The Subject Line Just Became a $500 Bet
You wrote a subject line this week. Maybe it said "Free gift inside." Maybe it said "Don't miss your discount." In Indiana right now, either one could cost you $500 per recipient. No actual harm required. No proof anyone was deceived. Just the allegation that the subject line was misleading. A federal court just let the case proceed. This is not a hypothetical.
Here is what happened. On September 15, 2026, the U.S. District Court for the Southern District of Indiana ruled that the Indiana Deceptive Commercial Electronic Mail Act applies to subject lines that are "misleading" — not just false. The plaintiffs in the case pointed to subject lines like "SO MANY FREE GIFTS INSIDE" and "Don't miss 10% off your purchase." The emails themselves contained the fine print. Minimum purchase requirements were there. Exclusions were disclosed. It did not matter. The court said the subject lines could still be misleading on their own, and the case could move forward as a class action.
How "Misleading" Became Worse Than "False"
The court drew a line that every email marketer needs to understand. If a subject line is factually false — "You won $1,000" when you didn't — that claim was dismissed because the email body told the truth. But "misleading" is a separate, broader category. An offer can be technically true in the fine print and still be misleading in the subject line. The court called this a "question for another day," but the plaintiffs get to ask that question in court. That is the exposure.
The ruling also rejected the argument that federal CAN-SPAM law overrides state statutes like this one. Other federal courts in the Fourth and Ninth Circuits had previously limited state anti-spam laws to tort-like claims. The Indiana court disagreed. It held that "misleading" essentially equals "deceptive" under the federal savings clause, and the state law survives. This creates a circuit split. Until the Supreme Court resolves it, Indiana is open for business — for plaintiffs' lawyers.
Washington State Shows the Pattern
Indiana is not a fluke. Washington state has a similar statute. After a 2025 ruling in Brown v. Old Navy interpreted it to cover any false or misleading subject line, nearly 200 class action lawsuits followed. Retailers, software companies, and nonprofits all got hit. The Washington legislature eventually stepped in, passing HB 2274 in June 2026, which requires the sender to know the subject line was misleading and cuts statutory damages to $100 per email. That slowed the bleeding.
Indiana has neither protection. The statute does not require knowledge. The sender does not have to intend to mislead. And damages remain at $500 per email. A list of 10,000 recipients in Indiana becomes a $5 million exposure. No one has to prove they opened the email. No one has to prove they lost money. Just that they received a misleading subject line.
What This Means for Your Cold Email Campaigns
If you are running cold email campaigns, this ruling directly affects how you write subject lines. The legal risk is no longer theoretical. It is venue-specific and dollar-denominated. Here is what you need to do, starting today.
Audit Every Subject Line Against "Standalone Truth"
The safest test: remove the email body and ask whether the subject line alone is false or misleading. "Free gift inside" fails that test if there is any purchase requirement, even if it is disclosed later. "10% off your purchase" fails if there are exclusions. The body of the email is irrelevant for this analysis. The court already made that clear.
Rewrite subject lines to be specific and unconditional where possible. "Free gift with any purchase" is better than "Free gift inside." "Save 10% on orders over $50" is better than "Don't miss 10% off." If you cannot make the subject line stand alone truthfully, consider whether the offer itself needs restructuring.
Segment Indiana Recipients — and Treat Them Differently
Until the legal situation stabilizes, Indiana residents represent elevated risk. You can pull a list of Indiana ZIP codes and apply a separate subject line policy to that segment. Or you can suppress Indiana recipients entirely for campaigns with promotional subject lines. This is not permanent. It is a tactical response to a specific ruling in a specific jurisdiction.
Review your suppression logic. Many email platforms let you exclude states. If yours does not, you need a workaround until it does. The cost of a few lost Indiana leads is lower than the cost of one class action.
Document Everything — Including Why You Think Your Subject Lines Are Safe
The Washington experience showed that plaintiffs' lawyers file first and ask questions later. Documentation does not prevent a lawsuit, but it helps with early dismissal. Create a subject line review log. For each campaign, note the purpose of the subject line, the offer being made, and the reasoning that the subject line is neither false nor misleading. Date it. Keep it. If a lawsuit comes, that log is your first line of defense.
Legitimate Interest Is Still Alive — But It Has Requirements
The Indiana ruling is about promotional email sent to consumers. It does not directly affect B2B cold email, which typically operates under a different legal framework in the EU and UK. But the broader regulatory environment matters. If you are doing B2B outbound under GDPR's legitimate interest basis, you need to understand what is required in 2026.
Legitimate interest under GDPR Article 6(1)(f) is a recognized legal basis for processing personal data without prior consent. Recital 47 explicitly mentions direct marketing as a potentially legitimate interest. For B2B outbound, the logic holds: you are contacting a professional about a business product, using professional contact information, in a professional context.
The Three-Step Test You Must Document
You cannot just claim legitimate interest. You must prove it through a documented assessment. The three steps are straightforward but mandatory.
- Purpose test: Your purpose must be legitimate. Proposing a business relationship to a professional qualifies.
- Necessity test: The processing must be necessary. Could you achieve the same outcome through a different method that is less intrusive? If you could send a LinkedIn message instead of an email, you need to justify why email is necessary.
- Balancing test: The individual's rights and interests must not override yours. Consider whether they reasonably expect this contact. Is it disruptive to their private life? How intrusive is the contact?
A legitimate interest assessment does not need to be long. One page covering these three points, signed by a senior stakeholder, dated, and kept in your compliance folder is sufficient for most B2B outbound motions. Update it when your processing changes materially.
Seven Operational Requirements You Cannot Skip
The assessment is internal. The following requirements are external and visible to recipients. Miss any of these, and your legitimate interest defense weakens significantly.
- A clear privacy notice on your website explaining how you process contact data
- A working, one-click unsubscribe in every email
- A global suppression list that removes unsubscribes across all campaigns
- A retention policy for contact data with actual deletion dates
- A process for handling data subject access requests within the legal timeframe
- Documentation that you checked the individual's role and company relevance before contacting
- A log of consent or legitimate interest assessments for each data source
These are not nice-to-haves. They are the evidence you produce when a regulator or opposing counsel asks how you conducted the balancing test. If you cannot show them, you did not balance anything. You guessed.
The Unresolved Tension
Here is the problem no one has solved yet. The Indiana ruling makes subject lines a legal liability even when the email body is truthful. The legitimate interest framework for B2B outbound demands transparency and documentation. These two trends pull in opposite directions. One says "be aggressive in the subject line to get opens." The other says "be cautious in the subject line to avoid liability." The same marketer has to navigate both.
There is no clean answer. The safe path is to write subject lines that are boring but bulletproof. The effective path is to write subject lines that get opens. The tension between safety and effectiveness will not be resolved by a single court ruling or a single compliance guide. It will be resolved by the next ruling, and the one after that, and by whatever legislation Congress or state legislatures pass in response.
For now, the question is not whether you agree with the Indiana court. The question is whether your subject lines can survive its reasoning. And if you cannot answer that with confidence, you already have your answer.