CAN-SPAM is the US law governing commercial email. It does not require permission to email someone, which surprises people who assume it works like the GDPR. What it requires is honesty about who you are, and a working, prompt way out.
The whole statute reduces to seven obligations. Here they are, with the parts senders actually get wrong.
The seven rules
1. Do not use false or misleading header information. The From, To, Reply-To and routing information must identify the actual sender. Using a domain you do not control, or spoofing a friendly-from that implies a different company, is the clearest violation in the law.
2. Do not use deceptive subject lines. The subject must reflect the content. "Re:" on an email that is not a reply is the classic example, and it is also one of the fastest ways to earn spam complaints regardless of legality.
3. Identify the message as an advertisement. The law is flexible about how — you do not need a banner saying ADVERTISEMENT. A recognisable brand, a clear commercial purpose and honest framing satisfy it. This obligation does not apply to transactional messages.
4. Include your physical postal address. A valid street address, a registered PO box, or a private mailbox registered with a commercial mail receiving agency. This is the rule most small senders quietly ignore, and it is trivially checkable by anyone who receives your email.
5. Tell recipients how to opt out. Clearly and conspicuously, in every commercial message.
6. Honour opt-outs within ten business days. The mechanism must work for at least 30 days after sending, must not require a login, a fee, or any information beyond an email address, and must not force the recipient through more than one page. In practice, honour them immediately — Google and Yahoo's bulk sender requirements demand processing within two days, and that is now the operative standard.
7. Monitor what others do on your behalf. If you hire an agency, a contractor or an affiliate to send email for you, both of you are liable. Outsourcing the sending does not outsource the responsibility.
What CAN-SPAM does not require
Opt-in. This is the genuine difference from the GDPR and CASL. Under CAN-SPAM you may email someone who never asked, provided the message is honest and they can leave. That is the law; it is not a strategy. Sending unrequested email to people who did not ask produces spam complaints, and spam complaints determine whether you reach the inbox at all — which is why purchased lists fail commercially long before anyone considers the legal position.
Double opt-in. Not mentioned anywhere in the statute.
A specific unsubscribe wording. "Unsubscribe" is conventional and clear. Nothing requires that exact word.
Transactional versus commercial
The rules above apply to messages whose primary purpose is commercial. Transactional and relationship messages — order confirmations, shipping notices, account statements, warranty information, password resets — are exempt from most of them, but they still must not have false or misleading headers.
The trap is the hybrid. A shipping confirmation with a promotional block underneath may be judged on its primary purpose, and if the promotional content dominates the subject line and the top of the message, it is a commercial email carrying commercial obligations. Keep receipts clean or accept that they are marketing. There is a fuller treatment in transactional vs marketing email.
The penalty structure
CAN-SPAM violations carry a civil penalty assessed per email, and the statutory maximum per message is adjusted for inflation over time — it currently sits above $50,000. Because the count is per message rather than per campaign, the arithmetic on even a modest list is unpleasant, and that is the entire deterrent effect of the law.
Aggravated violations — harvesting addresses, dictionary attacks, using someone else's computers to relay mail — carry criminal penalties on top.
The practical checklist
- Real From address on a domain you control, with SPF, DKIM and DMARC published so it can be verified.
- Subject line that describes the email.
- Physical address in the footer of every commercial send.
- One-click unsubscribe in the body, plus a List-Unsubscribe header.
- Opt-outs processed immediately, and the suppression list preserved permanently — it is the one list you never delete.
- A written agreement with anyone sending on your behalf that makes their obligations explicit.
If you are also sending into the EU or Canada, CAN-SPAM is the least demanding of the three regimes. Meeting GDPR consent standards or CASL puts you comfortably past it. This is general information rather than legal advice.
Frequently asked questions
Does CAN-SPAM require opt-in consent?
No. It permits sending commercial email to people who never requested it, provided the message identifies the sender honestly and offers a working opt-out. Opt-in is a deliverability and reputation requirement rather than a US legal one.
How long do I have to honour an unsubscribe?
The statute allows ten business days. Google and Yahoo's bulk sender requirements allow two days, and mailbox providers treat that as the standard, so ten days is legally sufficient and practically far too slow.
Do I really need a physical address in every email?
Yes, in every commercial message. A registered PO box or a private mailbox from a commercial mail receiving agency satisfies the requirement, which is the usual answer for people who work from home.
Am I liable if my agency sends non-compliant email for me?
Yes. CAN-SPAM makes both the party whose product is promoted and the party doing the sending responsible. Put the obligations in the contract and check the emails that go out under your name.
