Get your outbound campaigns reviewed for CAN-SPAM and California B&P § 17529.5 risk before a lawsuit lands: sender identity, domain transparency, opt-out process, suppression records, and campaign-risk review.
If your business runs cold outreach, you sit on the sending side of the same statutes the defense guides in this section are written against. Real estate investors, SaaS founders, marketing and lead-gen agencies, recruiters, and outbound sales teams all send commercial email at volume. The cheapest time to fix a compliance problem is before a recipient, a competitor, or a serial plaintiff turns your campaign into a claim. This page explains what I review and how a written attorney review works.
The two laws that matter most for senders. The federal CAN-SPAM Act (15 U.S.C. § 7704) sets baseline rules for every commercial email: accurate header information, non-deceptive subject lines, identification of the message as an advertisement, a valid physical postal address, a working opt-out, and honoring opt-outs within 10 business days. California Business and Professions Code § 17529.5 goes further and targets deception: falsified, misrepresented, or forged headers, misleading subject lines, and use of a third party's domain or address without authorization, for email sent from California or to a California address. Section 17529.5 carries liquidated damages of $1,000 per offending email or actual damages, whichever is greater.
CAN-SPAM is an opt-out regime. It does not ban cold email outright. The practical question is never "is cold email legal," it is "does this campaign meet the requirements and avoid the deception triggers."
I read your actual sending setup and a representative sample of your campaigns, then write back a focused attorney response. The review covers:
Whether your From:, Reply-To:, and friendly-name clearly identify the real business that initiated the message, as CAN-SPAM § 7704(a)(1) requires.
Whether sending domains transparently connect to your business or read as lookalike, throwaway, or disguised infrastructure that invites a "forged header" allegation.
Whether subject lines accurately describe the message, or imply a prior relationship or reply that never happened (a common § 17529.5 and § 7704(a)(2) trigger).
Whether the message is identifiable as an advertisement or solicitation where required under § 7704(a)(5)(A)(i).
Whether every campaign includes a valid physical postal address, as § 7704(a)(5)(A)(iii) requires.
Whether your opt-out is clear, conspicuous, and functional, and does not condition unsubscribing on a fee or extra information (§ 7704(a)(3)).
Whether you actually honor opt-outs within 10 business days and maintain a suppression list across tools, domains, and sub-vendors (§ 7704(a)(4)).
Volume, targeting of California recipients, use of third-party data, and whether any pattern in your program looks like the cases serial plaintiffs file.
These are the patterns I see most often in cold email programs that later draw a complaint. Each one is a place where a campaign drifts from baseline compliance toward the deception triggers that anti-spam statutes punish:
From: or Reply-To: fields, so a recipient cannot tell who actually sent the message.Anti-spam statutes do not punish you for emailing a stranger. They punish deception about who you are, where the message came from, and what it is. The line between aggressive-but-lawful outreach and an actionable email is almost always about transparency. A message is far more likely to be treated as evasive or misleading when:
A clean cold email does the opposite: it tells the recipient who you are, sends from a domain that plainly belongs to your business, describes the message honestly in the subject line, identifies itself as outreach, includes a physical address, and offers a working opt-out you actually honor.
The single most important thing a sender controls is whether the header fields tell the truth. CAN-SPAM § 7704(a)(1) requires that header information identify the person or business that initiated the message and not be materially false or misleading. California § 17529.5 separately targets falsified, misrepresented, or forged headers and the unauthorized use of a third party's domain. The way you stay on the right side of both is transparency:
From: and Reply-To: honest. A recipient should be able to tell who sent the message and reply to a real address.Opt-out handling is where compliant intentions most often break down operationally, especially once a team runs multiple campaigns across multiple tools and domains. CAN-SPAM requires a clear and conspicuous opt-out mechanism (§ 7704(a)(3)) and that opt-out requests be honored within 10 business days without charging a fee or requiring extra information (§ 7704(a)(4)).
The review is delivered as a written attorney response, not a templated checklist. You send me your sending setup, a representative sample of your campaigns, your opt-out and suppression process, and a short summary of how and to whom you send. I send back:
You work directly with me. There is no intake team, no junior associate, and no handoff.
Send me your sending setup, sample campaigns, and opt-out process. I review it for CAN-SPAM and California § 17529.5 risk and write back with the issues, the priority fixes, and the practical next steps.
Request a Written Review$240 Written Attorney Consultation, returned by email. If your program is larger, or you want a full review of your sending system, domains, vendors, and templates rather than a single campaign, that deeper campaign and system review can be scoped separately starting at the $575 tier.
A single written review is the right starting point for most senders. It is not the right tool for every situation. Consider a deeper engagement, or a different one, when:
If any of these fit, say so when you reach out and I will tell you which path makes sense before any larger work begins.