The CAN-SPAM Act is the US law that sets the rules for commercial email. Prior permission isn't among its requirements, but every marketing email must have honest headers and subject lines, identify itself as an ad, include your physical postal address and a working opt-out, and opt-outs must be honoured within 10 business days.
That's the big difference from the UK, Canada and Australia, which generally need consent first. CAN-SPAM works on opt-out: the FTC describes it as giving recipients the right to have you stop emailing them. But the FTC is clear that it applies to more than bulk email, it makes no exception for business-to-business email, and each separate email that breaks it can carry a penalty of up to $53,088 as of October 2026. Here's what it asks of you.
The 7 CAN-SPAM requirements
- Don't use false or misleading header information: From, To, Reply-To and routing details must be accurate and identify who sent it.
- Don't use deceptive subject lines: the subject must reflect the content.
- Identify the message as an ad: you have leeway on how, but it must be clear and conspicuous.
- Tell recipients where you're located: include a valid physical postal address, which can be a street address, a registered PO box or a registered private mailbox.
- Tell recipients how to opt out, in a way an ordinary person can recognise, read and understand.
- Honour opt-outs promptly: within 10 business days, and keep your opt-out working for at least 30 days after you send.
- Monitor what others do on your behalf: hiring an agency or platform doesn't transfer your legal responsibility.
The opt-out rules have extra detail. The FTC says you can't charge a fee, ask for any personal information beyond an email address, or make people do anything more than reply to an email or visit one web page to opt out. And once someone opts out, you can't sell or transfer their address, except to a company you've hired to help you comply.
Commercial, transactional or both?
CAN-SPAM covers commercial messages: any email whose primary purpose is advertising or promoting a commercial product or service, including email that promotes content on a commercial website. Transactional or relationship emails, such as order confirmations, account changes or delivering something the person already agreed to, are exempt from most rules, though their routing information still has to be truthful.
This is the insight most marketers miss. The FTC says you shouldn't assume every email to existing customers or members is transactional. If an email mixes both, it's treated as commercial if the subject line would lead the reader to think it's an ad, or if the transactional part doesn't appear mainly at the beginning. So an invoice reminder with a promo banner at the top and the account details at the bottom is a marketing email under the Act.
| Likely treatment under the FTC's guidance | |
|---|---|
| Order confirmation or shipping update | Transactional: truthful routing required, most other rules don't apply |
| Newsletter promoting your products or paid content | Commercial: all 7 requirements apply |
| Account notice first, short promo at the end, neutral subject | Likely transactional |
| Promo subject line, account details lower down | Commercial |
| Cold email to a business contact | Commercial: there's no B2B exception |
Who's responsible when someone else sends
The FTC is direct about this: even if you hire another company to handle your email marketing, you can't contract away your legal responsibility to comply. If an agency, an affiliate or a platform sends promotional emails for your business, check their footers, subject lines and unsubscribe handling as if you'd written them yourself, because the FTC says the responsibility stays with you. Ask for a sample of every template before it goes out, and get a copy of the unsubscribe list each month. The same goes for any list you pass to a partner: addresses that have opted out can't be sold or transferred, so scrub them before you share anything.
How CAN-SPAM compares with other countries
If you email people outside the US, their law applies to them, and most are stricter. The UK's PECR, Canada's CASL and Australia's Spam Act are built around consent. My guides to the UK PECR email rules, Canada's CASL and Australia's Spam Act cover what each one needs. If your list is international, the safest default is to collect consent for everyone and apply CAN-SPAM's footer and opt-out rules on top.
A CAN-SPAM checklist for your next send
- Your From name and address clearly identify your business
- The subject line describes what's inside
- It's clear the email is promotional
- Your postal address is in the footer
- The unsubscribe link works without a login, and your spam filter doesn't block opt-out replies
- Unsubscribes sync to every tool you send from within 10 business days
- Any agency or affiliate sending for you follows the same rules
My verdict
CAN-SPAM is the easiest of the major email laws to meet, which is exactly why businesses trip over it: they assume no consent rule means no rules. Put your address in the footer, write honest subject lines, make unsubscribing a single step, and treat any email with a promo up top as marketing. If you email outside the US, build for consent anyway.
Texting customers as well as emailing them? The US has a separate rule for calls and texts, and our TCPA guide explains it.
Want AI doing the heavy lifting in your marketing?
I build the systems that handle the boring 80 percent, so you get your week back. Done properly, with the human kept in.
Frequently asked questions
What is the CAN-SPAM Act?
It's the US law that sets the rules for commercial email, gives recipients the right to stop emails, and sets penalties for violations, according to the FTC.
Does CAN-SPAM require consent before emailing?
Prior consent isn't one of the requirements in the FTC's compliance guide. Instead, every commercial email must meet the Act's rules, including a working opt-out that's honoured within 10 business days.
How fast must I honour an unsubscribe under CAN-SPAM?
The FTC says you must honour a recipient's opt-out request within 10 business days.
Does CAN-SPAM apply to B2B email?
Yes. The FTC says the law makes no exception for business-to-business email.
Do I need a physical address in marketing emails?
Yes. Your message must include a valid physical postal address, which can be a street address, a registered PO box or a registered private mailbox.
What is the penalty for violating CAN-SPAM?
As of October 2026, the FTC says each separate email in violation is subject to penalties of up to $53,088.
Are transactional emails covered by CAN-SPAM?
Transactional or relationship messages are exempt from most provisions, but they still can't contain false or misleading routing information.
