Key Takeaways
- Every commercial email needs accurate sender info, a truthful subject line, a physical address, and a working unsubscribe link
- Violations can cost up to $53,088 per email under current FTC guidance, effective January 2025
- Compliance protects email deliverability and preserves customer trust, not just legal standing
- CAN-SPAM covers all commercial email, B2C and B2B, including newsletters and promotional campaigns
What Is the CAN-SPAM Act?
The CAN-SPAM Act is a federal law enacted in 2003 (15 U.S.C. 7701 et seq.) that regulates commercial email communications in the United States. Its provisions took effect January 1, 2004.
What qualifies as a "commercial message"?
Any email whose primary purpose is "the commercial advertisement or promotion of a commercial product or service," including promotion of content on a commercial website. This definition captures promotional emails, marketing newsletters, and sales announcements.
Who must comply?
CAN-SPAM applies to all commercial emails, not just bulk campaigns. It covers:
- B2C promotional messages
- B2B marketing emails (no business exception exists)
- Single messages and mass sends alike
- Messages sent by third-party vendors on your behalf
Does CAN-SPAM require prior consent?
No. Unlike GDPR or Canada's CASL, CAN-SPAM uses an opt-out model. You may send commercial emails without prior permission. You must still provide a clear, easy opt-out method and honor requests within 10 business days.
Who enforces CAN-SPAM?
The Federal Trade Commission (FTC) enforces violations as though they were unfair or deceptive acts. The law also grants enforcement authority to:
- State attorneys general
- Internet service providers (ISPs)
- Sector regulators (banking, insurance, transportation, agriculture, FCC)
Individual recipients have no private right of action under CAN-SPAM.
CAN-SPAM Act Requirements: The 7 Compliance Rules
Every commercial email you send must satisfy these seven requirements:
Rule 1: Don't Use False or Misleading Header Information
Your "From," "To," "Reply-To," and routing information, including originating domain and email address, must accurately identify the person or business that initiated the message. Misrepresenting your identity or using deceptive headers is prohibited under 15 U.S.C. 7704(a)(1).
Rule 2: Don't Use Deceptive Subject Lines
Subject lines must accurately reflect the content of the message. Avoid clickbait, bait-and-switch tactics, or promises your email doesn't fulfill.
Rule 3: Identify the Message as an Advertisement
Clearly and conspicuously disclose that your message is an advertisement or solicitation. The law doesn't dictate exact wording or placement, but the disclosure must be obvious. One exception: if the recipient already gave prior affirmative consent to receive your emails, the ad-label requirement doesn't apply.
Rule 4: Include Your Physical Postal Address
Every email must contain a valid physical postal address:
- Street address
- USPS-registered PO Box
- Private mailbox registered with a commercial mail-receiving agency under Postal Service regulations
Rule 5: Provide a Clear and Easy Opt-Out Mechanism
Explain clearly and conspicuously how recipients can stop receiving future marketing emails. The mechanism must meet these criteria:
- Be easy to recognize and use
- Allow opt-out via return email or a single webpage visit
- Require no fee or personal information beyond the email address
- Stay active for at least 30 days after you send the message
Industry best practice calls for a one-click unsubscribe link in the email footer, though CAN-SPAM itself only requires it be "clear and conspicuous."
Rule 6: Honor Opt-Out Requests Within 10 Business Days
When someone opts out, you have 10 business days to stop sending them commercial messages. You must:
- Process the request within the 10-day window
- Keep that opt-out path working for 30 days after the email goes out
- Never sell or transfer the opted-out address (except to a contractor helping you comply)
Email platforms like Klaviyo automatically suppress opted-out contacts and keep compliance records. At FluenceFlow, that suppression and 10-day opt-out handling is built into every client setup so requests are honored without manual tracking.
Rule 7: Monitor What Others Are Doing on Your Behalf
Even when you hire a third party to handle your email marketing, both your company and the sender can be held legally responsible for CAN-SPAM violations. You cannot outsource compliance. Ensure your agency or vendor follows every requirement.
Other Email Marketing Laws to Know
CAN-SPAM governs U.S. commercial email, but if you serve international customers or operate in certain states, other regulations may apply.
GDPR (General Data Protection Regulation)
Who it covers: EU residents' personal data, regardless of where your business is located.
Key requirements:
- Establish a lawful basis before processing personal data
- Get consent before electronic marketing when ePrivacy rules require it, even if legitimate interests apply under GDPR
- Honor rights to access, delete, correct, and port data
- Allow an unconditional right to object to direct marketing
CASL (Canada's Anti-Spam Legislation)
Who it covers: Commercial messages sent to Canadian recipients.
Key requirements:
- Obtain express or implied consent before sending
- Identify the sender and include contact information in every message
- Include a clear unsubscribe mechanism
- Risk penalties up to C$1 million for individuals and C$10 million for businesses per violation
CASL is stricter than CAN-SPAM and enforces a consent-first model.
CCPA (California Consumer Privacy Act)
Who it covers: California residents.
Key requirements:
- Disclose what you collect and honor delete, correct, and opt-out-of-sale requests
- Provide notice at collection covering data categories and purposes
- Treat email addresses as "personal information" under the statute
CCPA is a privacy law, not an email consent rule, but it still shapes how you store, share, and delete California residents' email data.
How to Build a Compliant Email Marketing Strategy
Compliance works best as an ongoing system, not a one-time checklist. Build these practices into every campaign.
Start with permission-based list building:
- Use double opt-in so subscribers confirm their address after signup (M3AAWG calls confirmed opt-in a best practice)
- Design signup forms with clear consent language explaining what subscribers will receive
- Never buy email lists. Yahoo and M3AAWG advise against purchased lists because of poor engagement, high complaints, and deliverability risk
Implement proper email identification:
- Ensure your "From" name and address clearly identify your brand
- Use authenticated sending domains (SPF, DKIM, DMARC) to prove legitimacy to ISPs
- Maintain consistent branding across subject lines, headers, and content
Design effective opt-out mechanisms:
- Place unsubscribe links prominently in the email footer
- Make the process one-click simple with no login or extra steps
- Test your unsubscribe workflow regularly to confirm it works
Create a compliance checklist for every campaign:
Before you hit send, verify:
- Accurate "From" and "Reply-To" headers
- Truthful subject line that reflects email content
- Clear ad disclosure (if required)
- Valid physical postal address in the footer
- Working, accessible unsubscribe link
Maintain proper records:
- Document how subscribers joined your list (signup forms, consent timestamps)
- Log opt-out requests and the dates you processed them
- Retain copies of sent emails for compliance audits
- Keep records accessible for FTC or ISP inquiries
Partners like FluenceFlow build these safeguards into Klaviyo from day one, so DTC brands protect deliverability while email and SMS carry a large share of store revenue.
CAN-SPAM Penalties and Consequences
Financial penalties
Each separate violating email can result in penalties up to $53,088 under current FTC guidance, effective January 17, 2025. There is no FTC-imposed aggregate cap on civil penalties. Both the company promoting the product and the company that sent the email can be held liable.
Criminal penalties
18 U.S.C. 1037 criminalizes aggravated violations, including:
- Unauthorized computer access to send spam
- False header information in large-scale campaigns
- Harvesting email addresses or generating them via dictionary attacks
- Falsifying domain or account registration information
Penalties can reach 1 to 5 years' imprisonment depending on the offense, prior convictions, and related felonies, plus fines and forfeiture.
Business consequences beyond fines
- Sender reputation: ISPs track complaints and engagement; Google states spam classification affects future inbox placement
- Spam folder placement: Messages land in junk instead of the inbox, cutting open rates
- Blocklisting: Your IP or domain can land on lists like Spamhaus, so receiving systems reject mail entirely
- Customer trust: People who feel spammed unsubscribe, hit “report spam,” or stop buying
Recent enforcement examples
- Verkada (2024): More than 30 million commercial emails over three years without compliant opt-outs, physical addresses, or honored unsubscribe requests. FTC settlement: $2.95M (largest CAN-SPAM penalty the agency has announced)
- Experian (2023): FTC charged Experian with spamming free-account holders using marketing mail that lacked a clear opt-out. Settlement: $650,000 plus an order barring non-compliant unsubscribe practices
For DTC brands, the real cost is rarely one fine alone; it is deliverability damage stacked on legal exposure. Building compliant opt-outs, headers, and sender identity into every flow and campaign is cheaper than rebuilding inbox placement after the fact.
Frequently Asked Questions
What are the legal requirements for email marketing?
Every commercial email needs accurate From/To/Reply-To headers, a truthful subject line, clear ad disclosure, a valid physical postal address, and a conspicuous opt-out. You must honor opt-outs within 10 business days and monitor third parties who send on your behalf.
What is the penalty for violating the CAN-SPAM Act?
Each violation can result in penalties up to $53,088 per email, with no FTC-imposed maximum cap. Both the advertiser whose product is promoted and the company that sent the email can be held liable.
Do I need permission to send marketing emails under CAN-SPAM?
No. CAN-SPAM doesn't require prior consent to send commercial emails. You must, however, provide a clear opt-out method and honor requests within 10 business days. This contrasts with GDPR and CASL, which generally require consent before sending.
What's the difference between transactional and marketing emails under CAN-SPAM?
Transactional messages like order confirmations, shipping updates, and account statements are largely exempt from CAN-SPAM. Marketing emails that promote products or services must fully comply. Mixed-content messages are governed by their primary purpose.
Does CAN-SPAM apply to B2B email marketing?
Yes. CAN-SPAM makes no exception for business-to-business emails. All commercial messages must comply, regardless of whether the recipient is a consumer or business.
Can I buy email lists and still comply with CAN-SPAM?
CAN-SPAM doesn't ban purchased lists outright, but you must still meet every requirement for every message, and knowingly using harvested or dictionary-generated addresses is an aggravated violation. Purchased lists usually hurt engagement and deliverability; M3AAWG and Yahoo advise against them.
Compliance protects your legal standing and your revenue. DTC brands that keep clean lists, honor opt-outs, and follow CAN-SPAM preserve inbox placement and the customer trust that makes email a reliable, high-ROI channel.
