If your business sends promotional email in the U.S., the CAN-SPAM Act applies, even to a small newsletter. The rules are short and very manageable.
TL;DR
- CAN-SPAM covers commercial email, including messages sent to other businesses.
- Every marketing email needs honest headers and subject lines, a postal address and a working way to opt out.
- Opt-out requests must be honored within 10 business days.
- Each violating email can bring a penalty of up to $53,088, and you’re responsible even if a vendor sends it.
The CAN-SPAM Act is the main U.S. law for commercial email, and the Federal Trade Commission enforces it. Despite the name, it doesn’t only target bulk spam. It covers any email whose main purpose is to advertise or promote a product or service.
Which emails does it cover?
The law looks at the primary purpose of the message:
- Commercial content, such as a sale announcement, a newsletter promoting your services or a product launch, is covered. That includes business-to-business email.
- Transactional or relationship content, such as an order confirmation, a shipping notice or a change to account terms, is exempt from most rules.
If an email mixes both, it counts as commercial when the subject line would make a reasonable reader think it’s an ad, or when the transactional part isn’t mainly at the start.
What does every marketing email need?
Based on the FTC’s compliance guide:
- Honest header information. The From, To and Reply-To details must accurately identify the business sending the message.
- A truthful subject line that reflects what’s in the email.
- A clear indication that the message is an ad.
- Your valid physical postal address, which can be a street address, a registered post office box or a registered private mailbox.
- A clear way to opt out of future marketing email, such as a link or a reply address.
- Prompt handling of opt-outs: within 10 business days, without charging a fee or asking for more than an email address and a single web page visit.
- Responsibility for anyone sending on your behalf.
Note
Your opt-out link has to keep working for at least 30 days after you send the email, and you can’t sell or share the addresses of people who opted out.
What are the penalties?
Each separate email that breaks the law can bring a penalty of up to $53,088, a figure the FTC adjusts for inflation. Both the company whose product is promoted and the company that sends the message can be held responsible, so hiring an email marketing service doesn’t move the obligation off your plate.
How do you stay on the right side of it?
- Use an email service that adds an unsubscribe link and your address to every campaign automatically.
- Check the opt-out process yourself once in a while.
- Keep subject lines plain and accurate.
- Remove people promptly when they ask.
Compliance is the floor, not the goal. Our guide to building an email list customers actually want covers permission and good habits, and sending from your own domain helps your messages get delivered.
Quick answers
Q: Does CAN-SPAM require people to opt in?
A: No. It’s an opt-out law. Asking for permission is still the better practice, because people who signed up are far less likely to report your emails as spam.
Q: Are order confirmations covered?
A: Transactional and relationship messages, such as receipts, shipping notices and account updates, are exempt from most of the rules, but they still can’t contain false or misleading routing information.
Q: Do the rules apply to emails sent to customers in other countries?
A: Other countries have their own laws. Canada’s anti-spam law, for example, generally requires consent before you send. Check the rules where your readers live.
Email services change their settings and menus often. This guide is general information, not legal or professional security advice; check your provider’s help pages and official sources such as FTC.gov and CISA.gov.
