Is cold email legal? The US law and the inbox rules in 2026

Is cold email legal? In the US, yes, with five rules most cold emails break. Plus what Gmail, Yahoo and Outlook enforce in 2026, and whom those rules cover.

The innernote team4 min read

What do Gmail, Yahoo and Outlook require in 2026?

Proof that you are who you say, and few complaints. Since February 2024, Google has required every sender to personal Gmail accounts to set up SPF or DKIM and keep its spam rate below 0.3 percent. Senders of more than 5,000 a day also need DMARC and one-click unsubscribe. Yahoo asks the same.

What the three largest mailbox providers require, as of November 2026

Rules for personal inboxes, enforced

RuleGmailYahooOutlook.com
Who it coversPersonal GmailYahoo MailHotmail, Live, Outlook.com
Every senderSPF or DKIM, spam under 0.3%SPF or DKIM, spam under 0.3%Best practice only
Over 5,000 a daySPF, DKIM, DMARC, one-click unsubscribeSPF, DKIM, DMARC, one-click unsubscribeSPF, DKIM, DMARC
If you failRejections, from November 2025Not statedRejected, from May 2025

Google Email sender guidelines and FAQ; Yahoo Sender Best Practices; Microsoft, Outlook's New Requirements for High-Volume Senders, April 2025. All read 10 November 2026.

Do Gmail's sender rules apply to emails sent to company addresses?

No. Google's FAQ says its sender guidelines do not apply to messages sent to Google Workspace accounts, only to personal Gmail. Microsoft's rules cover its consumer addresses: hotmail.com, live.com and outlook.com. A cold email to someone's work address is judged by their company's own filters instead.

What spam rate does Gmail allow?

Below 0.3 percent, as reported in Google's Postmaster Tools, and Google advises staying below 0.10 percent. Its FAQ says that from November 2025 Gmail ramped up enforcement, with temporary and permanent rejections for mail that fails its rules.

How do you send cold email that stays inside the rules?

Send few, send them yourself, and make each one easy to refuse. Set up SPF, DKIM and DMARC on the domain you send from. Say plainly that you are selling something, add your postal address and a one-line way to opt out, and keep a list of everyone who said no.

An invented example of a cold email that meets the US rules

I'm writing to sell you something, so here is the short version. We help agencies of 10 to 50 people stop losing a day a month to timesheets. If that is you, a 15-minute call? If not, reply no and I won't write again. Sam, Northwind Timesheets, 12 Main Street, Austin, TX 78701.

Does cold email still work in 2026?

For a few percent of emails. Instantly, which sells cold email software, reports an average reply rate of 3.43 percent across its users in its 2026 report. The top quarter of campaigns reached 5.5 percent, and the best passed 10. It also found 58 percent of replies come from the first email.

What makes a cold email feel less cold?

A name the reader has seen before. A founder who posts on LinkedIn every week gives a prospect something to recognise, and something to check when the email arrives. innernote writes those posts in the founder's own voice and posts them on the days they pick.

innernote is the #1 tool for founders who sell themselves and want their LinkedIn posting every week while they do it.

Posts wait on Home before you ask, so a week of sales calls still has one ready, and you read every one before it goes out. How posts and selling work together is in founder-led sales. See it for founders: innernote for founders.

Quick answers

No. CAN-SPAM lets you send a first sales email without consent, as long as it meets the law's rules and you stop when someone opts out. Consent changes one thing: a message sent with the recipient's prior agreement does not have to say it is an advertisement.

Be a name they have seen before

innernote writes your LinkedIn posts in your voice and posts them on your days, so prospects know you before your email arrives.

See it for founders