How to find business owner emails legally (CAN-SPAM and GDPR basics)

By 67Leads Team · Published 11 Nov 2026 · Updated 11 Nov 2026 (US Central) · 5 min read

You can find a business owner's email legally by using addresses the business publishes itself, such as its website contact page, and verifying them before you send; what the law then cares about is how you email, not where the address was listed. As of 12 Nov 2026, 10,456 of the 150,200 sellable US local businesses in the 67Leads warehouse name an owner on their own site, and 777 of those also have an email the mail server confirmed. This is general information, not legal advice.

Shortcut: the owner emails pages list businesses by trade and city where we hold both, the CAN-SPAM checker tests a draft, and the business owner lookup shows where owner records are public in each state.

Step 1: Start with what the business publishes

The safest source is the company's own website: the Contact, About or Team page. A business that puts an address there expects to be contacted. Check the footer and the Google Business listing too. Note the source for each address, because a record of where it came from is useful if anyone asks.

Step 2: Find the owner's name from public records

If the site names no one, owner and officer names are public record in most states. The business owner lookup points to each state's official business entity search, county records and trade licensing boards. Our guide on finding a small business owner's name covers the method. Only 1% of the warehouse has both an owner name and a verified email, so expect most of your list to need the phone instead.

Step 3: Do not guess addresses

Guessing patterns such as first.last@company.com is the step that gets people in trouble. It produces mail to the wrong person, bounces that hurt your sending reputation, and in some places it is treated as collecting personal data without a basis. If you must use a pattern, verify each address before sending: the email verifier asks the mail server whether the mailbox exists, and tells you if the domain accepts every address, which makes the check meaningless.

Step 4: Prefer role-free addresses

Of the 777 owner records with a verified email, 742 are not a shared inbox such as info@ or sales@. A personal address reaches the owner; a shared one reaches whoever opens it. The glossary entry on a role address explains the difference.

US rules: CAN-SPAM

CAN-SPAM applies to commercial email in the US, including email to businesses. The FTC's compliance guide lists the requirements, in short:

• Do not use false or misleading header information.
• Do not use deceptive subject lines.
• Identify the message as an ad where that applies.
• Include a valid physical postal address.
• Give a clear way to opt out, and honor opt-outs promptly.
• Monitor what anyone sending on your behalf does.

Notice what is not on the list: there is no rule that you need permission before the first email. The rules are about honesty and a working way to stop. See the glossary entry for CAN-SPAM, and read our guide, is buying an email list legal.

UK and EU rules

If you email people in the UK or EU, different rules apply, and they can depend on whether the recipient is a company or an individual such as a sole trader. The UK regulator's direct marketing guidance is the place to start. 67Leads lists US businesses, so GDPR matters mainly if you also contact people in Europe; for those, ask a lawyer.

Step 5: Keep a suppression list

Whoever opts out, in any channel, goes on a list you check before every send. Include anyone who replies "remove me" in plain words. Honor it everywhere you use the same address. The glossary entry on a suppression list explains how. 67Leads removes businesses that ask to be removed from the warehouse; the removal page is where they do it.

Step 6: Send like a person

The legal minimum is not the same as a good email. Keep it short, name something specific about their business, say who you are and why you are writing, and ask one question. The cold email grader scores a draft, and the spam word checker flags trigger phrases. Use a separate sending domain so a complaint never touches your main one.

How 67Leads fits

67Leads is a search over public business listings and company websites. Owner names and emails stay masked until you export, your first 67 leads export free, and after that credits start at $6.70 per 1,000. Emails come from the business's own site and are checked against the mail server before we call them verified. Start at the owner emails pages and test a draft in the CAN-SPAM checker.

Questions

Is it legal to email a business owner without permission?

In the US, CAN-SPAM does not require permission before a first commercial email. It requires honest headers and subject, a postal address and an easy opt-out that you honor. Other countries differ. This is general information, not legal advice.

Can I guess a business owner's email address?

You can, but you should not send until you verify it. Guessed addresses bounce, reach the wrong person and hurt your sender reputation. Verify each one with an email verifier first.

How many business owners have a public email?

In our warehouse as of 12 Nov 2026, 777 businesses have both an owner name from their site and a verified email. That is 1% of the 150,200 we hold.

Does GDPR apply to emailing US small businesses?

GDPR applies to personal data of people in the EU and UK, not to US-only outreach. If your list includes people there, the rules can differ for companies and for individuals; check with a lawyer.

No card. Search is free with contacts masked.

Sources

1. https://www.ftc.gov/business-guidance/resources/can-spam-act-compliance-guide-business
2. https://ico.org.uk/for-organisations/direct-marketing-and-privacy-and-electronic-communications/