October 24, 2026 · LegalBriefsUSA
Who Is Liable for Agency Cold Emails? Usually Both of You, and the Client Cannot Contract It Away
Who is liable for agency cold emails? Usually both of you: under CAN-SPAM, the client that pays an agency to send and the agency that presses send can each be held responsible, at up to $53,088 per violating email. The FTC says it plainly: you cannot contract away your legal responsibility to comply. The contract decides who pays whom afterward, not who regulators or plaintiffs can pursue.
That answer holds across most of the rules an outbound program touches, and the details differ by law. This guide sits in our outbound compliance hub and walks through who carries the risk under CAN-SPAM, California’s anti-spam statute, the TCPA for calls, Canada’s CASL and the GDPR, with every rule checked against the primary text or the court or agency decision itself on 24 October 2026. It is not legal advice.
Key takeaways
- CAN-SPAM treats a client that pays for a send as having “procured” it, which makes the client an initiator and a sender alongside the agency.
- California lets recipients sue anyone who “advertises in” a violating email, at $1,000 per email, and a state appeals court held advertisers strictly liable for affiliates’ sends.
- For cold calls, a seller can be vicariously liable under agency law for a vendor’s TCPA violations, at $500 per call and up to $1,500 if willful.
- Under CASL and the GDPR, the client is normally the party with primary responsibility, and the agency joins it when it acts on its own.
- Indemnities, audit rights and suppression controls do not remove liability. They decide who absorbs it.
Is the client liable if the agency sends the cold emails?
Yes, under CAN-SPAM. The Act defines “initiate” to include procuring a message, and defines “procure” as intentionally paying or providing other consideration to, or inducing, another person to initiate a message on your behalf. A monthly retainer for outbound email is exactly that.
The statute also says “more than one person may be considered to have initiated a message,” and it defines the sender as a person who initiates a message and whose product or service it promotes. Put together, the client is both an initiator and the sender. The agency is an initiator too, because it originates and transmits the message.
The FTC’s compliance guide spells out the practical result: both the company whose product is promoted and the company that actually sends the message may be held legally responsible, and each separate violating email can draw a penalty of up to $53,088. The law makes no exception for business-to-business email. The full list of what each message must contain is in our guide to whether cold email is legal in the US.
Can I be liable if I did not know what the agency was sending?
Under federal law, for one category of violation, yes. Section 7705 makes it unlawful to promote, or allow the promotion of, your business in email with false or misleading transmission information when you knew or should have known in the ordinary course of business, received or expected an economic benefit, and took no reasonable action to prevent or detect it.
“Should have known” is the phrase that matters for agency clients. Not asking how your agency sources lists, which domains it sends from, or what its headers say is not a defense if a regulator decides the answers were knowable. Section 7705 is enforced by the FTC rather than by state attorneys general or internet providers.
California goes further. Its statute has no knowledge requirement for most violations, which is covered in the next section.
Who can actually sue over agency cold emails?
Under CAN-SPAM, not the recipient. Federal enforcement belongs to the FTC and other federal agencies, state attorneys general can sue for up to $250 per email with a $2,000,000 cap on most violations, and the only private plaintiffs are internet access providers adversely affected by the violation.
State law is where individual recipients come in. California Business and Professions Code section 17529.5 lets the Attorney General, an email service provider or a recipient sue anyone who advertises in a commercial email sent from California or to a California address when that email uses a third party’s domain without permission, carries falsified, misrepresented or forged header information, or has a subject line the sender knows is likely to mislead.
The verb is “advertise in,” not “send.” In Hypertouch v. ValueClick on February 10, 2011, the California Court of Appeal held the statute is not preempted by CAN-SPAM and that advertisers are strictly liable for violating emails sent by their affiliates, with no proof required that the advertiser knew the emails went out. Liquidated damages are $1,000 per email, up to $1,000,000 per incident, cut to $100 per email and $100,000 per incident if the defendant shows it implemented, with due care, procedures reasonably designed to prevent such emails.
| Law | Who can be liable | Standard for the client | Who can sue or enforce | Maximum exposure |
|---|---|---|---|---|
| CAN-SPAM, 15 U.S.C. 7702 and 7704 | Client and agency, both as initiators | Paying or inducing the send is enough | FTC, state AGs, internet access providers | Up to $53,088 per email (FTC); $250 per email, $2M cap (state AGs, most violations) |
| CAN-SPAM, 15 U.S.C. 7705 | Business promoted in emails with false transmission information | Knew or should have known, benefited, took no reasonable action | FTC | Federal civil penalties |
| California B&P 17529.5 | Anyone who advertises in the email | Strict liability for affiliate sends (Hypertouch, 2011) | Attorney General, email providers, recipients | $1,000 per email, $1M per incident; $100 and $100,000 with due-care procedures |
| TCPA, 47 U.S.C. 227 (calls) | Caller, and seller through agency law | Actual authority, apparent authority or ratification | Call recipients, FCC, state AGs | $500 per violation, up to 3 times if willful or knowing |
| CASL (Canada) | Anyone who sends, causes or permits, plus principals and officers | Due diligence is a defense | CRTC | $10,000,000 per violation for a business |
| GDPR (EU) | Controller, and processor if it breaches its own duties or instructions | Controller liable for damage from unlawful processing | Data subjects, supervisory authorities | EUR 20M or 4% of worldwide turnover |
Does the same apply when an agency makes cold calls for me?
Largely, and the money is bigger because recipients can sue. In a declaratory ruling released 9 May 2013, the FCC said a seller does not generally “initiate” calls a third-party telemarketer places, but can be vicariously liable for that telemarketer’s TCPA violations under federal common-law agency principles, including formal agency, apparent authority and ratification.
The FCC listed the kind of facts that point to apparent authority: giving the vendor access to information and systems normally within the seller’s exclusive control, letting it enter consumer information into the seller’s sales or customer systems, and authorizing it to use the seller’s trade name and trademarks. A booking agency with a login to your CRM and your calendar is close to that description.
Courts apply the same agency ideas on their own. In United States v. DISH Network, the Seventh Circuit largely affirmed liability in March 2020, but vacated the damages calculation and one substantial-assistance ruling, remanding those issues. It held that contractual language disclaiming agency did not override the actual relationship, including DISH’s right to control the retailers’ work. A principal that knows of violations, does nothing and keeps the gains is liable for them. Since McLaughlin Chiropractic v. McKesson in June 2025, district courts are not bound by the FCC’s reading of the TCPA, but common-law agency doctrine applies regardless of the FCC.
The TCPA pays $500 per violation, or up to three times that for willful or knowing violations, and recipients bring those claims directly.
Who is responsible under CASL and the GDPR?
Under both, the client normally carries primary responsibility, and the agency adds to it rather than replacing it. CASL reaches anyone who sends or causes or permits a message to be sent, and the GDPR puts damage from unlawful processing on the controller, which is usually the client that decides who gets contacted and why.
CASL is broad. Section 9 prohibits aiding, inducing or procuring a violation, section 31 makes officers, directors and agents liable when they directed, authorized or participated in one, and section 32 makes a person liable for violations by an employee in the scope of employment or an agent acting within its authority. Section 33 is the out: a person is not liable if it establishes it exercised due diligence. Penalties run to $10,000,000 per violation for a business. The consent rules themselves are in our guide to CASL cold email rules.
Under the GDPR, Article 82(2) says any controller involved in processing is liable for damage caused by processing that infringes the Regulation, while a processor is liable only where it breached obligations aimed at processors or acted outside or contrary to the controller’s lawful instructions. Article 28(1) requires the controller to use only processors that give sufficient guarantees. Article 28(10) is the agency trap: a processor that determines the purposes and means of processing on its own is treated as a controller for that processing. Article 82(4) makes each party involved liable for the entire damage so the data subject is compensated. Fines for breaching the lawful-basis rules reach EUR 20,000,000 or 4% of worldwide annual turnover. Our guide to whether cold email is legal under GDPR covers the lawful basis question itself.
The UK takes the same line for email marketing. The ICO’s PECR guidance says that if you ask another organisation to send your marketing you may still be responsible as the instigator, and that where you instigate messages another organisation sends, both parties are responsible for complying.
What should the agency contract say about compliance?
It should allocate cost and control, because it cannot allocate legal liability away. The clauses below are the ones that change your real exposure: who indemnifies whom, what you can audit, and what evidence exists if a regulator or plaintiff asks how a contact was sourced.
| Clause | What to ask for | Why it matters |
|---|---|---|
| Compliance warranty | Agency warrants every send meets CAN-SPAM, CASL, PECR and GDPR where they apply | Gives you a breach-of-contract claim; it does not stop a regulator pursuing you |
| Indemnity | Agency indemnifies for fines, damages and defense costs caused by its own sends, with insurance behind it | Shifts the cost, if the agency can pay it |
| Data sourcing record | Source, date and consent basis logged per contact and produced on request | Supports the due diligence defense under CASL section 33 and the controller duty under GDPR Article 28(1) |
| Sending identity | Your business name, a valid postal address and accurate headers on every message; no third-party domains without permission | Avoids the header and domain violations that trigger section 7705 and California 17529.5 |
| Suppression | Opt-outs honored within 10 business days across every domain and inbox, with your master suppression list loaded first | CAN-SPAM requires 10 business days; DISH turned on a failure to keep one do-not-call list across vendors |
| Audit and approval | Right to review copy, lists and sending domains before launch and monthly after | Documents the reasonable action section 7705 asks about |
| Data processing terms | A GDPR Article 28 contract that limits the agency to your documented instructions | Keeps the agency a processor and gives you a claim if it acts outside them |
Watch for the reverse clause too. Some agreements make the client warrant that it owns the program and approved every list and message, which moves the indemnity the other way.
Frequently asked questions
Does an indemnity clause protect me from CAN-SPAM liability?
No. The FTC says you cannot contract away your responsibility to comply. An indemnity lets you recover costs from the agency afterward, and it is worth only as much as the agency’s ability to pay.
Is the agency liable if the client supplied the list?
Often, yes. Under CAN-SPAM the agency is an initiator because it transmits the message, and under CASL it sends or causes the send. Under the GDPR an agency following documented instructions is generally a processor, liable for its own processor duties or for acting outside those instructions.
How LeadButton handles this
LeadButton’s published process includes client approval of the prospect list before sending. Its privacy policy states that it honors opt-out and unsubscribe requests. Before launch, confirm the program’s sending identity, sourcing records, suppression process and country-specific requirements in writing.
Launch is $1,500 a month for email outreach. Growth is $3,500 a month and adds LinkedIn. Scale is custom. Details are on the LeadButton pricing page. We are not lawyers and this is not legal advice; before signing any outbound agreement, an hour with counsel on the indemnity and data terms is well spent.
Sources
- FTC, CAN-SPAM Act: A Compliance Guide for Business, checked 24 October 2026. Both companies may be held responsible, $53,088 per email, no B2B exception, 10 business days.
- 15 U.S.C. 7702, definitions of initiate, procure and sender, Cornell LII, checked 24 October 2026.
- 15 U.S.C. 7705, businesses knowingly promoted by email with false or misleading transmission information, Cornell LII, checked 24 October 2026.
- 15 U.S.C. 7706, enforcement by states and internet access providers, Cornell LII, checked 24 October 2026.
- California Business and Professions Code section 17529.5, checked 24 October 2026.
- Hypertouch, Inc. v. ValueClick, Inc., No. B218603, California Court of Appeal, Second Appellate District, opinion on rehearing filed 10 February 2011, checked 24 October 2026. Holds that CAN-SPAM does not preempt claims under section 17529.5, and that the statute’s civil provisions reach anyone who advertises in a violating email without requiring knowledge or intent. It reversed summary judgment for the defendants and remanded; it did not decide whether they violated the statute.
- 47 U.S.C. 227, Telephone Consumer Protection Act, Cornell LII, checked 24 October 2026.
- FCC, Declaratory Ruling, FCC 13-54, CG Docket No. 11-50, adopted 17 April 2013, released 9 May 2013, checked 24 October 2026. Paragraph 28: a seller that does not itself initiate a call may still be vicariously liable under federal common-law agency principles, including formal agency, apparent authority and ratification, for TCPA violations by third-party telemarketers. Paragraph 46: illustrative examples of evidence that may support apparent authority. An agency ruling, not a court decision.
- United States v. DISH Network L.L.C., 954 F.3d 970 (7th Cir. 2020), No. 17-3111, decided 26 March 2020, checked 24 October 2026. Cited at slip opinion pp. 4–5, 8–9 and 16. Affirmed the judgment except the holding that DISH substantially assisted Star Satellite and the measure of damages, which were vacated and remanded.
- McLaughlin Chiropractic Associates, Inc. v. McKesson Corp., 606 U.S. 146 (2025), decided 20 June 2025, checked 24 October 2026. Holds that the Hobbs Act does not bind district courts in civil enforcement proceedings to an agency’s interpretation of a statute; district courts interpret the TCPA independently, affording appropriate respect to the agency’s interpretation. It is not a holding about vendor liability and does not abolish FCC rules.
- Canada’s Anti-Spam Legislation, S.C. 2010, c. 23, full text, checked 24 October 2026. Sections 6, 9, 20, 31, 32 and 33.
- GDPR Article 28, Article 82 and Article 83, checked 24 October 2026.
- ICO, How do we comply with the PECR electronic mail marketing rules?, checked 24 October 2026.
Leave a Reply