Which emails it covers
The FTC says the law covers all commercial messages, not only bulk mail, and makes no exception for business-to-business email. A single sales email from your normal inbox to a company address counts. What decides the rules is the primary purpose of the message, and the FTC sorts content into three kinds:
- Commercial: advertises or promotes a commercial product or service. All eight requirements apply.
- Transactional or relationship: confirms a purchase the recipient agreed to, gives warranty, recall, safety or security information about something they bought, reports changes to an account, subscription or loan, gives regular balance information, covers employment or benefits, or delivers goods or services already agreed to. These messages may not contain false or misleading routing information, but are otherwise exempt from most provisions.
- Other: neither of the above.
Mixed messages are where people slip. If the subject line would make the recipient think the email is commercial, it is commercial for CAN-SPAM purposes. If the transactional part does not appear at the beginning, it is commercial too. An order confirmation that opens with a banner for next week's sale and puts the order details at the bottom has turned itself into an ad. The FTC adds that it reads the transactional categories narrowly.
The eight requirements, with a compliant example each
The FTC's guide lists eight main requirements. The third column shows one way to meet each; the law gives you leeway in how, for example, you label an email as an ad.
| # | Requirement | What it means | Compliant practice |
|---|---|---|---|
| 1 | No false or misleading header information | From, To, Reply-To and routing must be accurate and identify who sent it | From: Trail Shop <news@example.com>, sent from a domain you control |
| 2 | No deceptive subject lines | The subject must match what the email is about | "20% off rain jackets until Sunday" on an email about that sale |
| 3 | Identify the message as an ad | Disclose clearly and conspicuously that it is an advertisement | A visible line such as "Advertisement from Trail Shop" near the top |
| 4 | Say where you are located | Include a valid physical postal address | Footer with a street address, a USPS PO box or a registered private mailbox |
| 5 | Explain how to opt out | A clear notice and a return email or easy web-based way to say no | An "Unsubscribe" link in the footer; a preference menu that also has "stop all" |
| 6 | Subscribers and members can opt out too | Being a customer or member does not remove the right to opt out of marketing | Paying members get the same unsubscribe link in promotional emails |
| 7 | Honor opt-outs promptly | Within 10 business days; no fee, no extra personal data, no selling the address | One-page unsubscribe that asks only for the email address and updates the list daily |
| 8 | Monitor what others do for you | Hiring a sender or affiliate does not move your legal responsibility | Your contract requires partners to use your suppression list, and you check their sends |
Two details are easy to miss. The postal address can be a current street address, a PO box registered with the US Postal Service, or a private mailbox registered with a commercial mail receiving agency under Postal Service rules. And a preference menu that lets people drop only certain kinds of email is allowed, as long as it also offers a way to stop all marketing messages from you.
The opt-out deadlines on a calendar
Two clocks start when you send. The opt-out mechanism must work for at least 30 days after the message goes out, and once someone asks to be removed you have 10 business days to stop emailing them. You cannot charge a fee, ask for personal information beyond the email address, or make people do more than reply to an email or visit a single web page.
Example: a newsletter goes out on Mon, Sep 14, 2026. A reader clicks unsubscribe the next day, Tue, Sep 15, 2026. Counting 10 business days, Monday to Friday, the last day to honor the request is Tue, Sep 29, 2026; there is no public holiday in that window. The unsubscribe link in that newsletter must still work on Wed, Oct 14, 2026, 30 days after sending. The add or subtract days tool does this count for any date, with a business days option.
Ten business days is a ceiling, not a target, and the risk is rarely the main unsubscribe link. It sits elsewhere: in replies that say "remove me" and land in a shared inbox, or in a second tool, such as a CRM or a sales sequence, that never got the suppression list. If unsubscribe requests arrive as emails, the email extractor pulls every address out of a pasted batch so you can add them to the suppression list in one go.
What a violation costs
The FTC says each separate email in violation is subject to penalties of up to $53,088. Because the maximum applies per email, it scales with the send. These are ceilings, not what a court would actually order:
| Emails in violation | Maximum penalty |
|---|---|
| 1 | $53,088 |
| 100 | $5,308,800 |
| 1,000 | $53,088,000 |
| 10,000 | $530,880,000 |
Responsibility is shared. The FTC says both the company whose product is promoted and the company that sends the message may be held legally responsible. When several advertisers share one email, they can designate one of them as the sender, but that sender has to be named in the From line, and if it fails its duties all of them may be held liable.
How this differs from the EU approach
CAN-SPAM works on an opt-out basis: none of its eight requirements asks for permission before the first email. The EU starts from the other end. The official Your Europe portal tells consumers that their prior consent is required for direct marketing emails, and that it is not enough to simply opt out; they have to opt in.
| Question | CAN-SPAM (FTC guide) | EU (Your Europe) |
|---|---|---|
| Before the first email | No consent step among the requirements | Prior consent required |
| Existing customers | Same rules; they can opt out too | A company you buy from may email about its own similar products |
| Stopping | Honor within 10 business days | Right to object at any time; the company must stop |
If your list includes people in the EU, design for the stricter rule: a sign-up form with an unticked box, a record of when each person opted in, and an unsubscribe link in every email. This page is general information, not legal advice; for a specific campaign, check the rules of each country you send to.
Checklist before you hit send
- From and Reply-To show your business name and a domain you control. Setting up domain authentication is a separate job; SPF, DKIM and DMARC explains the three records.
- Subject line says what is inside. The email subject line checker shows length, capitals, punctuation and an inbox preview before you send.
- Ad label is visible, not hidden in gray text.
- Postal address is in the footer. For one-to-one sales emails from a normal inbox, put it in your signature with the email signature generator.
- Unsubscribe link works, needs one page at most, and has a "stop all" option.
- Suppression list is shared with every tool and partner that sends for you.
- Tracking links built with the UTM builder still lead where the link text says they do.
For services that handle sending, list hygiene and unsubscribes, see the free email marketing tools list.
Frequently asked questions
Does CAN-SPAM require permission before I send marketing email?
None of the eight requirements in the FTC compliance guide asks for consent before the first email; they govern how you send and how people stop you. The rules elsewhere can be stricter. In the EU, for example, the official Your Europe portal says prior consent is required for direct marketing emails.
How fast do I have to process an unsubscribe?
The FTC says you must honor an opt-out request within 10 business days. Your opt-out mechanism also has to keep working for at least 30 days after you send the message, so a link that expires after a week is not enough.
Does CAN-SPAM apply to business-to-business email?
Yes. The FTC states that the law makes no exception for business-to-business email, and that it covers all commercial messages, not only bulk mailings. A sales email sent from a normal inbox to a company address is covered if its primary purpose is commercial.
Are order confirmations and receipts covered?
A message whose content is only transactional or relationship content, such as an order confirmation or a warranty or recall notice, is exempt from most provisions, but it may not contain false or misleading routing information. If the subject line makes it look like an ad, or the transactional part does not come first, the FTC treats it as a commercial message.
What is the penalty for breaking CAN-SPAM?
The FTC compliance guide says each separate email in violation is subject to penalties of up to $53,088. The figure is adjusted for inflation from time to time, so check the FTC page for the current maximum.
Can I sell or share my email list?
Not the addresses of people who have opted out. The FTC says you cannot sell or transfer those addresses; the only exception it names is passing them to a company you hired to help you comply with the law.
Sources
- FTC: CAN-SPAM Act, A Compliance Guide for Business (the eight main requirements, 10 business days to honor opt-outs, opt-out working for 30 days, no fee or extra data to opt out, no selling opted-out addresses, penalties of up to $53,088 per email, no B2B exception, the five kinds of transactional content and the primary purpose test, designated sender)
- Your Europe (European Union): Data protection and online privacy (prior consent for direct marketing emails, opting out is not enough, the exception for similar products from a company you buy from, the right to object at any time)