You've probably sent hundreds maybe thousands of commercial emails without thinking twice about the law behind them. That's how most marketers operate. Until they get a compliance notice, a deliverability crash, or worse.
The CAN-SPAM Act has been federal law since 2003, but enforcement is anything but outdated. In August 2024, the FTC issued its largest-ever CAN-SPAM penalty a $2.95 million fine against security camera company Verkada, specifically for sending commercial emails without proper unsubscribe options. That single case put the entire email marketing industry on notice: the FTC is actively watching, and even well-known companies aren't immune.
Each separate email in violation of the CAN-SPAM Act is subject to penalties of up to $53,088 and more than one person may be held responsible for the same violation.
The good news? The rules themselves are straightforward. This guide breaks down all 7 CAN-SPAM Act requirements, what each one actually means in practice, and the specific mistakes that get senders in trouble.
Key Takeaways:
- CAN-SPAM is a U.S. federal law that allows commercial emails by default, but requires senders to include honest headers, clear identification, and a working opt-out — or face fines of up to $53,088 per email.
- CAN-SPAM applies to B2B email too — if the primary purpose is commercial, the law applies regardless of your audience.
- Missing or broken unsubscribe links don't just risk fines — they directly damage your sender reputation and inbox placement.
- If you use agencies or third-party tools to send email, you are still legally responsible for their compliance.
- The FTC issued its largest-ever CAN-SPAM fine in 2024 — $2.95 million against Verkada — signaling active and ongoing enforcement.
What Is the CAN-SPAM Act?
CAN-SPAM stands for Controlling the Assault of Non-Solicited Pornography And Marketing. It is a U.S. federal law that sets nationwide standards for sending commercial electronic mail, designed to reduce unsolicited commercial email while still allowing legitimate businesses to reach customers and giving recipients the right to opt out of future marketing emails.
Two things about CAN-SPAM that most senders get wrong:
It applies to B2B email too. The law makes no exception for business-to-business email a message to former customers announcing a new product line, for example, must comply with the law. If the primary purpose of your email is commercial, CAN-SPAM applies. Full stop.
It covers third-party senders. Liability isn't limited to a single entity more than one person may be held responsible for violations. Individual employees, managers, or third-party service providers involved in the email marketing process could face penalties if they facilitated activities that violate the CAN-SPAM Act.
Now, the 7 requirements.
The 7 CAN-SPAM Act Requirements
Rule 1: Don't Use False or Misleading Header Information
Your "From," "To," "Reply-To," and routing information must accurately identify the person or business sending the email. This means no fake sender names, no spoofed domains, and no routing the message through another party's server to disguise its origin.
Aggravated violations under CAN-SPAM include spoofing disguising sender information to appear to come from a known source to trick recipients and these carry criminal penalties beyond standard civil fines.
What this looks like in practice: Your "From" name should match your brand. Your reply-to address should be real and monitored. If you're sending on behalf of a client, that relationship needs to be transparent not hidden.
Rule 2: Don't Use Deceptive Subject Lines
Your subject line must accurately reflect the content of the email. Writing "Re: Your account" on a cold outreach email, or "Your order has shipped" on a promotional message, violates this rule directly.
This isn't just a legal issue. 71% of consumers mark emails as spam based solely on the "from" name and subject line. Deceptive subject lines don't just expose you to fines they train your audience to distrust and report you, which destroys sender reputation over time.
What this looks like in practice: If your email is a promotion, the subject line should indicate it's a promotion. If it's a product announcement, it should read like one. Curiosity-gap tactics are fine; deception is not.
Rule 3: Identify the Message as an Advertisement
The CAN-SPAM Act requires senders to clearly disclose when an email is a commercial advertisement or promotional message. The law gives flexibility in how this is done it doesn't mandate exact wording but the disclosure must be clear and conspicuous somewhere in the email.
What this looks like in practice: A line in the email footer such as "This email contains promotional content from [Company Name]" satisfies this requirement. Many senders include it as part of their standard footer template so it's never accidentally omitted.
Rule 4: Tell Recipients Where You're Located
Every commercial email must include a valid physical postal address. This can be:
- Your current street address
- A registered P.O. Box
- A private mailbox registered with a commercial mail receiving agency
A working and up-to-date physical postal address in the footer is one of the core requirements of the CAN-SPAM Act checklist for 2025 and 2026.
What this looks like in practice: This goes in your email footer on every single send not just your newsletter, but cold outreach, promotional campaigns, and follow-up sequences. There are no exceptions.
Rule 5: Tell Recipients How to Opt Out of Future Emails
Every commercial email must include a clear, conspicuous mechanism that allows recipients to opt out of future messages. The unsubscribe option must be:
- Easy to find — not buried in 6pt gray text at the bottom
- Functional — the link must actually work
- Free — you cannot charge a fee or require any account creation to unsubscribe
- Simple — you cannot require the recipient to provide information beyond their email address
45% of email recipients cite a difficult unsubscribe process as their reason for marking an email as spam. A broken or hidden unsubscribe link doesn't just violate the CAN-SPAM Act — it directly feeds spam complaints that damage your deliverability.
What this looks like in practice: A clearly labeled "Unsubscribe" link in your footer is the standard. One click should initiate the process. Don't make recipients log in, fill out a form, or wait more than 10 business days.
Rule 6: Honor Opt-Out Requests Promptly
Once a recipient opts out, you must stop sending them commercial email within 10 business days. After that deadline, you cannot:
- Transfer or sell their email address to another list
- Use their address for any other commercial email purpose
- Require them to do anything beyond submitting their opt-out request
This rule catches many senders off guard when they use multiple sending tools or CRMs that aren't properly synced. If a contact unsubscribes from one sequence but remains active in another system, you're still in violation.
What this looks like in practice: Your unsubscribe list needs to be centralized and synced across every platform you use for sending your ESP, your CRM, your cold outreach tool. Opt-out requests should be automatically synced across all platforms the moment they're received, not manually processed at the end of the week.
Rule 7: Monitor What Others Do on Your behalf
If you work with an agency, contractor, or email marketing platform to run your campaigns, you remain legally responsible for their compliance with the CAN-SPAM Act.
Both the company whose product is promoted in the message and the company that originated the message may be legally responsible for violations. This is one of the most overlooked aspects of CAN-SPAM compliance especially for businesses that outsource their email marketing entirely.
What this looks like in practice: Before engaging any third-party sender, confirm they follow all 7 CAN-SPAM requirements. Review their processes for handling opt-outs. Make sure their unsubscribe mechanisms meet the standard. "We didn't know what our agency was doing" is not a legal defense.
CAN-SPAM Penalties: What Non-Compliance Actually Costs
The penalty structure under the CAN-SPAM Act is per email, not per campaign. That distinction matters enormously.
The FTC can impose fines of up to $53,088 per violating email, and these penalties can add up quickly if email marketing practices are not up to standard. For a campaign sending to 10,000 contacts with a broken unsubscribe link, the theoretical exposure runs into the hundreds of millions.
Beyond civil fines, certain violations carry criminal consequences. Aggravated violations including address harvesting, dictionary attacks to generate email lists, and spoofing — can result in criminal penalties including up to five years imprisonment.
And enforcement is active. The FTC's $2.95 million penalty against Verkada in 2024 the largest CAN-SPAM fine in history signals a renewed focus on enforcement, and serves as a direct reminder for businesses to review their email compliance practices.
Tip: If you want a clearer understanding of the rules behind email marketing, check out our email marketing compliance guide.
CAN-SPAM vs. GDPR: Why U.S. Senders Can't Ignore European Law
The CAN-SPAM Act sets the floor for U.S. email compliance — but if any of your subscribers are based in the EU, GDPR applies on top of it, and it operates very differently.
If you're running outbound campaigns to mixed global audiences, applying GDPR's stricter opt-in standard globally is the safest approach. It keeps you compliant across jurisdictions without having to segment your practices by geography.
CAN-SPAM Compliance Checklist
Before every send, confirm:
- ☑ "From" name and email address accurately identify your organization
- ☑ Subject line honestly reflects the email's content
- ☑ Email is labeled as an advertisement or commercial message
- ☑ Physical mailing address is included in the footer
- ☑ Unsubscribe link is visible, functional, and one-click
- ☑ Opt-out mechanism requires no fee, login, or extra information
- ☑ Unsubscribe list is synced across all sending platforms
- ☑ Opt-out requests will be honored within 10 business days
- ☑ Third-party senders are confirmed to be CAN-SPAM compliant
Conclusion
The 7 CAN-SPAM Act requirements aren't complicated. No misleading headers. Honest subject lines. Identify commercial intent. Include your address. Make unsubscribing easy. Honor opt-outs fast. Own what your partners do on your behalf.
What makes CAN-SPAM compliance fail in practice isn't ignorance of the rules it's operational gaps. A broken unsubscribe link. An unsync'd CRM. A third-party agency that skips the footer. These are the things that generate complaints, kill deliverability, and attract FTC attention.
Run the checklist above before every campaign. Audit your opt-out flow quarterly. Make compliance a default part of your sending process not an afterthought when something goes wrong.
