CAN-SPAM Act Compliance for Email Marketing

The Controlling the Assault of Non-Solicited Pornography And Marketing Act was enacted in 2003 and is enforced by the FTC. It's the primary federal law governing commercial email in the U.S.

One thing that surprises many small business owners: CAN-SPAM does not require you to get permission before emailing someone. Unlike Canada's CASL or Europe's GDPR, the U.S. law operates on an opt-out model, not an opt-in model. You can legally send commercial email to people who haven't explicitly subscribed — as long as you follow the rules and stop when they ask you to.

That said, "legal" and "smart" aren't always the same thing. Cold emailing people who didn't ask to hear from you tends to produce poor results and high spam complaint rates. But the question here is about legal compliance, and CAN-SPAM sets the floor.

What the law covers: any electronic mail message whose primary purpose is commercial advertisement or promotion of a product or service. It applies to B2B email just as much as B2C. It applies to emails sent on your behalf by a third party (like an agency or email service provider). There are no carve-outs for small businesses.

1. Accurate header information. Your "From," "To," and "Reply-To" fields must accurately identify you. The originating domain and email address must be real and traceable back to the sender. Using a fake or misleading "From" name — like making an email look like it came from a personal friend or a government entity when it didn't — is a direct CAN-SPAM violation, and one that gets scrutinized heavily.

2. Honest subject lines. The subject line must reflect the actual content of the email. A subject line that actively misleads the reader about what's inside — like "Re: our conversation" when there was no conversation — is a violation.

3. Identify it as an ad. If the email is commercial in nature and the recipient hasn't given you their affirmative consent (i.e., they didn't subscribe to your list), you must clearly identify it as an advertisement. The law gives you flexibility here — there's no required language — but it must be clear.

4. Include your physical address. Every commercial email must include your valid physical postal address. This can be a street address, a USPS-registered P.O. box, or a private mailbox registered with a commercial mail receiving agency. If you work from home and don't want to share your home address, a P.O. box is perfectly acceptable here. This requirement catches a surprising number of small business owners off guard. Check your email templates right now — if there's no physical address in the footer, you're technically out of compliance.

5. Provide a clear unsubscribe mechanism. Every commercial email must include a clear, easy-to-find way for recipients to opt out of future marketing emails. You cannot require a recipient to log in to unsubscribe. You cannot charge a fee. You cannot require them to provide more information than their email address. The process must be as simple as possible — one click, one page, done.

6. Honor opt-out requests promptly. Once someone unsubscribes, you have 10 business days to stop sending them marketing emails. Your unsubscribe mechanism must remain functional for at least 30 days after the email is sent. And once someone opts out, you cannot sell or transfer their email address to another marketer — except to a company you've hired specifically to help you process opt-outs. This is one of the most commonly violated provisions.

7. Monitor what others do on your behalf. If you hire an agency, freelancer, or email marketing platform to run campaigns for you, you share legal responsibility for compliance. You can't hand off your list to a third party and disclaim responsibility when they violate the rules. Both you and your service provider can be held liable.

8. Be careful with mixed content. If your email contains both promotional content and transactional content (like a receipt plus an upsell), the FTC evaluates the "primary purpose" of the message. If the subject line implies promotional content, or if the promotional material appears before the transactional content, the primary purpose is considered commercial and all CAN-SPAM rules apply.

Transactional and relationship emails — like order confirmations, shipping notifications, password resets, and account updates — are exempt from most CAN-SPAM requirements. They still cannot have false or misleading header information, but they don't need an unsubscribe link.

The catch: you cannot dress up a promotional email as a transactional one. If your "order confirmation" email happens to contain three product recommendations and a discount code, and those elements appear more prominently than the actual order information, the FTC will likely view it as primarily commercial.

CAN-SPAM explicitly preempts most state email laws — but it does not preempt state laws that target fraud, deception, or computer security. More importantly, it doesn't preempt the growing body of state privacy laws.

If you're collecting email addresses from California residents, CCPA compliance applies. Other state privacy laws — Virginia, Colorado, Connecticut, Texas, and more — have their own data handling rules. CAN-SPAM tells you how to send an email; state privacy laws tell you how to handle the data behind it.

The practical takeaway: if you're using an email marketing platform with robust opt-in forms, double opt-in confirmation, and clean unsubscribe management, you're handling most of this correctly. If you're manually managing a spreadsheet of email addresses and batch-sending campaigns, you need to tighten things up.

Using a purchased or rented email list without proper vetting. Even if the list vendor claims everyone opted in, you have no way to verify that, and you're on the hook for compliance.

No physical address in email templates. Go check yours. Right now. This is an easy fix.

Unsubscribe links that don't work or go to broken pages. Test them regularly. A non-functional unsubscribe link is a violation.

Waiting too long to process opt-outs. If you're using a reputable email service provider (ESP) like Mailchimp, ConvertKit, or ActiveCampaign, this is usually handled automatically. If you're managing lists manually, you need a real process.

Re-adding people who unsubscribed. Once someone opts out, they're out. Don't re-add them because you "cleaned your list" or migrated to a new platform.

The baseline for any solopreneur doing email marketing:

1. Use a reputable ESP that handles unsubscribes automatically and provides compliant footer templates. 2. Add your physical address to every email footer — either your business address or a P.O. box. 3. Use honest subject lines that reflect the actual content. 4. Don't mask your "From" name — use your real name or business name. 5. Test your unsubscribe flow every few months to make sure it works. 6. Maintain your suppression list — a record of everyone who's opted out. 7. If you use an agency or freelancer, include CAN-SPAM compliance as an explicit requirement in your agreement.

CAN-SPAM is the legal floor. Operating right at the floor isn't a great strategy — audiences who feel annoyed by your emails will eventually tune you out, report you as spam, or damage your sender reputation. The businesses that get the most out of email marketing are the ones that treat their list with respect: clear opt-in processes, consistent value delivery, and easy unsubscribes for anyone who's done.

Take action today: Review your email footer template, verify your unsubscribe link works, and check that you have a physical address in every outgoing commercial message. Those three things alone will put you ahead of a large percentage of small business email senders.

US senders also face GDPR when EU subscribers join the list, and your signup forms should match your privacy policy. Affiliate promos in email add FTC disclosure duties on top.