CAN-SPAM: email marketing rules for US businesses
The CAN-SPAM Act in plain English: what every commercial email must include, how fast to honor unsubscribes, which emails are exempt and the inbox rules on top.
CAN-SPAM is the US federal law that sets the rules for commercial email. In short: do not use false or misleading sender information or subject lines, identify the message as an ad where required, include a valid physical postal address, give a clear way to unsubscribe and honor opt-outs within 10 business days. It applies to every commercial email, including emails to other businesses, and you stay responsible even if an agency or platform sends on your behalf.
The law is enforced by the Federal Trade Commission, and each email that breaks it can bring civil penalties of more than $50,000, adjusted for inflation every year. Most small businesses will never see an FTC letter, but the same habits that keep you compliant also keep you out of spam folders. This guide explains the rules in plain English. It is not legal advice; for anything unusual, check with your attorney.
Does CAN-SPAM apply to your email?
The law looks at the primary purpose of the message:
- Commercial content advertises or promotes a product or service. Newsletters with offers, promotions, product launches and "come back" emails count. CAN-SPAM applies in full.
- Transactional or relationship content facilitates a transaction the person already agreed to or updates them on an existing relationship: order confirmations, receipts, shipping updates, account notices, warranty information, appointment confirmations. These are mostly exempt, but they still must not contain false or misleading routing information.
- Other content, such as purely informational messages with no promotion, is generally not covered.
Mixed emails are judged by their primary purpose. If the subject line suggests a promotion, or the commercial part comes first and dominates, treat it as commercial. A receipt with a small "you might also like" block at the bottom is usually still transactional; a "receipt" that is mostly an ad is not.
The seven requirements
- No false or misleading header information. The "From", "To", "Reply-To" and routing must accurately identify your business.
- No deceptive subject lines. The subject must reflect the content. "Re: your order" on a promotion is a classic violation.
- Identify the message as an ad. Required for commercial email unless the recipient gave affirmative consent. The law does not prescribe exact wording; it must be clear.
- Tell recipients where you are. Include a valid physical postal address: a street address, a USPS-registered PO box or a registered private mailbox.
- Tell recipients how to opt out. A clear, easy-to-find unsubscribe link or reply method. Do not hide it in light gray text.
- Honor opt-outs promptly. Within 10 business days. The unsubscribe must keep working for at least 30 days after you send. You cannot charge a fee, ask for anything beyond an email address and opt-out preferences, or make people log in. You also cannot sell or transfer the addresses of people who opted out.
- Monitor what others do on your behalf. If an agency, freelancer or affiliate sends email promoting your business, both of you can be held responsible.
What CAN-SPAM does not require
People are often surprised that CAN-SPAM is an opt-out law: it does not require prior consent to send commercial email. Do not take that as permission to buy lists. Inbox providers do require good behavior, and unsolicited email is the fastest way to ruin your sender reputation.
The inbox rules on top of the law
Since 2024, Gmail and Yahoo have enforced stricter requirements for bulk senders, and other providers follow similar practices. In broad terms:
- Authenticate your domain with SPF and DKIM, and publish a DMARC record
- Offer one-click unsubscribe in marketing emails and process requests quickly, within about two days
- Keep spam complaints low, well below the thresholds the providers publish
- Send from your own domain, not a free mailbox address
If you send from a platform, most of this is a one-time setup in your domain's DNS settings plus a few switches in the platform. It takes an hour or two when someone knows where to click. These are technical rules, not law, but breaking them sends your emails to spam or gets them rejected. Any decent email platform walks you through the setup.
A pre-send checklist
| Check | Why |
|---|---|
| Sender name and address are your business | Header accuracy |
| Subject line matches the content | No deception |
| Message clearly promotional where it is an ad | Ad identification |
| Postal address in the footer | Required for commercial email |
| Unsubscribe link visible and tested | Opt-out requirement |
| Unsubscribes sync to every list and tool | 10-business-day rule across systems |
| SPF, DKIM, DMARC in place | Deliverability |
| List built from customers and sign-ups | Reputation, lower complaints |
The sync point catches many small businesses. If someone unsubscribes from your newsletter tool but stays in a CRM sequence that sends promotions, you are still emailing them. Make one system the source of truth for opt-outs.
Common mistakes I see
- Purchased or scraped lists. Legal in a narrow sense under CAN-SPAM, but bad for deliverability and often against platform terms.
- "Reply to unsubscribe" that nobody reads. If you offer it, someone must process the replies.
- Unsubscribe that requires a login. Not allowed.
- Old footers. You moved, the footer still shows the old address.
- Promotions inside "transactional" emails. Treat them as commercial if the promotion dominates.
Email and texting together
Many businesses run email and SMS from the same platform. The rules for texts are very different and stricter: marketing texts generally require prior express written consent under the TCPA. Read SMS marketing and the TCPA before you add texting to your campaigns.
Getting it set up properly
I set up email marketing for small businesses: platform, domain authentication, sign-up forms with clear consent wording, welcome and follow-up automations, and templates with compliant footers. Email and SMS work is quoted individually after a short call; you can see what is included on the email marketing page. If you are wondering what a program costs in total, see how much email marketing costs, and for content once the setup is done, there are 30 newsletter ideas.
Have a customer list?
Let’s turn it into sales
30 minutes, free: I look at your contact list and suggest your first 3 messages.
12+ years in online marketing, 100+ clients. I build websites, Google Ads and Meta ads campaigns, CRMs and automations for small and mid-sized businesses. About me →
CAN-SPAM questions
Do I need permission to send marketing emails in the US?
CAN-SPAM itself does not require opt-in consent; it is an opt-out law. In practice, sending to people who never asked to hear from you hurts deliverability and your reputation with inbox providers. Build your list from customers and people who signed up, and keep proof of how each address was collected.
Does CAN-SPAM apply to B2B emails?
Yes. The law covers commercial email messages in general, including those sent to other businesses. There is no exemption for business-to-business marketing, so the same rules on headers, subject lines, address and unsubscribe apply.
Can I use a PO box as my postal address?
Generally yes. The FTC accepts a current street address, a post office box registered with the US Postal Service, or a private mailbox registered with a commercial mail receiving agency under postal regulations. Many home-based businesses use one of the last two.
What about customers outside the US?
If you email people in the EU, the UK or other countries, their laws may apply and are usually stricter, with opt-in consent as the default. If a meaningful share of your list is outside the US, ask your attorney which rules cover those contacts.
Want an email setup
that stays compliant?
I set up email platforms, sign-up forms, automations and templates with the legal basics built in. Tell me what you send today and I will suggest the next steps.