Read this first
This is not legal advice, and we are not lawyers — we are a software studio that had to understand this properly in order to build responsibly. It is a working summary, accurate to the best of our understanding as of August 2026. Statutes are amended, regulators update guidance, and penalty amounts are adjusted. Before you scale outreach, have someone qualified look at what you are actually sending.
Most owners assume cold email law is something that happens to bulk senders. It is not. The rules attach to the message, not to the volume — a single first email from a two-person cleaning company carries the same obligations as a hundred-thousand-address campaign.
The good news is that the requirements are short, mostly common sense, and almost entirely about being findable and easy to get away from. The bad news is that the assumptions people carry around about B2B exemptions and purchased lists are, in the main, wrong.
Which law applies to you
For a North American local service business, two regimes matter. Which one applies is mostly decided by where the recipient is — with one exception that catches Canadian senders out, below the table.
| CAN-SPAM (United States) | CASL (Canada) | |
|---|---|---|
| Basic model | Opt-out. You may send without prior permission, provided the message meets the requirements. | Opt-in. You need consent — express or implied — before the message goes out. |
| Applies to | Commercial email whose primary purpose is advertising or promoting a product or service. | Commercial electronic messages where a computer system in Canada is used to send them or to access them. Sending from Canada is enough on its own. |
| B2B carve-out | None. Business addresses are covered. | None as such, though several implied-consent routes are business-shaped. |
| Enforced by | The FTC, with other agencies and state authorities depending on context. | The CRTC. |
If you send from Canada, read this twice
CASL is not something that only happens to messages arriving in Canada. It catches messages sent from a computer system in Canada, wherever they land. A Canadian cleaning company emailing a prospect in Charlotte is inside CASL.
There is a way out, and it is conditional: the regulations exclude a message the sender reasonably believes will be accessed in a listed country — the United States is on that list — only if the message complies with that country's own anti-spam law. So a Canadian sender who gets the CAN-SPAM footer wrong on a US-bound email does not merely have a CAN-SPAM problem. They lose the carve-out and are back inside CASL as well.
If you email outside North America the picture changes again — the UK and EU operate under a consent-plus-data-protection model that this article does not cover. Do not assume a process built for CAN-SPAM travels.
CAN-SPAM, in practice
CAN-SPAM does not require permission. It requires honesty and an exit. In practice that means every commercial message you send needs all of the following:
- Accurate routing and header information. The From, To, Reply-To, and originating details must identify who actually sent the message. No borrowed domains, no invented sender names.
- A subject line that reflects the content. Curiosity is fine. "Re:" on a message that is not a reply is not.
- Identification that the message is an advertisement. The rule gives you real latitude in how you say it — but not in whether you do. Its only exception is prior affirmative consent, which a cold email by definition does not have. Assume this one applies to you in full.
- A valid physical postal address. Yours, in the message. The FTC accepts your current street address, a post office box you have registered with the Postal Service, or a private mailbox registered with a commercial mail receiving agency. The registration is part of the requirement, not a detail. This is the one small senders skip most often.
- A clear and conspicuous opt-out mechanism that a reader can actually find and use.
- An opt-out path that keeps working for at least 30 days after you send.
- Opt-outs honoured within 10 business days, at no cost and without requiring anything beyond an email address to process.
- An opted-out address becomes untransferable. Once someone has opted out you cannot sell or transfer their address, including as part of a list you hand to somebody else. The only exception is a provider you have hired to help you comply. This one matters if you export lists between tools.
The part that surprises people
Responsibility does not transfer. If you hire an agency, a lead vendor, or a contractor to send on your behalf, the business being promoted can still be held liable for what goes out. "The vendor handled it" is not a defence — which makes knowing what your tools actually do a commercial concern, not just a technical one.
Penalties are assessed per individual email, and the maximum amount is adjusted for inflation, so any specific figure quoted in a blog post ages quickly. Check the FTC's current published figure rather than trusting a number you read somewhere — including this page.
CASL, in practice
Canada inverts the default. Under CASL you need consent before sending, and that consent is either express or implied.
Express consent
Someone actively agreed to receive commercial messages from you — a ticked box, a form, a clear verbal agreement you recorded. It does not expire on its own, and the burden of proving it is on you, which is the practical reason to record when and how you got it.
Implied consent
Several routes exist. The ones that matter for local B2B prospecting:
- Conspicuous publication. Four things have to be true at once. The recipient published the address themselves, or caused it to be published — the statute says "has conspicuously published, or has caused to be conspicuously published", which is a narrower thing than the address being findable. It was published conspicuously. It is not accompanied by a statement saying they do not want unsolicited commercial messages. And your message is relevant to that person's business role, functions or duties. This is the route most local B2B outreach relies on, and the first condition is the one that quietly fails.
- An existing business relationship, such as a purchase or contract within the previous two years.
- An inquiry made to you within the previous six months.
The two conditions that actually fail
Who published it. The test is whether the recipient published the address or caused it to be published. An address taken from a third-party directory, an aggregator, or a listing the business did not put up is not the same thing as an address that business published, however public it looks from the outside.
Relevance to their role. Conspicuous publication is not a licence to email a published address about anything. Pitching commercial landscaping to a facilities manager is plausibly relevant. Pitching the same thing to the address on a dental practice's patient-contact page is a harder argument. If you cannot articulate why this message fits this person's job, the implied-consent basis is weak — and that is exactly the kind of send worth skipping.
What every CASL message must contain
- Who is sending, including on whose behalf if that differs.
- A mailing address, plus one of a phone number, email address, or web address.
- An unsubscribe mechanism that is readily performed, stays valid for at least 60 days, and is actioned without delay — and in any case within 10 business days.
The 60 days is not only about the unsubscribe link. The contact details in the message have to stay valid for at least 60 days too, so rotating a reply address while leaving the unsubscribe URL alive does not get you there.
The maximum administrative monetary penalties under CASL are substantial — up to CAD $1 million for an individual and CAD $10 million for an organisation, per violation. Those are ceilings rather than typical outcomes, but "per violation" is the part that scales badly, and they are a fair signal of how seriously the regime is meant to be taken.
Five things people get wrong
| The assumption | What is actually true |
|---|---|
| "It is B2B, so it is exempt." | Neither regime has a general business-to-business exemption. CASL offers narrow relief where the sender and recipient each act for an organisation, those organisations already have a relationship, and the message concerns the activities of the organisation being written to — all three at once. "It is a work address" is not a basis on its own. |
| "I bought the list, so it is the vendor's problem." | Liability follows the business being promoted. A purchased list also gives you no evidence of consent, which is precisely what CASL asks you to be able to produce. |
| "Scraped it off the web, so it is public." | Publication can support implied consent in Canada — but only if the business itself published the address, it carried no refusal notice, and your message is relevant to their role. And collecting addresses with software without consent is a separate offence in Canada under its privacy legislation, enforced by a different regulator from the one that polices the messages. |
| "Unsubscribe is in the footer, in grey, at 9px." | Both regimes require it to be clear and conspicuous, and readily performed. Technically present but practically hidden is the failure mode regulators look for. |
| "It is one email, not a campaign." | The obligations attach per message. One email needs the same sender identification, postal address, and working opt-out as ten thousand. |
A pre-send checklist
Before the first message of any new outreach run, walk this once. It takes about five minutes and it is the same list whether you are sending five emails or fifty.
0 of 10 checked
Ticks are remembered in this browser only, and never leave it. This is a memory aid, not a compliance certification.
The suppression question is the important one
Of everything on that list, the one most likely to bite a growing business is the last-but-one. Honouring an opt-out is easy once. Honouring it eighteen months later, when the same business shows up in a new search under a slightly different name, is a record-keeping problem — and it is the one worth solving before you have volume rather than after.
How this shapes the tool
Two consequences of the above shape how ZipQuarry is being built, and it is worth being direct about both.
It drafts and stops. Nothing is sent automatically. Every message lands in a review screen where you edit it, regenerate it, or skip the lead entirely. That is partly a quality decision — the judgment in that step is what makes an email worth receiving — and partly the honest structure: the obligations above belong to the sender, and the sender is you. You send from your own mailbox, under your own name, with your own postal address and your own unsubscribe path.
Relevance is a compliance feature, not just a conversion one. The whole design — pick a niche, pick a radius, enrich each business with real context, write an angle specific to that business — happens to be the same work as being able to say why a message fits a recipient's role. A tool that helps you send more generic email to more addresses is helping you into trouble. A tool that makes it obvious when a prospect should be skipped is doing something more useful.
ZipQuarry is in controlled beta while exactly these questions are worked through with early partners rather than assumed. If you want to see where it currently stands, that is what the demo is for.
Again, and it matters
This is a working summary, not legal advice. Use it to ask better questions of someone qualified — particularly if you sell into more than one country, or you are about to increase volume.
Two questions in here are judgment calls rather than facts, and they are the ones worth paying for an hour of someone's time on: whether the addresses your tooling surfaces really were published by the businesses themselves, and whether your first email needs to say in so many words that it is an advertisement.
Prospecting you could explain to a regulator
Book a guided demo and we will run a real local search: what it finds, what it enriches, and the first email it prepares for your review. Nothing sends without you.