[{"data":1,"prerenderedAt":126},["ShallowReactive",2],{"lesson-/academy/sdr/cold-email-laws":3},{"path":4,"data":5,"html":61,"toc":62,"prev":75,"next":81,"track":85},"/academy/sdr/cold-email-laws",{"title":6,"description":7,"primaryQuery":8,"secondaryQueries":9,"module":14,"order":15,"tier":16,"intent":17,"asset":18,"publishedAt":21,"author":22,"reviewedAt":23,"relatedTool":24,"challenge":25,"exercise":49,"sources":52},"Cold Email Laws: CAN-SPAM, GDPR, and What You Can Actually Send","Cold email to a business contact is legal in the US without prior permission — CAN-SPAM requires honesty and an easy opt-out, not opt-in. You must use a truthful subject and sender, include a real physical postal address, and honor unsubscribe requests within 10 business days. Emailing someone in the EU or UK adds GDPR duties. This page is a compliance checklist, not legal advice.","cold email laws",[10,11,12,13],"is cold email legal","can spam act cold email","cold email gdpr","is cold emailing legal",5,4,"B","informational",{"type":19,"title":20},"checklist","The cold-email compliance checklist + the required-elements table","2026-09-10","closers","2026-09-24",null,{"type":26,"id":27,"brief":28,"buckets":29,"items":32},"sort","m5-l5-email-compliance-bucket","Eight things you might do when sending cold email. Sort each into 'Compliant' or 'Legal risk'.",[30,31],"Compliant","Legal risk",[33,36,39,42,45,47],{"key":34,"text":35},0,"Send a commercial email to a US recipient with no physical postal address anywhere in it",{"key":37,"text":38},1,"Email a named professional at their work address about a work problem, signed with your real name and company",{"key":40,"text":41},2,"Use a misleading subject line or a fake sender name to get the email opened",{"key":43,"text":44},3,"Send a B2B cold email with a truthful subject and sender, your real physical postal address, and a working unsubscribe link",{"key":15,"text":46},"Email an individual in the EU or UK for marketing without a lawful basis or an easy way for them to object",{"key":14,"text":48},"Remove a recipient who clicked unsubscribe within 10 business days and never email them again",{"prompt":50,"successCriteria":51},"Sort the eight behaviors above into 'compliant' and 'legal risk', then write one sentence naming the two lines you must never cross when cold emailing.","You can name them without hedging: never deceive about who you are or what the email is, and never omit the identifying details (postal address, opt-out) the law requires. GDPR adds a stricter bar only when you email people in the EU/UK.",[53,57],{"label":54,"url":55,"vintage":56},"FTC, CAN-SPAM Act: A Compliance Guide for Business (16 CFR Part 316)","https://www.ftc.gov/business-guidance/resources/can-spam-act-compliance-guide-business","2023",{"label":58,"url":59,"vintage":60},"UK Information Commissioner's Office, direct-marketing guidance under the UK GDPR","https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/direct-marketing/","2024","\u003Cp>Cold emailing a business contact is \u003Cstrong>legal in the US without prior permission\u003C/strong> — the law that governs it, CAN-SPAM, is not an opt-in law. It requires three things: honest sender and subject information, a real physical postal address in the email, and an easy way to opt out that you honor within 10 business days. The common fear that "you can't cold email without consent" comes from confusing email law with phone law — the TCPA's opt-in rules govern robocalls and texts to cell phones, not the kind of one-to-one \u003Ca href=\"/glossary/cold-email/\" target=\"_blank\" rel=\"noopener noreferrer\">cold email\u003C/a> a \u003Ca href=\"/glossary/bdr/\" target=\"_blank\" rel=\"noopener noreferrer\">BDR\u003C/a> sends to a business contact. The rules get stricter the moment you email someone in the EU or UK, where the GDPR applies. This page is a compliance checklist for legitimate outreach — \u003Cstrong>not legal advice\u003C/strong>.\u003C/p>\n\u003Ch2 id=\"the-compliance-checklist\">The compliance checklist\u003C/h2>\n\u003Cp>Here is the asset — run every sending program through it:\u003C/p>\n\u003Cul>\n\u003Cli>[ ] \u003Cstrong>Be honest about who you are.\u003C/strong> A real sender name, a real company, a truthful subject line. No spoofing, no "re:" on a thread that never existed, no invented urgency.\u003C/li>\n\u003Cli>[ ] \u003Cstrong>Include a real physical postal address.\u003C/strong> CAN-SPAM requires it in commercial email to US recipients. A street address (or a valid registered agent's address) satisfies it; a bare P.O. box can be a gray area.\u003C/li>\n\u003Cli>[ ] \u003Cstrong>Make opt-out easy and honor it fast.\u003C/strong> A working unsubscribe link in every commercial email, honored within 10 business days. Keep a suppression list — never email someone who opted out.\u003C/li>\n\u003Cli>[ ] \u003Cstrong>Mark it truthfully.\u003C/strong> If an email is primarily advertising, you can label it — CAN-SPAM says you may, not must. What it forbids is disguising an ad as a personal note or hiding that it's from a business.\u003C/li>\n\u003Cli>[ ] \u003Cstrong>Know when GDPR applies.\u003C/strong> If you email anyone in the EU/UK, their personal data is covered. A legitimate-interests basis for B2B outreach can work, but you must balance it against their rights, identify yourself, and make opting out trivial. This is the layer most US-only guides skip.\u003C/li>\n\u003Cli>[ ] \u003Cstrong>Send like a human at human volume.\u003C/strong> Law isn't the only filter — mailboxes are. A blast that reads as bulk trips \u003Ca href=\"/academy/sdr/cold-email-deliverability/\">deliverability\u003C/a> filters and spam complaints long before any regulator notices.\u003C/li>\n\u003Cli>[ ] \u003Cstrong>When in doubt, ask a lawyer.\u003C/strong> This checklist is not legal advice. If you're scaling outreach or emailing EU/UK contacts, a compliance question is worth a real attorney's answer.\u003C/li>\n\u003C/ul>\n\u003Ch2 id=\"the-required-elements-table\">The required-elements table\u003C/h2>\n\u003Cp>What a compliant US commercial email must carry, in plain English:\u003C/p>\n\u003Ctable>\n\u003Cthead>\n\u003Ctr>\n\u003Cth>Element\u003C/th>\n\u003Cth>Why it's required\u003C/th>\n\u003Cth>What to do\u003C/th>\n\u003C/tr>\n\u003C/thead>\n\u003Ctbody>\n\u003Ctr>\n\u003Ctd>Truthful subject\u003C/td>\n\u003Ctd>CAN-SPAM bans misleading subjects\u003C/td>\n\u003Ctd>Match the subject to the actual email; no deception\u003C/td>\n\u003C/tr>\n\u003Ctr>\n\u003Ctd>Truthful sender\u003C/td>\n\u003Ctd>No fake "from" or forged headers\u003C/td>\n\u003Ctd>Your real name and your company's domain\u003C/td>\n\u003C/tr>\n\u003Ctr>\n\u003Ctd>Physical postal address\u003C/td>\n\u003Ctd>Required in every commercial email\u003C/td>\n\u003Ctd>A real street or registered address in the footer\u003C/td>\n\u003C/tr>\n\u003Ctr>\n\u003Ctd>Working opt-out\u003C/td>\n\u003Ctd>Recipients must be able to stop you\u003C/td>\n\u003Ctd>A clear unsubscribe link, honored within 10 business days\u003C/td>\n\u003C/tr>\n\u003Ctr>\n\u003Ctd>No opt-in needed (US B2B)\u003C/td>\n\u003Ctd>CAN-SPAM is honesty-based, not consent-based\u003C/td>\n\u003Ctd>Research + relevance are your permission\u003C/td>\n\u003C/tr>\n\u003C/tbody>\n\u003C/table>\n\u003Ch2 id=\"where-the-penalties-live\">Where the penalties live\u003C/h2>\n\u003Cp>CAN-SPAM violations carry \u003Cstrong>statutory penalties per separate email\u003C/strong>, and the amounts are adjusted for inflation each year — the FTC's civil-penalty levels now run to tens of thousands of dollars per message. The damage is rarely a fine in practice for a single honest outreach email; it's the pattern — deceptive headers, no address, no opt-out, at scale — that draws enforcement and, more often, gets you blocked and reported into the spam folder. Compliance is a business decision, not a legal nicety, and it compounds with the same habits that make \u003Ca href=\"/academy/sdr/cold-email-template/\">cold email work\u003C/a> in the first place: honesty, specificity, and respect for the reader.\u003C/p>\n\u003Ch2 id=\"send-clean-then-send-often\">Send clean, then send often\u003C/h2>\n\u003Cp>Email law sets the floor, not the ceiling — the ceiling is whether you land in the inbox at all. Keep your outreach on the right side of \u003Ca href=\"/academy/sdr/cold-email-deliverability/\">deliverability\u003C/a>, and remember cold email is one channel in a \u003Ca href=\"/academy/sdr/cold-email-vs-cold-call/\">cold email vs cold call\u003C/a> decision, not the whole of outreach. Send cleanly, and the craft of the email itself — not the law — decides the reply.\u003C/p>\n",[63,66,69,72],{"id":64,"text":65},"the-compliance-checklist","The compliance checklist",{"id":67,"text":68},"the-required-elements-table","The required-elements table",{"id":70,"text":71},"where-the-penalties-live","Where the penalties live",{"id":73,"text":74},"send-clean-then-send-often","Send clean, then send often",{"path":76,"title":77,"description":78,"module":14,"order":43,"kind":79,"practiceCall":24,"core":80},"/academy/sdr/cold-email-follow-up","Cold Email Follow-Up: The 6-Email Sequence That Gets Replies","A cold email follow-up sequence sends 4–6 touches over roughly two to three weeks, each one adding a new reason to reply rather than repeating the ask. This page gives you the full six-email sequence — copy-paste ready — with the timing and the job of each email, plus when to stop.","order",true,{"path":82,"title":83,"description":84,"module":14,"order":14,"kind":79,"practiceCall":24,"core":80},"/academy/sdr/cold-email-deliverability","Cold Email Deliverability for Beginners: SPF, DKIM, DMARC (Why You Land in Spam)","Your cold email lands in spam when the receiving mailbox can't prove it's really from your domain and sees signals of bulk sending. Fixing deliverability means authenticating your email (SPF, DKIM, DMARC), protecting your sending reputation, and sending like a person, not a list. This page is the plain-English setup checklist.",{"slug":86,"title":87,"shortTitle":88,"crumb":89,"path":90,"positioning":91,"totalLessons":92,"modules":93},"sdr","Certified Sales Development Representative (CSDR)","SDR/BDR Certification","SDR Certification","/academy/sdr","The free certification for getting your first sales job — no degree, no experience, no upsell.",58,[94,98,101,105,109,112,115,119,122],{"id":37,"name":95,"lessonCount":96,"description":97},"The Role",6,"What an SDR actually does, whether it’s for you, and the sales career path it opens — 6 core lessons.",{"id":40,"name":99,"lessonCount":43,"description":100},"Getting In With No Experience","Land your first sales job with no experience or degree — a 30-day plan — 3 core lessons.",{"id":43,"name":102,"lessonCount":103,"description":104},"Prospecting and Research",8,"Find the right accounts and contacts to reach — 8 lessons.",{"id":15,"name":106,"lessonCount":107,"description":108},"Cold Calling",11,"Make cold calls without freezing up — 11 core lessons.",{"id":14,"name":110,"lessonCount":103,"description":111},"Cold Email and LinkedIn","Write cold emails and LinkedIn messages that get replies — 8 core lessons.",{"id":96,"name":113,"lessonCount":14,"description":114},"Conversations: Discovery and Qualification","Run discovery calls and qualify real buyers — 5 core lessons.",{"id":116,"name":117,"lessonCount":43,"description":118},7,"The Tool Stack","The tools that run an SDR’s daily workflow — 3 core lessons.",{"id":103,"name":120,"lessonCount":96,"description":121},"Money: Comp, Commission and Quota","SDR salary, OTE, commission and quotas — 6 lessons.",{"id":123,"name":124,"lessonCount":103,"description":125},9,"Getting Hired","Resume, interview answers, offer negotiation, and the certification assessment — 8 lessons.",1792888518517]