Email remains one of the most direct channels a business has, and in the United States it comes with a rulebook. This article explains the CAN-SPAM Act as the Federal Trade Commission (FTC) describes it in its compliance guide for business, what each requirement means in practice, and how to build the rules into your sending routine.
What does the CAN-SPAM Act actually cover?
CAN-SPAM is a federal law that sets rules for commercial email, meaning messages whose primary purpose is to advertise or promote a commercial product or service. It gives recipients the right to make a sender stop emailing them, and it spells out penalties for breaking the rules.
A point that surprises many small teams is that the law is not limited to bulk mailings or to unsolicited messages. According to the FTC’s guide, the requirements apply to all commercial messages, including email to existing customers. A promotional newsletter sent to people who bought from you last year is covered just as a cold outreach campaign would be.
The FTC’s guide sorts email into three types: commercial content, transactional or relationship content, and everything else. Transactional or relationship messages, such as a receipt or a notice about an account change, fall into a narrower set of categories (the guide lists five). They are treated more lightly, and may be sent without an opt-out link, provided their primary purpose really is transactional or about the relationship. A message that mixes a receipt with a large promotion is the kind of case where the “primary purpose” test matters, so it is safest to keep the two apart.
The eight requirements, one by one
The FTC’s guide lists eight main requirements. In plain language:
| # | Requirement | What it means for your campaigns |
|---|---|---|
| 1 | Don’t use false or misleading header information | The From, To, Reply-To and routing details, including the originating domain and email address, must be accurate and identify who sent the message |
| 2 | Don’t use deceptive subject lines | The subject must match what is inside the email |
| 3 | Identify the message as an ad | Make clear and conspicuous that the email is an advertisement |
| 4 | Tell recipients where you are located | Include a valid physical postal address |
| 5 | Tell recipients how to opt out | Explain clearly how to stop future marketing email |
| 6 | Honor opt-out requests promptly | Process requests within the required time, at no cost to the recipient |
| 7 | Monitor what others do on your behalf | Responsibility cannot be handed off to a vendor |
| 8 | Handle subscribers and members correctly | Existing subscribers can still opt out of marketing email |
The table compresses the guide’s wording, so treat it as a checklist for your own review rather than a substitute for the guide itself.
Headers, subject lines and the advertising label
The first three requirements are about honesty at the moment of delivery. Header information is the technical wrapper around a message: who it says it is from, where replies go and the path it took. The FTC says all of it must be accurate. In practice that means sending from a domain and address that genuinely identify your business rather than something that disguises the sender.
Subject lines must not mislead. If the subject promises a discount code and the body contains a sales pitch with no code, the subject has misrepresented the content. The same standard is useful beyond legal compliance: subject lines that overpromise tend to damage trust, a theme explored in content marketing that earns trust.
The advertising label does not require a particular phrase. The FTC’s guide asks that the message clearly and conspicuously disclose that it is an ad. A short line in the body is the common approach, positioned where a reader will see it and not buried in small print.
What must the opt-out mechanism look like?
Every commercial message needs a clear way to stop receiving more of them. The guide says you can provide a return email address or another easy internet-based way, such as a single web page, and that you can let people opt out of some categories of email as long as you also offer an option to stop all marketing messages from you.
The guide sets several specific conditions:
- The mechanism must be able to process opt-out requests for at least 30 days after you send the message.
- You must honor a recipient’s opt-out request within 10 business days.
- You cannot charge a fee, require the person to give you any personal information beyond an email address, or make them take any step beyond sending a reply email or visiting a single web page.
- Once someone opts out, you may not sell or transfer their email address, except to a company you hired to help you comply with the law.
- You should make sure your spam filter does not block opt-out requests.
A practical lesson follows: the opt-out link should work from the first day of a campaign through at least the 30-day window, so a link that points at a decommissioned landing page after a campaign ends is a compliance problem as well as a poor customer experience.
Why a physical address is required
The fourth requirement says your message must include your valid physical postal address. The FTC’s guide says this can be your current street address, a registered post office box, or a registered private mailbox. Businesses without a public office often choose one of the latter two.
What can a violation cost?
According to the FTC’s guide, updated in January 2024, each separate email in violation of the CAN-SPAM Act is subject to penalties of up to $53,088. That figure is a ceiling set by the law and adjusted for inflation over time, so the current amount may differ from the one in that update, not a typical outcome, and it is applied per email. The risk therefore scales with list size.
A worked example shows why. Suppose a single campaign of 200 emails went out with a broken header and no working opt-out. At the maximum, the theoretical exposure would be 200 × $53,088 = $10,617,600. No real case needs to reach that number for the point to hold: a design flaw copied into a template is multiplied by every send.
Who is responsible when an agency sends the emails?
The seventh requirement addresses outsourcing. The FTC’s guide states that you cannot contract away your legal responsibility to comply. It says both the company whose product is promoted in the message and the company that actually sends the message may be held legally responsible.
For a business that uses an email service provider, an agency or an affiliate network, the practical steps are straightforward:
- Put compliance expectations in writing in your agreements.
- Ask who processes opt-outs and how quickly the suppression list is updated.
- Test the unsubscribe path yourself, using a real inbox, before each major campaign.
- Keep a single master suppression list so a request made through one tool reaches all of them.
A simple pre-send checklist
Turning the law into a routine reduces the chance of mistakes. A short review before any commercial send might cover:
- Does the sender name and address match the real business?
- Does the subject line describe what the email contains?
- Is it clear that this is an advertisement?
- Is the postal address in the footer and current?
- Does the opt-out link work, and does it lead to one simple step?
- Has the suppression list been applied, including requests from the last 10 business days?
- If a partner is sending, has someone confirmed they follow the same checks?
Teams that run many campaigns often store these items in the email template itself, so the footer, label and link are present by default. It is also worth pairing compliance with performance review. Unsubscribe and complaint rates are useful signals of whether your content matches what people expect, as discussed in how to measure marketing without drowning in metrics. And for subscription businesses, an easy opt-out is a visible part of the customer relationship that links closely to SaaS churn: making leaving painful rarely keeps customers, and here it can also break the law.
Is following the law enough to build a good email program?
Compliance is the floor, not the goal. The law says nothing about whether your emails are relevant, welcome or well timed. Lists built on clear permission, content that answers a real need and a footer that makes leaving effortless tend to produce healthier engagement than any amount of legal box-ticking. Treat the opt-out as useful feedback: someone who leaves cleanly is better for your sender reputation than someone who stays and marks every message as junk.
International senders should also note that this guide describes United States rules. Other jurisdictions have their own requirements for consent and data handling, and a list that includes recipients elsewhere may need to meet those too.
Making the rules routine
The CAN-SPAM Act asks for a short list of things: honest headers and subject lines, a clear ad label, a real postal address, an opt-out that works for at least 30 days and is honored within 10 business days, and oversight of anyone sending for you. Because penalties are counted per email, the cheapest protection is a template and a checklist that get the basics right every time. Review them whenever you change tools, agencies or campaign formats.
This article is general information, not legal advice. Consult a qualified attorney about how the law applies to your business.
Sources: Federal Trade Commission
