Is Cold Email Legal for Hemp and CBD Companies? CAN-SPAM in Plain Terms
By Tyler HempLast updated
Draft: facts marked VERIFY are being checked before publication.
This post is general information, not legal advice. HempLeads is a lead generation company, not a law firm. Check anything that affects your business with a lawyer who knows your state.
Cold email is legal for hemp and CBD companies in the United States. The federal law that governs it, the CAN-SPAM Act of 2003, applies to every commercial email regardless of what the sender sells. It does not require the recipient's permission before you send. It requires honesty, an address, and a way to opt out. Hemp and cannabis companies face extra rules on what they say, not on whether they can send.
Here is the detail behind that answer.
What CAN-SPAM actually requires
CAN-SPAM is enforced by the Federal Trade Commission. It sets seven requirements for any email whose primary purpose is commercial. In plain terms:
- Do not lie in the header. The "From," "Reply-To," and routing information must accurately identify the person or business sending the email. Sending from
sarah@yourcompany-mail.comis fine as long as Sarah works for you and replies reach her. - Do not lie in the subject line. The subject has to reflect what is in the email. "Re: our call" when there was no call is a violation, not a clever tactic.
- Say that it is an ad. The law gives leeway on how, but the email must make clear it is a commercial message. A plain, honest pitch satisfies this; disguising a sales email as a personal note does not.
- Include your physical postal address. A street address, a registered PO Box, or a private mailbox registered with a commercial mail agency. Every email. A one-line footer does it.
- Tell people how to opt out. Every email needs a clear, working way to say "stop." It can be a reply ("reply 'no' and I won't email again") or a link. It cannot be buried or require a login.
- Honor opt-outs within 10 business days. Once someone opts out, you cannot email them again, sell their address, or charge them to process the request. Most tools handle this automatically; confirm yours does.
- Watch what your vendors do. If an agency or contractor sends on your behalf, you are liable for their violations too. Read your contracts.
Penalties are per email. The FTC's inflation-adjusted maximum was over $50,000 per violating message as of 2024 [VERIFY current figure]. Enforcement against small B2B senders is rare, but state attorneys general and ISPs can also bring actions.
B2B versus B2C: the distinction that matters
CAN-SPAM does not have a B2B exemption. A commercial email to a purchasing manager at a dispensary chain is covered the same way as an email to a consumer. The seven rules above apply to both.
The practical difference is in what you are selling and to whom.
B2B hemp email promotes products or services to businesses: bulk biomass to an extractor, packaging to a brand, lab testing to a processor, software to a dispensary. CAN-SPAM and deliverability rules apply; consumer-protection advertising rules mostly do not.
B2C hemp and CBD email sells finished products to consumers. That pulls in the FDA's position on CBD in food and supplements, FTC rules on health claims, and state consumer-protection laws. This is where hemp companies get into trouble, and it is almost never because of the sending. It is because of the claims.
HempLeads only runs B2B campaigns. Our cold email service is built for hemp and cannabis companies selling to other businesses, and the compliance notes below assume that context.
The rules that are specific to hemp and cannabis
CAN-SPAM covers the mechanics. Three other layers cover the content.
Federal: no health or medical claims
The FDA has not approved CBD as a food additive or dietary supplement ingredient, and the FTC has taken action against companies making unsubstantiated health claims about CBD. In a B2B email this rarely comes up, because you are selling volume, purity, lead time, and price, not benefits. Keep it that way. Describe your product by its specification (cannabinoid profile, COA, extraction method, MOQ), never by what it does for a person.
Federal: the 0.3% line
Hemp is federally legal under the 2018 Farm Bill at 0.3% delta-9 THC or less by dry weight [VERIFY: check for any Farm Bill reauthorisation changes to the hemp definition]. Products above that line are marijuana under federal law, and interstate commercial email promoting them is a different risk category. If you sell licensed cannabis products, your outreach should stay inside your state and inside your state's advertising rules.
State: cannabis licensee advertising rules
States with licensed cannabis markets regulate how licensees advertise. Some of those rules reach email. Examples to check, not rely on:
- California: the Department of Cannabis Control's advertising and marketing rules require licence numbers on advertisements and restrict marketing to audiences where a majority may be under 21 [VERIFY current regulation and whether B2B email is treated as an "advertisement"].
- Colorado: Marijuana Enforcement Division rules restrict "unsolicited" advertising by licensees, including electronic messages, unless the recipient has opted in or is a licensed business [VERIFY exact wording and B2B carve-out].
- Washington, Oregon, Michigan, Illinois, and others: each has licensee advertising rules; most focus on consumer-facing ads and minors, but some include email [VERIFY per state].
Two state laws also touch email generally: California's anti-spam statute (Business and Professions Code §17529.5) targets deceptive headers and subject lines, and Washington's Commercial Electronic Mail Act does the same [VERIFY]. Both are consistent with CAN-SPAM. If you follow the seven rules above, you comply with both.
If you hold a state cannabis licence, have your compliance officer read the sequence before it goes out. If you sell hemp without a licence, licensee advertising rules generally do not apply to you, but the recipient's state rules may limit what they can buy.
Legal versus deliverable
Legal and deliverable are different tests. You can write a fully CAN-SPAM-compliant email and have it land in spam every time.
Since February 2024, Gmail and Yahoo require bulk senders to authenticate with SPF, DKIM, and DMARC, offer one-click unsubscribe, and keep reported spam rates under 0.3% [VERIFY thresholds and whether they apply to your volume]. Microsoft announced similar requirements for Outlook.com in 2025 [VERIFY]. These are not laws. They are the price of admission to the inbox.
Hemp companies carry extra deliverability risk because spam filters weight words like "CBD" and "cannabis," and a lot of low-quality hemp mail has already trained them. Separate sending domains, slow warm-up, low daily volume per mailbox, and copy that reads like a person wrote it keep you out of the junk folder. That is a technical problem, and the playbook covers it.
Compliance checklist for hemp B2B cold email
Sender and infrastructure
- Sending from a dedicated outreach domain, not the company's primary domain
- SPF, DKIM, and DMARC pass on every sending domain
- "From" name and address identify a real person at your company
- Replies route to a monitored inbox
Every email
- Subject line matches the content; no fake "Re:" or "Fwd:"
- Reads as a commercial message; no disguised personal notes
- Physical postal address in the footer
- Clear opt-out (reply-to-stop or link) that works without a login
- No health, medical, therapeutic, or THC-effect claims
- Product described by specification and COA, not benefit
List and process
- Recipients are businesses that plausibly buy what you sell
- Opt-outs suppressed across every domain and tool within 10 business days
- Suppression list shared with any agency sending on your behalf
- Agency contract makes them responsible for compliance
- State cannabis licensee rules reviewed if you or the recipient hold a licence
- Sequence reviewed by counsel or a compliance officer before first send
- Spam complaint rate tracked per domain; pause any domain over 0.3%
Done well, cold email is the most predictable channel a hemp B2B company has. The law is not the obstacle. Sloppy sending is.
FAQ
Do I need permission before cold emailing a hemp business?
No. Under the US CAN-SPAM Act, commercial email does not require the recipient's prior consent. The sender must use accurate header and subject information, identify the message as commercial, include a physical postal address, provide a working opt-out, and honor opt-outs within 10 business days. Recipients in the EU, UK, or Canada fall under stricter consent-based laws (GDPR and PECR, CASL) and should be handled separately.
Does CAN-SPAM apply to B2B cold email?
Yes. CAN-SPAM has no business-to-business exemption; it covers any email whose primary purpose is commercial, whether the recipient is a consumer or a purchasing manager. The same seven requirements apply. The difference for hemp companies is that B2B emails describe products by specification and price rather than health benefits, which keeps them clear of FDA and FTC claim rules that apply to consumer marketing.
Can a licensed cannabis company send cold email?
A licensed cannabis company can send cold email under federal CAN-SPAM rules, but state licensee advertising regulations may add restrictions. Some states, including Colorado and California, limit unsolicited electronic advertising by licensees or require licence numbers on marketing [VERIFY]. Licensed operators should keep outreach to other licensed businesses in the same state and have a compliance officer review the sequence before sending.
Reminder: this post is general information, not legal advice. Confirm anything that affects your business with a qualified attorney.