

B2B cold email

Does CAN-SPAM apply to B2B cold email?

Yes. CAN-SPAM applies to B2B cold email, and the law has no business-to-business exception. The FTC's compliance guide states that the Act covers all commercial messages, not only bulk email, so 1 sales email to a law firm partner carries the same header, notice, address and opt-out duties as a campaign to thousands.

The Act defines a commercial electronic mail message as one whose primary purpose is the commercial advertisement or promotion of a commercial product or service (15 U.S.C. § 7702(2)(A)), and 16 CFR 316.3 sets the criteria for messages that mix commercial and other content. A first-touch email pitching legal software, court reporting or recruiting services to an attorney is promotional, so the CAN-SPAM rules for emailing lawyers are the same rules that apply to any other business audience.

Header lines and routing data must identify the business that initiated the message, and the subject line must not mislead a recipient acting reasonably about the content (15 U.S.C. § 7704(a)(1)–(2)). Section 7704(a)(5)(A) adds 3 items to the message body: clear and conspicuous identification that it is an advertisement, clear and conspicuous notice of the opt-out opportunity, and a valid physical postal address of the sender. The advertisement identifier falls away for a recipient who gave prior affirmative consent, under section 7704(a)(5)(B), while the other 2 items stay. The FTC rule at 16 CFR 316.2 defines the required physical postal address as the sender's current street address, a Post Office box registered with the US Postal Service, or a private mailbox registered with a commercial mail receiving agency.

Address sourcing raises the stakes. Under 15 U.S.C. § 7704(b)(1), an unlawful message becomes an aggravated violation when the sender knew, or knowledge is fairly implied from the objective circumstances, that the recipient's address was taken by automated means from a website that stated it would not transfer addresses, or was generated by combining names, letters or numbers into numerous permutations.

The FTC's compliance guide puts the civil penalty at up to $53,088 for each violating email, the amount set in 16 CFR 1.98(d), and the Commission's notice of September 15, 2026 keeps that 2025 amount for 2026. Before a sequence goes out, compare its first message with cold emailing law firms step by step, which walks through the message structure these rules apply to.

Postal mail

Which laws apply to direct mail marketing?

Direct mail falls under Title 39 of the US Code, not CAN-SPAM. The postal statutes regulate specific kinds of advertising mail: solicitations that look like invoices, unordered merchandise, sweepstakes and sexually oriented advertisements. They give a recipient 3 removal routes: a sweepstakes promoter's list, the Postal Service's list of people refusing sexually oriented advertisements, and a prohibitory order against a specific sender.

Under 39 U.S.C. § 3001(d), a solicitation that reasonably reads as a bill, invoice or statement of account due is nonmailable unless its face carries a conspicuous notice. That notice says the piece is a solicitation for goods or services, not a bill, and that the recipient owes nothing unless it accepts the offer.

Mailing unordered merchandise is an unfair method of competition and an unfair trade practice in violation of 15 U.S.C. § 45(a)(1), under 39 U.S.C. § 3009, which lets the recipient keep the item as a gift and forbids the mailer from sending a bill or dunning letter for it. Free samples marked as such and merchandise mailed by a charitable organization asking for contributions are outside that rule.

Sweepstakes and skill contest promoters must drop a person's name and address within 60 calendar days of a removal request (39 U.S.C. § 3017(d)(2)). Mailers of sexually oriented advertisements must skip anyone who has been on the Postal Service's list for more than 30 days (39 U.S.C. § 3010(b)), and 39 U.S.C. § 3008 lets an addressee obtain a Postal Service order stopping pandering advertisements.

DMAchoice, the mail preference service of the Association of National Advertisers, is industry practice rather than law. Registrants ask for fewer prospect mailings from companies they have no relationship with for a 10-year period, and an account accepts up to 4 additional addresses, including a business address. One suppression list shared by email, phone and mail keeps a removal request from resurfacing in another channel.

Outside the US

How do CASL, PECR and the GDPR treat B2B email?

Canada requires consent for B2B email, the UK exempts corporate subscribers from its email consent rule, and the EU GDPR requires a lawful basis for personal data. Each regime asks more of senders than CAN-SPAM in at least 1 respect, from consent records to a right to object at any time.

Canada's Anti-Spam Legislation (S.C. 2010, c. 23) prohibits sending a commercial electronic message without express or implied consent (section 6(1)); consent is implied when a person conspicuously publishes an email address without a statement refusing unsolicited messages and the message relates to that person's business role (section 10(9)(b)), and an unsubscribe request takes effect within 10 business days (section 11(3)). The UK Information Commissioner's Office explains that the PECR electronic mail rule does not apply to corporate subscribers such as companies and limited liability partnerships, while sole traders and non-limited partnerships in England, Wales and Northern Ireland count as individual subscribers; every message still has to identify the sender and give a valid opt-out address, and the UK GDPR applies to the personal data of a named business contact. In the EU, Article 13 of the ePrivacy Directive sets a prior-consent rule for email marketing to subscribers who are natural persons, GDPR Recital 47 states that processing for direct marketing can be regarded as carried out for a legitimate interest, Article 21(2) and (3) give every person the right to object to direct marketing at any time and end the processing for that purpose, and Article 12(5) requires the controller to act on that objection free of charge.

2026 changes

What changed in email marketing law in 2026?

CAN-SPAM penalties stayed at $53,088 per email in 2026, and California data brokers began processing statewide deletion requests. The FTC announced the unchanged penalty on September 15, 2026. Since August 1, 2026, data brokers must access consumer deletion requests from California's DROP platform at least once every 45 days.

The FTC's Federal Register notice of September 15, 2026 (91 FR 58446) explains that OMB Memorandum M-26-11, issued April 17, 2026, canceled the 2026 civil penalty inflation adjustment because the Bureau of Labor Statistics was unable to produce October 2025 CPI-U data during the government shutdown.

California Civil Code § 1798.99.86(c) requires each data broker to access the Delete Request and Opt-out Platform at least every 45 days, delete the personal information of the consumers who asked, and treat requests it cannot verify as opt-outs of sale or sharing. Section 1798.99.82(d) sets a $200 fine for each deletion request for each day a broker fails to delete.

The UK Information Commissioner's Office has marked its business-to-business marketing guidance as under review because of changes made by the Data (Use and Access) Act.

Related lists and guides

Plan outreach to US lawyers with the fields in view

A free sample of the B2B email list of attorneys shows the columns a campaign works from: firm name, mailing address, direct phone and practice area on every record, with catch-all emails flagged. Samples and quotes go out within 1 hour, Monday to Friday, 9am to 6pm UTC.

Questions

Frequently asked questions

Does CAN-SPAM require consent before sending marketing email?

No. CAN-SPAM lets a business send commercial email without prior consent and requires it to stop within 10 business days of an opt-out. Prior affirmative consent removes the duty to label the message as an advertisement under 15 U.S.C. § 7704(a)(5)(B).

Do transactional emails need an unsubscribe link?

No. Order confirmations, account notices and other transactional or relationship messages are outside the opt-out requirement. Their header and routing information must still be accurate, because 15 U.S.C. § 7704(a)(1) covers transactional messages as well.

Do email marketing laws apply to newsletters?

Yes, when the newsletter promotes a commercial product or service as its primary purpose. That makes it a commercial message under CAN-SPAM, with the same opt-out duty, and 16 CFR 316.3 decides the primary purpose of mixed content.

Who is liable when an agency sends the campaign?

Both companies. The FTC's compliance guide states that the business whose product the email promotes and the company that actually sends it can each be held legally responsible, so outsourcing the sending does not outsource compliance.

Can a state attorney general sue over unlawful commercial email?

Yes. Under 15 U.S.C. § 7706(f), a state attorney general can recover up to $250 per unlawful message, capped at $2,000,000 except for false header violations, and a court can raise the award up to 3 times for willful or aggravated conduct.

Sources

  1. CAN-SPAM Act: A Compliance Guide for Business, Federal Trade Commission, 2023-08. Accessed 2026-09-16.
  2. 15 U.S.C. § 7702 – Definitions, Legal Information Institute, Cornell Law School (US Code text). Accessed 2026-09-16.
  3. 15 U.S.C. § 7704 – Other protection for users of commercial electronic mail, Legal Information Institute, Cornell Law School (US Code text). Accessed 2026-09-16.
  4. 15 U.S.C. § 7706 – Enforcement generally, Legal Information Institute, Cornell Law School (US Code text). Accessed 2026-09-16.
  5. 15 U.S.C. § 7707 – Effect on other laws, Legal Information Institute, Cornell Law School (US Code text). Accessed 2026-09-16.
  6. 16 CFR Part 316 – CAN-SPAM Rule, Legal Information Institute, Cornell Law School (CFR text), 2008-05-21. Accessed 2026-09-16.
  7. 16 CFR § 316.2 – Definitions, Legal Information Institute, Cornell Law School (CFR text). Accessed 2026-09-16.
  8. 16 CFR § 316.5 – Prohibition on charging a fee or imposing other requirements on recipients who wish to opt out, Legal Information Institute, Cornell Law School (CFR text). Accessed 2026-09-16.
  9. 16 CFR § 1.98 – Adjustment of civil monetary penalty amounts, Legal Information Institute, Cornell Law School (CFR text), 2025-01-17. Accessed 2026-09-16.
  10. Civil Penalty Inflation Adjustments (FR Doc. 2026-18853, 91 FR 58446), Federal Trade Commission, Federal Register, 2026-09-15. Accessed 2026-09-16.
  11. 47 U.S.C. § 227 – Restrictions on use of telephone equipment, Legal Information Institute, Cornell Law School (US Code text). Accessed 2026-09-16.
  12. 47 CFR § 64.1200 – Delivery restrictions, Legal Information Institute, Cornell Law School (CFR text). Accessed 2026-09-16.
  13. California Consumer Privacy Act (CCPA), State of California Department of Justice, Office of the Attorney General, 2026-08-28. Accessed 2026-09-16.
  14. Updated Monetary Thresholds in CCPA, California Privacy Protection Agency, 2024-12-17. Accessed 2026-09-16.
  15. Va. Code § 59.1-575 – Definitions, Virginia General Assembly, Legislative Information System. Accessed 2026-09-16.
  16. California Civil Code § 1798.99.86, California Legislative Information. Accessed 2026-09-16.
  17. California Civil Code § 1798.99.82, California Legislative Information, 2026-01-01. Accessed 2026-09-16.
  18. 39 U.S.C. § 3001 – Nonmailable matter, Legal Information Institute, Cornell Law School (US Code text). Accessed 2026-09-16.
  19. 39 U.S.C. § 3008 – Prohibition of pandering advertisements, Legal Information Institute, Cornell Law School (US Code text). Accessed 2026-09-16.
  20. 39 U.S.C. § 3009 – Mailing of unordered merchandise, Legal Information Institute, Cornell Law School (US Code text). Accessed 2026-09-16.
  21. 39 U.S.C. § 3010 – Mailing of sexually oriented advertisements, Legal Information Institute, Cornell Law School (US Code text). Accessed 2026-09-16.
  22. 39 U.S.C. § 3017 – Nonmailable skill contests or sweepstakes matter, Legal Information Institute, Cornell Law School (US Code text). Accessed 2026-09-16.
  23. DMAchoice registration, Association of National Advertisers (ANA). Accessed 2026-09-16.
  24. Email sender guidelines, Google (Gmail Help), 2024-02-01. Accessed 2026-09-16.
  25. Canada's Anti-Spam Legislation, S.C. 2010, c. 23, sections 1–8, Justice Laws Website, Government of Canada. Accessed 2026-09-16.
  26. Canada's Anti-Spam Legislation, S.C. 2010, c. 23, sections 9–15, Justice Laws Website, Government of Canada. Accessed 2026-09-16.
  27. Business-to-business marketing, Information Commissioner's Office (UK). Accessed 2026-09-16.
  28. Regulation (EU) 2016/679 (General Data Protection Regulation), EUR-Lex, Publications Office of the European Union, 2016-04-27. Accessed 2026-09-16.
  29. Directive 2002/58/EC (ePrivacy Directive), EUR-Lex, Publications Office of the European Union, 2002-07-12. Accessed 2026-09-16.