Cold Email Compliance Checklist (CAN-SPAM)

TEMPLATE, NOT LEGAL ADVICE. This is a practical checklist based on the federal CAN-SPAM Act (15 U.S.C. §7701 et seq.) and the FTC's rule (16 C.F.R. Part 316). Laws and penalty amounts change, so confirm current requirements with an attorney. CAN-SPAM covers business-to-business email too, so every cold email to a restaurant owner counts.

Who's responsible: Crumbtrail is both the sender and the business being promoted, so we're responsible for every message, including any sent by a contractor or tool on our behalf. Each violating email can bring a civil penalty of more than $50,000 (the FTC adjusts the amount for inflation each year).

1. Before every campaign

• ☐ Accurate "From" line. Use a real person's name and Crumbtrail, for example "[SENDER NAME] at Crumbtrail" <[email protected]>. Never impersonate the prospect's vendor, a customer, or a platform such as Google or Instagram.
• ☐ Accurate "Reply-To" and routing. Replies must reach a monitored Crumbtrail inbox, and the sending domain must be one we control. [CONFIRM SENDING DOMAIN, e.g. crumbtrailhq.com once set up]
• ☐ Honest subject line. It must match what's inside the email. ✅ "I made a new website for [Restaurant Name] (free to look at)", if a preview really exists. ❌ "Re: your order", "Your Google listing is suspended", a fake "Fwd:", or false urgency.
• ☐ Identify it as an ad. Make it clear and conspicuous that the email is a commercial message. A plain-English pitch ("I run Crumbtrail, and we'd love to build your site…") usually does this. Don't disguise it as a personal or transactional email.
• ☐ Physical mailing address in every email. Use a valid postal address: a street address, a USPS-registered P.O. box, or a private mailbox at a commercial mail receiving agency (for example a UPS Store box). Footer: Crumbtrail · [MAILING ADDRESS]. ⚠️ Don't send any campaign until [MAILING ADDRESS] is filled in.
• ☐ Clear opt-out in every email. Example footer: "Not interested? Reply 'no thanks' or 'unsubscribe' and we won't email you again." Other opt-out methods are fine too, such as an unsubscribe link, but:
• it must be easy to see and understand;
• it must work for at least 30 days after the email is sent;
• it can't require more than a reply email or a single web page visit, no login, and no fee; and
• it can't ask for any information except the email address (and opt-out preferences, if we offer them).
• ☐ Check the suppression list (Section 3) and remove every suppressed address before sending.

2. Honoring opt-outs (within 10 business days, but aim for same day)

• ☐ Treat any "stop," "no thanks," "unsubscribe," "remove me," "not interested," or a clear equivalent as an opt-out, whether it comes by reply, the unsubscribe link, phone, DM, or in person.
• ☐ Add the address to the suppression list within 10 business days at the latest. Our policy: within 1 business day.
• ☐ After an opt-out, don't send any more marketing, including "last follow-up" messages, to that address. One short confirmation ("Done, you won't hear from us again") is OK if it isn't a sales message.
• ☐ Never sell, rent, trade, or share opted-out addresses, except with a vendor that's helping us comply with the opt-out.
• ☐ If the prospect becomes a client, they can still opt out of marketing. Transactional and service emails (receipts, approvals, account notices) can continue.

3. Suppression list

• ☐ Keep one master suppression list at [SUPPRESSION LIST LOCATION, e.g. a shared spreadsheet or CRM field]. Columns: email, business name, date of request, how received, who logged it.
• ☐ Also log bounces (remove hard bounces right away) and spam complaints.
• ☐ Log the whole domain when an owner asks you to stop contacting the business, for example "stop emailing anyone here."
• ☐ Check the list before every send, including manual one-off emails and new lists or tools.
• ☐ Never delete anyone from the suppression list. Keep it permanently.
• ☐ Mirror the suppression list in every sending tool you use, and reconcile it [RECONCILE FREQUENCY, e.g. weekly].

4. List building: do's and don'ts

• ✅ Use business contact details that are publicly posted by the business for business inquiries (its website, Google Business Profile, Instagram bio).
• ✅ Keep a record of where each address came from (column source in the prospect sheet).
• ❌ Don't harvest addresses with scrapers from sites that prohibit it, and don't generate guessed addresses (dictionary attacks). These are "aggravated violations."
• ❌ Don't buy email lists.
• ❌ Don't use hijacked accounts, open relays, or multiple accounts to get around filters or opt-outs.
• ❌ Don't send cold email to personal addresses we got from Diner uploads or giveaway entries. That data belongs to the Shop and is never used for Crumbtrail marketing.

5. Email footer template

[SENDER NAME]
Crumbtrail · Philadelphia, PA
[PHONE] · [email protected] · https://crumbtrailhq.com
[MAILING ADDRESS]

You're getting this because [Restaurant Name] lists this address for business inquiries.
Not interested? Reply "no thanks" or "unsubscribe" and we won't email you again.

6. Deliverability (not CAN-SPAM, but it keeps us out of spam folders)

• ☐ Set up SPF, DKIM, and DMARC on the sending domain before any outreach.
• ☐ Send in small, personal batches (for example [DAILY SEND LIMIT, e.g. 20–30/day]) from a warmed-up inbox. Keep spam complaints well below 0.3%, the threshold that Gmail and Yahoo enforce for bulk senders.
• ☐ If we ever send 5,000+ emails a day to Gmail or Yahoo addresses, we must add a one-click unsubscribe header (RFC 8058) and meet those providers' bulk-sender rules.

7. Other channels and places

• Texts and calls: CAN-SPAM doesn't cover them, and different, stricter laws apply (TCPA, state telemarketing laws). Don't send marketing texts or make robocalls to prospects without prior express written consent. Talk to an attorney first.
• DMs (Instagram/Facebook): follow each platform's rules on unsolicited messages, and honor "no" the same way.
• Outside the U.S.: Canada (CASL) and the EU/UK (GDPR/PECR) require consent before cold commercial email in most cases. Don't cold email prospects outside the U.S. without legal review.
• State laws: most state anti-spam laws are preempted by CAN-SPAM, except rules against false or deceptive messages. Honesty covers them.

8. Pre-send sign-off (copy for each batch)