Guides
UGC creator cold email compliance: CAN-SPAM rules for US pitches
UGC creator cold email compliance: CAN-SPAM requires truthful headers, ad disclosure, an opt-out, a postal address, and timely opt-out handling.
What to take away
- The FTC and the Federal Communications Commission split enforcement of the CAN-SPAM Act, and the FTC's compliance guide explains what a pitch email must contain.
- A compliant cold pitch needs accurate routing information, a subject line that matches the body, clear ad disclosure, a working opt-out, and a valid physical postal address.
- Opt-out requests must be honored within 10 business days, and each separate violating email can carry a civil penalty up to the current statutory maximum.
- CAN-SPAM governs commercial email, not social DMs. Instagram, TikTok and YouTube messages fall outside the statute but inside each platform's terms.
- Canada's CASL is stricter and applies to mail sent to Canadian recipients. This article covers US rules only.
Who has jurisdiction over a cold pitch
The CAN-SPAM Act is a federal statute at 15 U.S.C. §§ 7701–7713, and the full text is published by the Legal Information Institute at Cornell Law. The FTC writes the business-facing guidance, while the FCC handles the rulemaking on commercial email sent to wireless-device email addresses.
That split matters for creators considering email-to-SMS gateways. The FCC's CAN-SPAM wireless rule, 47 C.F.R. § 64.3100, concerns commercial email sent to wireless-device email addresses; it does not make an ordinary text message a CAN-SPAM email. The requirements for text messages are outside this article's focus on cold pitch emails.
For ordinary email, the FTC's CAN-SPAM Act: A Compliance Guide for Business is the document to read before you send anything. It is short, written for business owners, and it lists each requirement separately.
What a compliant pitch email must disclose
The checklist covers four core email elements, but it is not the complete set of CAN-SPAM requirements. A commercial pitch must also clearly and conspicuously disclose that it is an advertisement or solicitation. The sender must honor opt-outs within 10 business days and keep the opt-out mechanism available for at least 30 days after sending.
Four mandatory pitch email elements
- Accurate headerfrom name, reply-to, sending domain
- Subject line reflects body content
- Clear opt-out working for 30 days
- Valid physical postal address in message
For example, a UGC creator emailing a brand's marketing contact to offer a paid product video should use a subject such as “Paid UGC video proposal,” identify the message as a commercial solicitation, use accurate From and reply-to information, include a valid postal address, and provide a working opt-out. The creator must honor any opt-out within 10 business days and keep the opt-out mechanism available for at least 30 days after sending.
The postal address requirement catches freelancers. If you work from a home studio and do not want that address public, a PO box is the usual workaround, and the FTC treats it as valid.
Records to keep
There is no federal retention schedule written specifically for cold email. The practical record set comes from what you would need to prove compliance if a recipient complained.
Cold email compliance records to keep
- Sent message with full headers
- Date, time, and list segment
- Opt-out requests with received and processed dates
- Suppression list showing removals
- Postal address used per campaign
Keep the suppression list permanently. The 10 business day clock restarts every time you send, and a stale list is the most common way a creator sends to someone who already asked to stop.
CAN-SPAM treats each separate email message in violation as a separate violation (15 U.S.C. § 7706(g)(3)). A campaign sent to 500 contacts can therefore expose a sender to as many as 500 violations if each message violates the act.
What happens if you do not comply
The concrete consequence is financial and per-message. The FTC's compliance guide states that violations can carry civil penalties up to a statutory maximum for each separate email, and that ceiling is adjusted periodically for inflation by the FTC and published in the Federal Register.
Per-message penalty exposure
One send to 500 contacts can be 500 violations
FTC treats a single campaign as many separate violations
Civil penalties up to a statutory maximum per email
Ceiling adjusted periodically for inflation
The FTC has brought enforcement actions against small senders, not only bulk mailers. A creator who ignores opt-outs after a complaint is exposed in the same way a marketing agency is.
Beyond penalties, internet service providers run their own filtering. A domain that draws spam complaints gets throttled or blocked, which kills deliverability for the sponsorship invoices and brand correspondence that run through the same address.
Where the rules differ by place
CAN-SPAM is an opt-out regime. You may send first and let the recipient leave. Canada's Anti-Spam Legislation is opt-in: commercial electronic messages to Canadian recipients generally require prior consent, and the penalties are larger.
CAN-SPAM vs CASL vs ePrivacy
CAN-SPAM (US)
- Consent model
- Opt-out
- Send first?
- Yes
- Penalties
- Per email
CASL (Canada)
- Consent model
- Opt-in
- Send first?
- No
- Penalties
- Larger
ePrivacy (EU)
- Consent model
- Opt-in
- Send first?
- No
- Penalties
- Strict
If your pitch list includes Canadian brands or Canadian-based contacts, you are outside the scope of this article and inside a stricter one. The same is true for recipients in the European Union under the ePrivacy Directive.
State law adds another layer. California's anti-spam statute, Cal. Bus. & Prof. Code § 17529, addresses unsolicited commercial email. CAN-SPAM preempts many state email rules but preserves certain state-law claims, including those based on falsity or deception.
