CAN-SPAM requirements in plain English

The short answer

The CAN-SPAM Act sets the US rules for commercial email. According to the FTC, every marketing email must: use accurate From, To and Reply-To details; have a subject line that reflects the content; identify the message as an ad; include a valid physical postal address; include a clear way to opt out; honor opt-out requests within 10 business days; and stay compliant even when a vendor sends it for you. Each email that breaks the law can bring a penalty of up to $53,088, the current inflation-adjusted maximum, last set in January 2025 (16 CFR 1.98).

CAN-SPAM does not require opt-in consent before you send. That is the biggest difference from Canada’s CASL and Europe’s GDPR-era rules, which generally do. This article is general information, not legal advice. Confirm your specific situation with counsel.

The requirements, one by one

1. No false or misleading header information. The From name, email address, Reply-To and routing must identify who actually sent the message. Use your business name or a recognizable person at your business.
2. No deceptive subject lines. The subject must reflect what the email is about. “Re: your order” on a promotion fails this test.
3. Identify the message as an ad. The FTC says the disclosure must be clear and conspicuous. The law gives some leeway in how you do it, but the reader should be able to tell they are getting marketing.
4. Include your physical postal address. A street address, a post office box registered with the US Postal Service, or a private mailbox registered with a commercial mail receiving agency.
5. Tell recipients how to opt out. Explain clearly how to stop future marketing emails. You can offer a menu of topics, but one option must stop all marketing messages. Make sure your spam filters do not block replies asking to opt out.
6. Honor opt-outs promptly. The opt-out must work for at least 30 days after you send, and you must act on requests within 10 business days. You cannot charge a fee, ask for more than an email address, or make people do more than reply or visit one web page. After someone opts out, you may not sell or transfer their address.
7. Monitor anyone who sends on your behalf. The FTC is explicit that you cannot contract away responsibility. Both the company promoted and the company that sends the message can be held liable.

Which emails CAN-SPAM covers

The law applies to commercial messages: email whose primary purpose is to advertise or promote a product or service. That includes business-to-business email. There is no exemption for B2B.

Transactional or relationship messages, such as order confirmations, receipts, account notices, warranty information and changes to terms, are largely exempt, but their routing information must still be accurate. The FTC reads the transactional category narrowly. An email that mixes a receipt with promotions is judged by its primary purpose: if a reasonable reader of the subject line would expect an ad, or the transactional part is not mostly at the start, it is treated as commercial.

Penalties and who is liable

Each separate email in violation can bring a civil penalty of up to $53,088, according to the FTC’s compliance guide and the inflation-adjusted amount set in January 2025. That adds up quickly on a list of thousands. Certain aggravated conduct, such as using false identities or hijacked computers to send, can bring criminal penalties including prison.

Liability is shared. If you hire an agency or use a platform, you are still responsible for what is sent in your name. When several businesses are promoted in one email, they may designate one as the sender, but if that sender does not meet its duties, all of them can be liable.

Want a second opinion on your email?

Book a free 30-minute call. We check your templates, footers, unsubscribe handling and sending setup with you and tell you what we would change first. No obligation. Pick a time.

CAN-SPAM vs GDPR and CASL

If any of your subscribers are in Canada, the UK or the EU, US rules are only the floor.

• Consent. CAN-SPAM lets you email until someone opts out. Canada’s government guidance says CASL requires consent before sending, either express (no expiry unless withdrawn) or implied in limited cases, which may last up to 2 years for an existing business relationship or 6 months after an inquiry. The UK’s ICO says individuals generally must give specific consent, with a “soft opt-in” exception for existing customers who bought something similar and were offered an opt-out.
• Identification. CASL requires your business name, a mailing address and a phone number, email or website, valid for at least 60 days after sending.
• Unsubscribes. CASL also sets 10 business days, at no cost to the recipient.
• Business recipients. UK rules allow emailing corporate bodies without prior consent, but sole traders and some partnerships are treated as individuals.
• Fines. Under the GDPR, which governs the personal data behind email marketing in the EU, the highest fine tier is up to 20 million euros or 4% of worldwide annual turnover, whichever is higher. CASL also carries significant administrative penalties.

The practical rule for a small business with any international audience: collect clear opt-in consent at signup, store when and where it happened, and follow the strictest rule that applies to each subscriber.

Inbox rules that go beyond the law

Gmail now enforces its own sender requirements, which matter as much as the law for whether your email arrives. Google’s sender guidelines require bulk senders (5,000+ messages a day to Gmail) to authenticate with SPF, DKIM and DMARC, support one-click unsubscribe in marketing messages along with a visible unsubscribe link, and keep spam rates below 0.30%, ideally below 0.10%. Meeting these is good practice at any volume.

A compliance checklist for every send

• From name and address are your business and a monitored mailbox.
• Subject line matches the content.
• Footer includes your postal address and an unsubscribe link that works.
• Unsubscribes sync to every system that sends email, including your CRM and any agency tools, within 10 business days.
• Imported lists contain only people who opted in, and previous unsubscribes are suppressed.
• Sending domain has SPF, DKIM and DMARC records.
• International subscribers have a recorded opt-in.

How JLB USA helps

JLB USA runs email marketing on MailChimp, Klaviyo and HubSpot for growing businesses. We set up compliant templates and footers, connect unsubscribes across your systems through systems integration, and configure your sending domain. For legal questions, we work alongside your counsel rather than replacing them. More on the basics: email marketing for Fort Lauderdale businesses.

Keep reading

• Email campaign open rate benchmarks, and why opens mislead
• How to build a welcome email series: emails, timing and examples
• How to build an email list for a small business (the ethical way)
• Email marketing for Fort Lauderdale businesses: what to send and how to get it delivered

Related services

• Email marketing
• Systems integration
• Email marketing for Fort Lauderdale businesses