CAN-SPAM Act Requirements Explained

Every commercial email sent in the United States must comply with federal law. The CAN-SPAM Act requires accurate sender information, truthful subject lines, clear advertisement disclosure, a physical mailing address, a working unsubscribe option, prompt handling of opt-out requests, and oversight of any third party sending on your behalf. Violations can result in FTC fines exceeding $53,000 per individual email. Here's what newsletter creators, marketers, and business owners need to know to stay compliant in 2026.

What Is the CAN-SPAM Act?

The CAN-SPAM Act is the primary federal law governing commercial email in the United States. Congress passed it in 2003 to combat deceptive and unwanted bulk email that was overwhelming inboxes, and the FTC has enforced it continuously since. The law does not ban commercial email. Instead, it sets rules for how senders must identify themselves, label their messages, and allow recipients to opt out.

The statute lives in federal code as 15 U.S.C. Chapter 103, originally enacted as Public Law 108-187. It applies to any email whose primary purpose is commercial advertising or promotion of a product or service, whether sent to one person or ten million.

What Does CAN-SPAM Stand For?

CAN-SPAM stands for "Controlling the Assault of Non-Solicited Pornography And Marketing Act." Despite its name, it doesn't ban commercial email. Instead, it establishes the conditions under which unsolicited commercial email can legally be sent, as long as senders follow its rules. The FTC's three-minute video explanation covers the name and seven core obligations in practical terms.

Who Enforces CAN-SPAM?

The Federal Trade Commission is the primary enforcer and brings most civil penalty actions against violators. The Federal Communications Commission has a narrower role: it writes rules under the Act that apply to commercial mobile messages, including text messages to wireless devices. State attorneys general and internet service providers also have standing to sue under the Act, according to the statute's enforcement provisions.

Is CAN-SPAM Still Enforceable in 2026?

Yes. The CAN-SPAM Act remains fully in effect. Congress has not repealed or replaced it, and the FTC continues to adjust civil penalty amounts annually and bring enforcement actions. No federal law has superseded it, so it remains the baseline legal standard for commercial email in the United States, even as individual states and other countries pass stricter privacy rules.

The 7 Core CAN-SPAM Act Requirements

If you send commercial email in the US, follow these seven rules:

1. Don't use false or misleading header information. Your "From," "To," and routing information must accurately identify the person or business that initiated the message.
2. Don't use deceptive subject lines. The subject line can't misrepresent the message's content.
3. Identify the message as an advertisement. Make clear and conspicuous disclosure that the email is a commercial advertisement or solicitation.
4. Tell recipients where you're located. Every commercial email needs a valid physical postal address.
5. Provide a clear and working opt-out mechanism. Recipients need an easy way to tell you they don't want future emails.
6. Honor opt-out requests within 10 business days. Once someone unsubscribes, don't email them again after that window closes, except for narrow legal exceptions.
7. Monitor what third parties do on your behalf. You bear legal responsibility even if another company or affiliate sends the email for you.

1. Don't Use False or Misleading Header Information

The header is everything that routes and identifies an email: the "From," "To," "Reply-To," and originating domain and email address. This information must be accurate and must identify the person or business that actually initiated the message. Using a domain you don't own, spoofing a sender name, or manipulating routing data to disguise the message's origin violates CAN-SPAM directly.

A practical test: if a recipient or their email provider traced the message back to its source, would they find a real, identifiable sender? If the answer is no, your header is noncompliant.

2. Don't Use Deceptive Subject Lines

Your subject line must reflect what's actually inside the email. Writing "Your order confirmation" on a newsletter packed with promotional offers, or "Re: our conversation" on a cold outreach message with no prior exchange, counts as deceptive. This is one of the most commonly cited violations because it's one of the easiest to detect, and increasingly easy to generate accidentally with AI-drafted subject lines that overpromise to boost opens. Any automated or AI-assisted subject line generator should be checked against the actual email body before sending, not just optimized for clicks.

3. Identify the Message as an Advertisement

CAN-SPAM requires clear and conspicuous disclosure that your message is an advertisement or solicitation. You have flexibility in how: a line of text near the top, a label in the subject line, or disclosure built into your template design. An ordinary recipient should recognize it. Burying disclosure in fine print at the bottom, or making it visually indistinguishable from surrounding content, doesn't meet the standard.

4. Tell Recipients Where You're Located (Physical Address Requirement)

Every commercial email needs a valid physical postal address. The FTC accepts any of these:

This requirement ensures recipients can always identify and locate the real business behind the message, closing a loophole that let early spammers hide behind anonymous domains.

5. Provide a Clear and Working Opt-Out Mechanism

Every commercial email must include a clear, conspicuous way to opt out. In practice, this is almost always an unsubscribe link in the footer, though CAN-SPAM technically allows any functional mechanism, including a reply-to address. A compliant opt-out mechanism must meet these standards:

• It must work for at least 30 days after the message was sent.
• You cannot require a fee to opt out.
• You cannot require more than an email address and opt-out preference.
• You cannot require more than one page to opt out in most cases.
• You cannot require login credentials just to unsubscribe.

If your opt-out flow forces someone through a login wall, a survey, or a multi-step confirmation before processing their request, that's a compliance gap worth fixing immediately. This friction is common among senders who treat unsubscribe as an afterthought rather than a core part of sending workflow. Our reference on CAN-SPAM opt-out mechanics breaks down the rules plainly if you need a quick team resource.

6. Honor Opt-Out Requests Within 10 Business Days

Once a recipient opts out, you have 10 business days to stop sending commercial email. After that window, continuing to email them is a violation, except for transactional or relationship messages that aren't promotional. If your email service provider or CRM takes longer than 10 days to sync suppression lists across every sending tool, you have a structural compliance risk, not just a slow process. This is especially common in organizations running email through multiple platforms, where a suppression in one system doesn't automatically propagate to another.

7. Monitor Third Parties and Affiliates Acting on Your Behalf

You remain legally responsible for CAN-SPAM violations committed by a third party sending commercial email promoting your product or service, even if you didn't write or send the message. This covers affiliate marketers, agencies, and outsourced sending partners. The FTC specifically warns that hiring someone else to handle email marketing doesn't transfer responsibility. If you run affiliate or partner email programs, you need visibility into what those partners send and under what sender identity, or you inherit their violations.

Quick Compliance Checklist

• Header "From," "To," and domain information accurately identifies your business
• Subject line matches the email's actual content
• Advertisement disclosure is clear and visible, not buried
• A valid physical postal address appears in every commercial email
• Opt-out link or mechanism is visible, functional, and free
• Opt-out requests are processed within 10 business days across all systems
• Third-party senders and affiliates are contractually required to follow the same rules

What Counts as "Commercial" Email Under CAN-SPAM?

CAN-SPAM applies only to commercial email - defined as any message whose primary purpose is advertising or promoting a commercial product or service. Purely transactional or relationship messages, like receipts, shipping notifications, account alerts, or password resets, fall outside most of the Act's content requirements, though they still can't contain false or misleading routing information.

Commercial vs. Transactional Emails Explained

Here's the distinction that trips up most senders:

Blended Emails: When Promotion and Transaction Mix

Real-world email rarely falls cleanly into one bucket. A shipping confirmation with a "20% off your next order" banner at the top is a blended email, and the FTC's analysis looks at which purpose dominates. If transactional content leads and promotional content is secondary, the stricter commercial rules generally don't apply to the whole message. Lead with the discount, and you've likely created a commercial email that needs an opt-out link and ad disclosure.

Decision checklist: Is my email commercial or transactional?

1. Does the email complete or confirm a transaction the recipient already agreed to? If yes, lean transactional.
2. Does the subject line or opening content promote a product, sale, or service? If yes, lean commercial.
3. If it's mixed, which content appears first and takes up more space? That's your dominant purpose.
4. When in doubt, treat it as commercial. The compliance bar is higher, but you avoid the risk.

Does CAN-SPAM Apply to B2B Emails and Newsletters?

Yes. CAN-SPAM makes no exception for business-to-business email. If the primary purpose of your message is commercial - promoting your product, service, or company to another business - the same seven requirements apply whether the recipient is a consumer or corporate buyer. This surprises many B2B marketers who assume cold outreach or account-based marketing sits outside consumer protection law. It doesn't.

B2B Senders and Newsletter Creators: Practical Differences

B2B senders face a few wrinkles that consumer marketers don't:

• Cold outreach still needs an opt-out path. Even a one-to-one sales email promoting your product needs a working way to say "stop emailing me," though the format can be as simple as "reply STOP."
• Company domains count as headers too. Sending from a shared sales engagement tool doesn't exempt you from accurate header requirements.
• Newsletter content mixing editorial and sponsor promotion needs the same ad-disclosure treatment as any other commercial email once sponsored or promotional content becomes the primary purpose.

For a deeper breakdown of how these rules apply to outbound sales and account-based email programs, see our guide on CAN-SPAM requirements for B2B marketers. If you're building a publication-style newsletter rather than a sales sequence, our B2B newsletter strategy guide covers how to structure sponsor disclosures and subscriber communications without tripping these rules.

CAN-SPAM Act Penalties and Enforcement in 2026

Civil Penalties Per Email

The FTC adjusts CAN-SPAM's civil penalty amount for inflation regularly. As of the most recent FTC penalty adjustments, violations carry a civil penalty of more than $53,000 per separate email, a figure confirmed in our 2026 compliance guide, which tracks the FTC's inflation-adjusted penalty schedule. That applies per individual message, not per campaign, so a single noncompliant send to 10,000 people carries catastrophic theoretical exposure if the FTC pursues maximum penalties.

Criminal Penalties for Aggravated Violations

Beyond civil fines, CAN-SPAM carries criminal penalties for aggravated violations such as using another person's computer without authorization, harvesting email addresses through dictionary attacks, or using scripts to register for multiple email accounts for bulk commercial messaging. These aggravated offenses can lead to imprisonment, not just fines, in cases involving large-scale deliberate fraud.

Notable FTC Enforcement Cases

Enforcement isn't theoretical. In 2024, the FTC and Department of Justice reached a $2.95 million settlement with security camera company Verkada over charges that included CAN-SPAM violations tied to unsolicited commercial email, among other data security and marketing claims. Cases like this show the FTC actively pursues CAN-SPAM enforcement alongside broader data practice claims, not just as a standalone statute.

Penalty and Enforcement Snapshot

What Is NOT Allowed Under CAN-SPAM?

These practices are explicitly prohibited:

• Using false, forged, or misleading header or routing information
• Using a deceptive or misleading subject line
• Failing to identify a commercial message as an advertisement
• Omitting a valid physical postal address
• Failing to provide a clear, functioning opt-out mechanism
• Continuing to email someone after they've opted out and your 10-business-day window has closed
• Charging a fee, requiring extra personal information, or forcing multiple steps to process an opt-out
• Selling or transferring an email address after someone has opted out, except to a service helping you comply with the law
• Harvesting email addresses from websites without consent
• Using dictionary attacks to generate email addresses
• Sending from a computer or network accessed without authorization

CAN-SPAM vs. GDPR vs. CCPA vs. CASL: Key Differences

CAN-SPAM is often compared with other privacy and anti-spam laws, but the consent models and penalty structures differ sharply:

The biggest practical difference is consent. CAN-SPAM lets you email someone first and requires you to stop when they ask. GDPR and CASL generally require permission before you send any commercial message. If you send to subscribers in multiple regions, comply with the strictest applicable law for each recipient, not just the one governing your headquarters. Our GDPR vs. CAN-SPAM comparison walks through how to build one sending workflow that satisfies both. For California-specific obligations around data use and sale, our CCPA glossary entry is a useful companion reference.

A Sample Compliant Commercial Email (Annotated Example)

Here's how each required element maps onto a real promotional newsletter:

• Sender name and domain: "Acme Supply Co. news@acmesupply.com" - a real, identifiable business, not a disguised or rented domain.
• Subject line: "20% off winter inventory this week" - matches the actual content inside, no bait-and-switch framing.
• Opening disclosure: A small line near the top or in the preheader reading "This is an advertisement from Acme Supply Co." or an equivalent clear label.
• Body content: The promotional offer, consistent with what the subject line promised.
• Footer physical address: "Acme Supply Co., 1200 Industrial Pkwy, Suite 4, Columbus, OH 43215."
• Footer opt-out link: "Unsubscribe from these emails" in visible, readable text, linking to a one-click or single-page opt-out form that requires no login and no fee.

Each element should appear in your email template by default, not added manually by whoever sends that week's campaign. Templating compliance into your system is far more reliable than relying on human memory.

How to Make Your Newsletter CAN-SPAM Compliant: Step-by-Step Checklist

Step 1: Verify Sender and Header Accuracy

Confirm your sending domain is authenticated and that the "From" name and address genuinely identify your business. If you use an email service provider, check that your domain isn't being masked by a shared sending domain that obscures who actually sent the message.

Step 2: Audit Subject Lines

Review recent campaigns and compare subject lines against actual content. If you use AI tools to draft or test subject lines, add a manual accuracy check before sending, since optimization for open rate can drift toward exaggeration. Our guide to newsletter subject lines that get opened covers how to write compelling lines that stay honest about content.

Step 3: Add Ad Disclosure and Physical Address to Templates

Build the advertisement disclosure and your registered physical address directly into your master email template footer so no individual sender can accidentally omit them. This one-time setup permanently closes two of the seven compliance gaps.

Step 4: Configure Automated, Instant Opt-Out Processing

Set up your email service provider or marketing automation platform to process unsubscribe requests immediately and sync suppression across every connected tool, not just the platform where the opt-out occurred. This is where sending infrastructure matters most. If your platform takes longer than 10 days to sync suppression across every sending tool, you have a structural compliance risk. This is especially common in organizations running email through multiple disconnected platforms. Breaker's platform is built so opt-outs, suppression lists, and sender reputation data stay unified across your entire sending program rather than fragmented across disconnected tools, which removes the most common source of accidental 10-day violations. If you're evaluating platforms for this reason, our overview of email deliverability best practices explains how suppression list hygiene and compliance intersect with inbox placement.

Step 5: Vet Third-Party Senders and Affiliates

If any agency, affiliate, or partner sends commercial email promoting your business, put compliance requirements in writing and periodically review what they actually send. You remain liable for their violations, so passive trust isn't a strategy.

Implementation Checklist (Printable)

• Sending domain authenticated and header information accurate
• Subject lines manually or automatically checked against email body before send
• Ad disclosure line built into master template
• Physical postal address built into master template footer
• Unsubscribe link tested for one-click or single-page functionality
• Suppression list syncs automatically across every connected sending tool
• Third-party and affiliate sending agreements include CAN-SPAM compliance clauses
• Compliance checklist reviewed quarterly or after any ESP migration

For a closer look at how automation workflows handle suppression and list hygiene behind the scenes, our guide on building an email automation workflow is a useful next read.

Common CAN-SPAM Violations and How to Avoid Them

The most frequent violations aren't complex. They're operational gaps: a shared sending domain that obscures the real sender, a subject line optimized purely for open rate at the expense of accuracy, an opt-out link that leads to a broken page, or a suppression list that updates in one tool but not another. Each is fixable with template and workflow changes, not legal maneuvering. Our dedicated guide on common CAN-SPAM violations breaks down specific violation patterns and how to audit your own program. Many violations also trace back to poor list hygiene; if you've ever purchased or scraped contact data, our piece on scraped email lists explains why that practice creates compliance risk well beyond CAN-SPAM alone.

History of the CAN-SPAM Act of 2003

Congress passed the CAN-SPAM Act in response to a surge of deceptive bulk email in the early 2000s that was overwhelming consumer inboxes and eroding trust in email as a channel. The bill had bipartisan sponsorship, including Senators Conrad Burns and Ron Wyden, and President George W. Bush signed it into law on December 16, 2003, with most provisions taking effect January 1, 2004. Congress passed it to create one uniform national standard rather than a patchwork of inconsistent state spam laws.

The law has drawn criticism over the years, with some consumer advocates calling it the "You-Can-Spam Act" because it legalized unsolicited commercial email under an opt-out model rather than requiring permission upfront, a sharp contrast to the opt-in approach later adopted by GDPR and CASL. More than two decades later, it remains the operative federal framework, even as state laws and international regulations have grown stricter.

Frequently Asked Questions

What are the main requirements of the CAN-SPAM Act? The main requirements are accurate header information, non-deceptive subject lines, clear advertisement disclosure, a valid physical postal address, a working opt-out mechanism, honoring opt-outs within 10 business days, and monitoring third parties who send email on your behalf.

Which practices are not allowed under the CAN-SPAM Act? False header information, deceptive subject lines, missing advertisement disclosure, missing physical address, broken or fee-based opt-out mechanisms, and continuing to email someone after their opt-out window has closed are all prohibited.

Is the CAN-SPAM Act still in effect in 2026? Yes. The CAN-SPAM Act remains fully in force, with the FTC continuing to enforce it and adjust its civil penalty amounts for inflation.

What are the CAN-SPAM physical address requirements? You can use a current street address, a US Postal Service registered post office box, or a private mailbox registered with a commercial mail receiving agency that complies with postal regulations. The address must appear in the email itself, typically in the footer.

What does CAN-SPAM stand for? CAN-SPAM stands for "Controlling the Assault of Non-Solicited Pornography And Marketing Act," the federal law passed in 2003 governing commercial email in the United States.

Does CAN-SPAM apply to B2B emails? Yes. CAN-SPAM applies to any email whose primary purpose is commercial, regardless of whether the recipient is a consumer or a business contact.

How long do I have to honor an opt-out request? You have 10 business days from the date of the opt-out request to stop sending commercial email to that recipient.

What is the penalty for violating CAN-SPAM? Civil penalties currently exceed $53,000 per individual violating email, and aggravated violations involving fraud or unauthorized computer access can carry criminal penalties, including imprisonment.

Does CAN-SPAM require opt-in consent? No. CAN-SPAM operates on an opt-out model, meaning you can send commercial email without prior consent as long as you provide a working way for recipients to opt out and honor that request promptly.

How is CAN-SPAM different from GDPR? CAN-SPAM allows commercial email without prior consent and only requires an opt-out mechanism, while GDPR generally requires affirmative opt-in consent before sending marketing email to individuals in the European Union, with far steeper maximum penalties.

Building Compliance Into Your Sending Program

Running a compliant sending program isn't a one-time project. It's an ongoing discipline built into your templates, your ESP configuration, and your list hygiene practices. Treat CAN-SPAM as the floor, not the ceiling - especially if any part of your list touches the EU, California, or Canada - and you'll stay ahead of both regulators and the inbox providers who increasingly penalize poor sending behavior regardless of what the law technically requires. For more on building that resilient sending foundation, visit Breaker to see how compliance and deliverability work together in one platform.

This guide is for informational purposes and does not constitute legal advice. Consult a qualified attorney for guidance specific to your business.

Sources

• Wikipedia: CAN-SPAM Act of 2003
• Transcend: The CAN-SPAM Act: A Complete 2026 Compliance Guide
• European Commission: Data Protection Overview