Founders hear two wrong things about cold email: that it is illegal, and that it is a free-for-all. In the United States the truth is narrower and more useful. The FTC's compliance guide for the CAN-SPAM Act says commercial email - "any electronic mail message the primary purpose of which is the commercial advertisement or promotion of a commercial product or service" - is legal if it follows the rules. Here they are, as the FTC lists them, in founder terms.
Two limits before the checklist. CAN-SPAM is the US federal baseline for commercial email. Other countries run stricter regimes - Canada's anti-spam law and European privacy rules generally demand some form of prior consent - and mailbox providers and sending services layer their own acceptable-use policies on top. Treat CAN-SPAM compliance as necessary for US sends, not as blanket permission to email anyone anywhere.
The seven rules
1. Don't use false or misleading header information. Your "From," "To" and routing details must accurately identify who sent the message. 2. Don't use deceptive subject lines. The subject must reflect the content - "quick question" is fine for a real question, not as a trick to open a pitch. 3. Identify the message as an ad. The law gives you flexibility in how; being plainly commercial is the safe reading. 4. Tell recipients where you're located. A valid physical postal address - street, PO box or private mailbox - must appear in the email. 5. Tell recipients how to opt out. A clear, conspicuous way to say stop, easy for an ordinary person to use. 6. Honor opt-out requests promptly. The FTC gives you 10 business days; the mechanism must keep working for at least 30 days after you send, and you can't charge a fee, demand extra personal data, or make people do anything beyond a single reply or a single web page. 7. Monitor what others do on your behalf. Hiring an agency or using a contractor does not transfer responsibility - the FTC is explicit that you can't contract away your legal duty to comply.
What it costs to get wrong
Each separate email in violation is subject to penalties that run into the tens of thousands of dollars, and more than one party - the company whose product is promoted and the company that sends - can be held responsible. For a founder the practical point is simpler than the statute: the rules are ordinary mechanics, not legal overhead. A real sender name, an honest subject, a footer with your address and an unsubscribe link that works cover almost everything.
Two habits that keep you safe
First, keep a suppression list: once someone opts out, their address stays out of every future send, including lists you buy or vendors you rotate through - the FTC also bars selling or transferring opted-out addresses. Second, spot-check your own funnel quarterly by sending yourself the sequence and clicking the opt-out. Compliance that you never test is a hope, not a control.
Cold email still has to earn the reply; the law only sets the floor. But it is a floor you can stand on confidently once the mechanics above are in place.