Article · Finding clients

Cold email to local business prospects: what US law requires and a short template

For writing to a local business that has never heard of you: what the FTC's CAN-SPAM guide says applies, how to research the business from what it publishes, what never to claim, three short messages and a log for replies and opt-outs.

FTC and Google sources checked on 30 October 2026.

Start with the reader's side

Google's page on hiring an SEO tells site owners to be wary of SEO firms and consultants that email them out of the blue, and to give unsolicited email about search engines the same skepticism as "burn fat at night" diet pills. It then reproduces a spam email of the kind Google says it receives too, telling google.com it is "not listed in most of the major search engines". Your email has to look nothing like that one.

Gmail's sender guidelines, written for email to personal Gmail accounts, say to send email only to people who want it, not to send messages to people who did not sign up, and not to buy addresses. A cold email is, by definition, a message to someone who did not sign up. If you send any, keep it small: a few businesses you have researched, one person at each, three messages at most.

The warmer routes are covered elsewhere: the other half of the job, a one-page website and a checklist lead magnet. Once someone has asked to hear from you, use the follow-up sequence for people who asked instead of this one. For introductions from clients who already know your work, see a client referral program.

What the FTC's CAN-SPAM guide says applies

The FTC's compliance guide says the law covers all commercial messages and, despite its name, does not apply only to bulk email. It is explicit about business email: "The law makes no exception for business-to-business email." What decides whether a message is commercial is its primary purpose. An email whose main job is to promote your SEO services is commercial, so a single message you write by hand to one owner is covered.

The guide adds that your spam filter must not block opt-out requests, and that each separate email in violation can bring penalties of up to $53,088. Its list of conduct carrying criminal penalties, including imprisonment, includes harvesting email addresses and generating them through a dictionary attack, which it describes as sending to addresses made up of random letters and numbers in the hope of reaching valid ones. Copy each address by hand from the business's own website, and never guess at others.

The guide's list of requirements does not include asking permission before the first email. That does not make cold email welcome everywhere: mailbox providers and your own email provider set their own rules, as the next section explains, and other countries have their own laws.

A footer for every message

Check your email provider's terms first

Your email provider's terms may not allow sending to people who have not opted in, so read them before you send. Read your provider's terms of service and acceptable use policy before your first cold email. If they forbid it, do not send it from that account.

Gmail's sender guidelines also require all senders to set up SPF or DKIM authentication for their sending domains, and add more requirements for anyone sending more than 5,000 messages a day to Gmail accounts. A handful of researched emails stays far below that threshold, but the SPF or DKIM requirement still applies.

Research a prospect honestly, from public information

Use only what the business publishes. Keep the research short, and write down what you saw, where and when.

1. Read their website

   What they sell, which area they serve, how a customer contacts them. Find the email address they publish for inquiries and copy it by hand, with the page URL. If the site lists only a contact form or a phone number, take that as your answer and do not hunt for a personal address.

2. Look at their Business Profile as Google shows it

   Search the business name on Google Search and Google Maps, where Google says people find local results. Note the name, category, hours, address or service area, reviews and photos. Google's local ranking help page says local results are mainly based on relevance, distance and how well known a business is, and that businesses with complete and accurate information are more likely to show up. A gap between profile and website, such as different hours, is a fact you can point to.

3. Run one site: search

   Search site: followed by their domain. Google's SEO Starter Guide says results pointing to the site mean it is in Google's index. That is all it tells you; it is not a page count, a traffic estimate or an audit.

4. Pick one observation, and check it is a real problem

   Some things look wrong but are not. Google's guidelines tell service-area businesses, such as a plumber working from home, to hide their address, so a missing address may be correct. The same guidelines say unnecessary information in a business name, such as a marketing tagline, is not permitted and could lead to suspension of the profile. Mention it only if you can point to the words and the matching guideline.

Without access you cannot see their Search Console data, their profile's performance figures or their calls and leads, so say nothing about them. Do not pose as a customer or send a fake inquiry to test them.

What never to claim

A cold email is an ad. The FTC's advertising guide for small businesses says ads must be truthful and not deceptive, and that advertisers need proof before an ad runs, for implied claims as well as stated ones.

For the same rules applied to a written offer, see red flags to keep out of a proposal. For past client results you have permission to share, see results claims in a case study.

A three-message sequence

One observation on day 0, a fix plus one offer on day 5, a closing note on day 12. Send each yourself, one at a time, from your normal mailbox. Stop the moment someone replies, opts out or bounces. Keep each message short enough to read on a phone.

Message 1: one observation (day 0)

Hypothetical example: "Your website lists Saturday hours of 8 to 2, but your Business Profile on Google shows Saturday as closed. Google's help page for business owners says complete and accurate information makes a business more likely to show up in local results."

Message 2: something useful, and one offer (day 5)

The fix should work without you. That is the part of the email the reader can check, and it shows how you work. For a fixed-price offer to link to, see defining a fixed-price audit.

Message 3: close the loop (day 12)

Then stop, and keep that promise: no new sequence next month. For the page behind the booking link, see a booking page for SEO discovery calls.

Templates only: fill every bracket with your own details. Nothing here describes a real business, client or result.

Reply handling and opt-out log

The log

One row per business, in a spreadsheet you check before every new email, including the ones you send next year.

An opt-out routine

1. Each business day, check your inbox and your spam folder for replies. The FTC guide says your spam filter must not block opt-out requests.
2. Apply every opt-out the same or next business day: move the row to "do not contact" and note the date and how they asked.
3. Never email that address again unless they write to you first, and never sell or transfer the list. The FTC guide allows one exception: a company you hired to help you comply with the law.
4. Keep the reply address working for well over 30 days after your last message.

After a yes

Send the note you promised, then move to a normal sales conversation. Google's hiring page says a good SEO asks what makes the business unique, who its competitors are, how search can help it and how customers find it; use those as your discovery call agenda. If they want a deeper look, the same page advises granting an SEO only read access to Search Console at the audit stage; what to put in an SEO audit covers which access to ask for. Someone who signs moves to the onboarding checklist.

---

Sources

checked on 30 October 2026

• Not just bulk email; no B2B exception; primary purpose; message and opt-out requirements; no transfer after opt-out; responsibility when others send; spam filters; penalties; harvesting and dictionary attacks: CAN-SPAM Act: A Compliance Guide for Business (FTC)
• Truthful, non-deceptive ads; proof before an ad runs; express and implied claims: Advertising FAQ's: A Guide for Small Business (FTC)
• SEO firms that email out of the blue; "burn fat at night" diet pills; the quoted spam example; no guaranteed #1 ranking; "special relationship" and "priority submit"; what a good SEO asks; read access for audits (last updated 5 June 2026): Do you need an SEO? (Google Search Central)
• Local results on Google Maps and Search; mainly based on relevance, distance and how well known a business is; complete and accurate information; no way to request or pay for a better local ranking: Tips to improve your local ranking on Google (Google Business Profile Help)
• Unnecessary information, including marketing taglines, in business names not permitted and could lead to suspension; service-area businesses should hide their address (plumber example): Guidelines for representing your business on Google (Google Business Profile Help)
• What a site: search shows: SEO Starter Guide (Google Search Central)
• Scope (personal Gmail accounts); send only to people who want your messages and signed up; no purchased addresses; SPF or DKIM for all senders; the 5,000-a-day threshold: Email sender guidelines (Gmail Help)