Can you email past customers who never opted in?

In the United States, yes. CAN-SPAM is an opt-out law, and there is no requirement to collect permission before you send a commercial email.

That surprises a lot of owners. It also does not mean anything goes.

One thing to get out of the way first. We sell email marketing to contractors, so we have an obvious interest in you believing this is allowed. That’s a good reason not to take our word for it. Every claim below links to its source, most of them the FTC, the Federal Register, or the Canadian government, and you can check all of them in about ten minutes. If any of it stops holding up, tell us and we’ll fix the page.

The short version

• US federal law does not require permission before you send a commercial email. CAN-SPAM is opt-out.
• It does require honest headers, a real postal address, a working unsubscribe, and opt-outs honored within 10 business days.
• The maximum penalty is $53,088 per email. That figure did not change for 2026.
• Your email software may ask for more than the law does. That’s its terms of service, not the law.
• Canada works the opposite way, and text messaging has its own stricter rules.

Your software said no. That was not the law talking.

A lot of owners who think they can’t email their own customers got that idea from a piece of software.

You go to build a list and half your customers are grayed out, because they never ticked a box that was never in front of them. The tool won’t send to them. So you figure it must be illegal, because why else would the software stop you?

That restriction came from a contract, not from Congress.

It’s easiest to see on the ecommerce side, where the policies are public. Shopify tells its merchants to send promotional content only to customers who have agreed to receive it, and it says that’s “for legal and privacy reasons.” That makes sense for a platform whose sellers live in countries with opt-in laws. It’s still Shopify’s rule, not US law.

On the Etsy community forums, a seller asked whether they could email previous customers about future sales. The answer that came back was that those buyers are Etsy’s customers, not the seller’s, so you contact them about an existing order and nothing else. That’s an accurate description of Etsy’s rules. It has nothing to do with federal law.

Before you assume a restriction came from the federal government, go read your own platform’s terms.

Three different things get treated as one problem. Pull them apart and the picture gets a lot clearer.

Federal law. What CAN-SPAM requires, below. It is less than you think.

Your platform’s rules. Every email tool sets its own conditions, and they vary more than people expect. We run our clients’ email on Klaviyo, so you should hear what it says from us rather than find it later. Klaviyo’s acceptable use policy prohibits sending to lists that haven’t consented to hear from your business. Its help center adds that, depending on your local regulations, you may be permitted to email someone who never subscribed if you believe they have implied consent, while recommending that you only email people who gave express consent. Break a platform’s rules and your account gets restricted. That’s a contract dispute, not a federal case.

A bad idea. Some things are legal and still stupid. Emailing a list you bought from a data broker is the obvious one. Legal in narrow circumstances. Still a terrible way to run a business.

What the law actually requires

Straight from the FTC’s own compliance guide. Seven things:

1. Accurate header information. The From, To, Reply-To and routing have to identify you honestly.
2. A subject line that matches what’s inside.
3. Identification that the message is an ad, where that applies.
4. A valid physical postal address in every email.
5. A clear way to opt out.
6. Opt-outs honored within 10 business days.
7. The opt-out mechanism still working for at least 30 days after you send.

There’s an eighth that people miss. You can’t hand this off. The FTC says both the company whose product is promoted and the company doing the sending can be held responsible, and that you can’t contract away your legal responsibility. Hiring an agency does not transfer the liability, which is worth asking about before you hire one.

The penalty, and a detail almost nobody has

Up to $53,088 per violating email.

Here’s the part that isn’t on most pages you’ll read this year. The FTC adjusts that number for inflation every year, and the formula runs on October consumer price data. The Bureau of Labor Statistics couldn’t produce October 2025 figures because of the government shutdown, so the Office of Management and Budget canceled the 2026 adjustment for every federal agency. The FTC confirmed it in the Federal Register on September 15, 2026: its civil penalty amounts stay at the 2025 levels.

So the figure stands where it was. If you read an article quoting $51,744, it’s running on 2024 numbers.

What the FTC actually goes after

A number like $53,088 per email will scare a contractor into doing nothing, which is the opposite of useful. So look at what enforcement actually looks like.

The largest penalty the FTC has ever obtained for CAN-SPAM violations is the $2.95 million Verkada settlement from August 2024. Verkada sent more than 30 million commercial emails over three years. No unsubscribe option. Opt-outs that weren’t honored. No physical address. The CAN-SPAM counts arrived bundled with data security charges and allegations about reviews posted by its own employees and investors without saying so.

In August 2023, Experian Consumer Services paid $650,000. Its marketing emails told recipients they contained “important information about your account.” The FTC said they were promotions, and they gave people no way to opt out.

See the pattern. Enormous volume, deception, and broken opt-outs.

We went looking for an FTC action against a small business that honestly emailed its own customers with a real From line, a working unsubscribe, and an address in the footer. We searched the FTC’s own press releases and the law firm commentary that tracks these cases, and we didn’t find one.

That isn’t the same as saying none exists. We looked at published cases, not at every settlement ever reached, and we’re not going to claim more than we checked. But the enforcement record points somewhere specific, and it isn’t at the electrician emailing four thousand people they’ve done work for.

So what actually happens if somebody complains?

Worth answering plainly, because this is the fear underneath the question.

A homeowner who doesn’t want your email has two buttons. Unsubscribe, which you honor and that’s the end of it. Or the spam button, which does not summon a regulator. It tells Gmail to trust you a little less.

That second one is the real risk, and it’s a business risk rather than a legal one. Send marketing from the same domain your office uses, collect enough complaints, and the damage doesn’t stay with the campaign. It reaches the quotes and invoices going out on that domain too. Nobody fines you. You just get quieter without knowing why.

The FTC gets involved when there’s a pattern: millions of messages, fake sender names, unsubscribe links that don’t work. Not when one customer is annoyed.

A past customer is not a stranger

The practical test is simple. Would this person recognize your name in their inbox?

Somebody whose panel you replaced would. Somebody whose address you bought would not. That difference is the whole thing, and it’s why buying lists is the actual problem in this industry rather than emailing your own database.

One trap to avoid. Don’t assume every email to an existing customer is automatically a “transactional or relationship” message and therefore exempt from most of the rules. The FTC says so directly: you shouldn’t assume messages to people with an ongoing commercial relationship with you fall in that category. A generic note that it’s time for an annual inspection is promoting a new sale. Treat it as commercial. Put the unsubscribe link and the address on it. Costs you nothing.

If you have Canadian customers, the answer changes

Canada runs the opposite system. CASL is consent-based, and the Canadian government’s guidance spells out the windows. Implied consent from an existing business relationship lasts up to two years. From an inquiry that never turned into a job, six months.

So a Canadian customer whose last paid job was three years ago is off limits without express permission. If you work near the border, that matters. If you don’t, skip it.

If you also text, that’s a different law entirely

Owners run these together and they should not.

Marketing texts generally require prior express written consent under the TCPA. Not opt-out. Written consent, before you send. On top of that, a wave of class actions starting in late 2024 argued that even consented marketing texts break the law when they go out before 8 a.m. or after 9 p.m. It got big enough that an industry group petitioned the FCC to settle the question, and the FCC put the petition out for public comment in March 2025.

Everything above is about email. The permissive answer does not carry over to SMS, which is one reason we don’t do SMS at all.

The thing that will actually cost you

Nobody is coming after you for a compliant email to your own customer.

What will hurt is a first send to four thousand addresses from a domain that’s never been authenticated, with no warmup, generating spam complaints from people who forgot they hired you. That doesn’t produce a federal penalty. It produces a sender reputation that’s slow to rebuild, and it’s the failure we see far more often than a legal one. We wrote that side up in why your contractor emails land in spam.

What we do before a first send

Authentication goes in during week one. SPF, DKIM and DMARC records in your DNS, before anything sends.

The list gets cleaned. Duplicates, dead addresses, typos, people who moved. We fix what’s fixable and quarantine the rest, because sending to bad addresses is what wrecks a reputation. Anyone you flag not to contact stays off. If you’re on Housecall Pro and want to do that part yourself, here’s how to clean the list before your first send.

How the first month runs has the whole build, week by week, if you want the detail.

What this does not mean

It isn’t permission to email anyone whose address you can find. The rules above are about commercial email generally, and they don’t make a purchased list a good idea.

It isn’t legal advice. We run email programs, we’re not attorneys, and a lawyer in your state is the right call if real money is riding on it.

And it doesn’t apply to anyone who already unsubscribed. Once they’re out, they’re out, and putting them back is the one thing in this article that genuinely gets people in trouble.

Questions we get

Is it legal to email past customers in the US?

Yes, as long as the email follows CAN-SPAM. There’s no consent requirement for commercial email under federal law. There are requirements about honesty, an address, and a working opt-out.

Does CAN-SPAM apply to business-to-business email?

Yes. The FTC states the law makes no exception for business-to-business email.

What if my software won’t let me email non-subscribers?

That’s the platform’s policy, not the law. Some tools require opt-in as a condition of use. Your options are to follow their rules or to run email somewhere that works the way you need.

Can I email someone who unsubscribed?

No. Honor it and keep honoring it. This is the one place where the rule is strict and the enforcement record is clear.

Do maintenance reminders count as marketing?

Usually, yes. A reminder that promotes booking new work is a commercial message. Put the unsubscribe and the postal address on it and stop worrying about the distinction.