The CAN-SPAM Act explained: requirements, penalties and a compliance checklist for email marketers

If you send marketing email to people in the United States, the CAN-SPAM Act applies to you, whether you are a two-person Shopify store or a large SaaS company. The law sets rules for every commercial email, and each email that breaks them can cost you a fine.

The good news is that CAN-SPAM is not hard to follow. This guide walks through what the law requires, based on the FTC's own CAN-SPAM Act: A Compliance Guide for Business: which emails are covered, the penalties, and a checklist. A final section compares CAN-SPAM with the stricter consent rules in the EU (GDPR and the ePrivacy Directive) and Canada (CASL).

What is the CAN-SPAM Act?

CAN-SPAM stands for "Controlling the Assault of Non-Solicited Pornography And Marketing". It is a US federal law passed in 2003, and the FTC enforces it. It sets the rules for commercial email, gives recipients the right to have you stop emailing them, and spells out penalties for violations.

Two things often surprise people:

• It isn't only about bulk email. The FTC's guide says the law covers "all commercial messages", not just mass mailings. A one-off sales email to a single person counts.
• There is no exception for B2B. Email to business addresses has to comply too.

Unlike the EU and Canadian laws covered below, CAN-SPAM doesn't require permission before a first marketing email. It is an opt-out law: you may email, but you must identify yourself honestly and stop when someone asks. In practice you still want consent, because mailbox providers judge you on complaints, and people who never asked for your email are the ones who mark it as spam. See the Gmail, Yahoo and Outlook sender requirements for those rules.

The CAN-SPAM requirements, one by one

The FTC's compliance guide lists the main requirements. Here they are in plain language.

1. Don't use false or misleading header information

Your From, To and Reply-To fields and the routing information, including the originating domain name and email address, must be accurate. They must identify the person or business that sent the message.

For example, if your brand is Northwind Coffee, a From line like Northwind Coffee <[email protected]> is fine. A From name like "Your bank" or "Order update" on a promotional email is not.

2. Don't use deceptive subject lines

The subject line must reflect what is actually in the message. Example of what to avoid: a subject line that reads "Your refund has been processed" on an email that is really a sale announcement. A subject line like "20% off cold brew this weekend" is honest and fine.

3. Identify the message as an ad

You must disclose clearly and conspicuously that the message is an advertisement. The FTC says the law gives you a lot of leeway in how you do this, so there is no required wording. Promotional content that is obviously promotional, with a clear brand and offer, is the usual approach.

4. Tell recipients where you're located

Every commercial email must include your valid physical postal address. According to the FTC, this can be your current street address, a post office box registered with the US Postal Service, or a private mailbox registered with a commercial mail receiving agency under Postal Service rules. Most senders put it in the footer.

5. Tell recipients how to opt out

Your message must include a clear and conspicuous explanation of how to opt out of future email from you. The opt-out has to be easy for an ordinary person to recognise, read and understand. You can give people a menu of choices, such as "fewer emails" or "only product launches", but the FTC says the menu must include an option to stop all marketing messages from you.

The FTC also points out that subscribers and members keep the right to opt out of your marketing email. Membership alone doesn't make a promotional message transactional.

Make sure your spam filter doesn't block opt-out replies or unsubscribe requests.

6. Honor opt-out requests promptly

This is the requirement with the clearest numbers:

• Your opt-out mechanism must be able to process requests for at least 30 days after you send the message.
• You must honor an opt-out request within 10 business days.
• You can't charge a fee, require any personal information beyond an email address, or make the person take any step other than sending a reply email or visiting a single web page.
• Once someone has opted out, you can't sell or transfer their email address, even as part of a mailing list, except to a company you have hired to help you comply with the law.

Gmail and Yahoo are stricter in practice: they expect bulk senders to process unsubscribes within about two days and to support one-click unsubscribe headers.

7. Monitor what others are doing on your behalf

You can't contract away your responsibility. If you hire an agency, an affiliate or an email platform to send for you, both the company whose product is promoted and the company that actually sends the message may be held legally responsible.

Special rule: sexually explicit content

Email with sexually oriented material must start its subject line with "SEXUALLY-EXPLICIT:" and follow extra formatting rules described in the FTC's guide.

Commercial vs transactional: which emails does CAN-SPAM cover?

CAN-SPAM sorts email by its primary purpose. The FTC describes three kinds of content:

• Commercial content advertises or promotes a commercial product or service. This includes content on a website operated for a commercial purpose.
• Transactional or relationship content facilitates an agreed-upon transaction or updates a customer about an ongoing transaction.
• Other content is neither, for example a purely informational note.

If the primary purpose is commercial, the message must follow all of the rules above. If it is transactional or relationship, it is largely exempt, but it still can't contain false or misleading routing information.

What counts as transactional or relationship

According to the FTC, a message is transactional or relationship only if it consists solely of content that:

1. facilitates or confirms a commercial transaction the recipient already agreed to;
2. gives warranty, recall, safety or security information about a product or service the recipient bought;
3. gives information about a change in terms or features, or account balance information, for an ongoing relationship such as a membership or subscription;
4. provides information about an employment relationship or employee benefits; or
5. delivers goods or services the recipient is entitled to under a transaction they agreed to.

The FTC adds that these categories are interpreted narrowly. Order confirmations, shipping notices, password resets and invoice emails usually fit. A "we miss you" email, a newsletter with product picks or a sale announcement does not.

Emails that mix both

Many real emails mix content, such as an order confirmation with a "you might also like" section. The FTC's guide gives the test:

• If a message has both commercial and transactional content, it is treated as commercial if a recipient reasonably interpreting the subject line would likely conclude it advertises a product or service, or if the transactional content doesn't appear mainly at the beginning of the message.
• If a message has commercial and other (non-transactional) content, it is commercial if the subject line test above is met, or if a recipient reasonably interpreting the body would likely conclude its primary purpose is commercial. Factors include where the commercial content appears, how much of the message it takes up, and how colour, graphics, type size and style are used to highlight it.

For example, a receipt with the subject "Your order #1042 is confirmed" that opens with the order details and has a small product block at the bottom is likely still transactional. The same receipt with the subject "Thanks! Plus 25% off your next order" and a big promo banner on top is likely commercial. We cover these grey areas in more detail in transactional vs marketing email.

CAN-SPAM penalties

The FTC's guide says each separate email in violation of the law is subject to penalties of up to $53,088. That maximum is adjusted for inflation from time to time, so check the FTC's guide for the current figure. More than one party may be held responsible for the same violation, as described above.

The guide also notes that some practices, such as harvesting addresses, dictionary attacks, registering accounts or domains with false information, and relaying spam through computers without permission, can bring extra fines and even criminal penalties, including imprisonment.

The FTC can also seek redress for consumers under Section 19 of the FTC Act.

Because the penalty applies per email, a non-compliant campaign to a few thousand people is a few thousand separate violations.

CAN-SPAM compliance checklist

Use this before every marketing campaign or new automated flow.

Two habits make this easier: keep one suppression list across every tool, including any separate cold email tool, and check imported CSVs for people who opted out elsewhere. Authentication also keeps your routing information accurate; see SPF, DKIM and DMARC explained.

How CAN-SPAM compares with GDPR, ePrivacy and CASL

If you have subscribers outside the US, CAN-SPAM is the floor, not the ceiling. The EU, the UK and Canada work on consent first: you generally need permission before sending marketing email. Here is a high-level comparison.

EU: GDPR and the ePrivacy Directive

In the EU, two laws work together:

• The ePrivacy Directive (Directive 2002/58/EC), Article 13, says email for direct marketing is allowed only to people who have given prior consent. Article 13(2) adds an exception: a business that got a customer's email address in the context of a sale may email them about its own similar products or services, as long as the customer had a clear, free chance to opt out when the address was collected and in every message. Each EU country implements the Directive in its own law, so details vary.
• The GDPR (Regulation (EU) 2016/679) governs the personal data itself. Consent must be freely given, specific, informed and unambiguous, and you need to be able to show it. People have an absolute right to object to direct marketing; when they do, you must stop. The most serious infringements can bring fines of up to €20 million or 4% of worldwide annual turnover, whichever is higher.

The UK's version, the PECR, works the same way. The UK regulator, the ICO, calls the existing-customer exception the "soft opt-in" and notes it doesn't cover bought-in lists or prospects who never bought from you.

Canada: CASL

Canada's Anti-Spam Legislation applies to commercial electronic messages sent to or from Canadian computers. Under the Act:

• You need consent: express, or implied in specific cases. Implied consent from an existing business relationship covers a purchase within the two years before the message, or an inquiry or application within the previous six months.
• Every message must identify the sender and include contact information that stays valid for at least 60 days after sending.
• Every message needs an unsubscribe mechanism, and requests must be honoured within 10 business days.
• The maximum administrative penalty is C$1,000,000 for an individual and C$10,000,000 for any other person per violation.

CASL also has a list of message types exempt from the consent requirement, such as quotes the person asked for and messages that confirm a transaction, but those messages still need sender identification and an unsubscribe mechanism.

A practical rule for mixed lists

If your list spans several countries, collect consent from everyone, record when and how each person agreed, and make unsubscribing instant. That covers CAN-SPAM and puts you in a strong position under GDPR and CASL. Our guide to growing your email list covers consent-friendly sign-up methods.

Where EterMail fits

EterMail is our product, an AI email marketing platform. It doesn't make anyone compliant on its own, but it builds several of these checks into sending. Before a campaign can be approved, it checks that your sending domain is verified and your postal address is set; campaigns can't send without a postal address. Every marketing email gets a footer with that address and an unsubscribe link. Every marketing email has a one-click unsubscribe, consent is re-checked at the moment of sending, and each subscription keeps a record of its source and time. You can read more in what EterMail is.

FAQ

Does CAN-SPAM require consent before sending marketing email?

No. CAN-SPAM is an opt-out law: you can send commercial email without prior permission, as long as you follow its rules and stop emailing people who opt out. The EU, UK and Canada are different and generally require consent first. Mailbox providers also penalise unwanted email through complaint rates, so getting consent is still the better practice.

What is the penalty for violating CAN-SPAM?

According to the FTC's compliance guide, each separate email that violates the law can bring penalties of up to $53,088. More than one company can be held responsible for the same email, for example the brand being promoted and the company that sent it. Some aggravated practices, such as harvesting addresses, can also bring criminal penalties.

Does CAN-SPAM apply to B2B email?

Yes. The FTC states that the law makes no exception for business-to-business email. A sales email sent to a company address must follow the same rules as one sent to a consumer, including the postal address and the opt-out.

How quickly do I have to process unsubscribe requests?

Under CAN-SPAM you must honor an opt-out within 10 business days, and your opt-out mechanism must keep working for at least 30 days after you send. Gmail and Yahoo expect bulk senders to process unsubscribes within about two days, so in practice faster is better.

Do transactional emails need an unsubscribe link?

Under CAN-SPAM, emails whose primary purpose is transactional or relationship, such as receipts, shipping notices and password resets, are largely exempt, though they can't have misleading routing information. If you add enough promotional content that the email becomes commercial, all the rules apply, including the opt-out. Gmail's one-click unsubscribe requirement also applies only to marketing and promotional messages.