CAN-SPAM Act Compliance: A Plain-English Checklist for US Businesses
What the US CAN-SPAM Act requires from marketing emails — honest headers and subject lines, a postal address, easy opt-outs — in a simple checklist.
In short: CAN-SPAM lets you email until someone opts out, but every commercial email must have honest sender details and subject lines, identify itself as an ad where needed, include your postal address and a working unsubscribe, and honour opt-outs within 10 business days. Fines exceed $50,000 per email.
The CAN-SPAM Act sets the rules for commercial email in the United States. Unlike Canada's CASL, it doesn't require consent before your first email — but it has clear rules every message must follow, and penalties can exceed $50,000 per violating email. Here's what it means in practice.
This guide is general information, not legal advice. The Federal Trade Commission (FTC) publishes the official compliance guide.
Who it applies to
CAN-SPAM covers any email whose main purpose is commercial — advertising or promoting a product or service. It applies to business-to-business email as well as to consumers. If someone sends emails on your behalf (an agency, a platform), you are still responsible.
The 7 requirements
1. Don't use false or misleading header information
Your "From", "To" and "Reply-To" details and routing information must be accurate and identify the business sending the email.
2. Don't use deceptive subject lines
The subject line must reflect what's inside. "Your order has shipped" on a promotion is a violation.
3. Identify the message as an ad
If the email is an advertisement, you must disclose that clearly. There's flexibility in how — but it must be clear and conspicuous. (People who opted in to your marketing generally know they're getting promotions; when in doubt, be explicit.)
4. Tell recipients where you're located
Include a valid physical postal address: a street address, a post office box registered with the US Postal Service, or a private mailbox registered with a commercial mail-receiving agency.
5. Tell recipients how to opt out
Every email needs a clear, easy way to stop receiving your emails — typically an unsubscribe link. You can offer choices (fewer emails, certain topics) as long as "stop all" is an option.
6. Honor opt-outs promptly
- Process opt-outs within 10 business days.
- Don't charge a fee, ask for more than an email address, or make people do more than visit one page to opt out.
- Keep the opt-out working for at least 30 days after you send.
- Never sell or transfer the addresses of people who opted out.
7. Monitor what others do on your behalf
If you hire an agency or use affiliates, you're legally responsible for their emails too.
What CAN-SPAM doesn't cover
Transactional or relationship messages — receipts, order confirmations, account notices, password resets — are mostly exempt from the rules above, but they still can't contain false or misleading routing information.
Beyond the law: what Gmail and Yahoo require
Being legal isn't the same as reaching the inbox. Since 2024, Gmail and Yahoo require bulk senders to authenticate their domain, offer one-click unsubscribe, and keep spam complaints very low. See Gmail and Yahoo sender requirements.
Your CAN-SPAM checklist
- ☐ Accurate From name and address that identify your business.
- ☐ Subject lines that honestly describe the email.
- ☐ Clear disclosure when the email is an advertisement.
- ☐ Your valid postal address in every email.
- ☐ A visible, working unsubscribe link in every email.
- ☐ Opt-outs honored within 10 business days (better: immediately).
- ☐ Opted-out addresses never sold, shared or emailed again.
- ☐ Anyone sending on your behalf follows the same rules.
Best practice: get permission anyway
CAN-SPAM allows emailing people who haven't opted in, but doing it is a fast way to land in spam folders. Permission-based lists get far better results — and keep you compliant with Canada's CASL if any subscribers are Canadian.
Common questions in practice
Can I email my existing customers without asking? Under CAN-SPAM, yes, as long as each email follows the rules above. But if any of those customers are in Canada, CASL's stricter consent rules apply to them.
Do I need "advertisement" in every subject line? No specific wording is required. The FTC says the disclosure must be clear and conspicuous. Many senders of permission-based newsletters rely on context (the subscriber asked for promotions), but if you email people who didn't opt in, be explicit.
Can I make people log in to unsubscribe? No. Unsubscribing must not require more than the email address and a single page visit — no passwords, no fees, no extra personal information.
What if my unsubscribe link breaks? You must keep a working opt-out for at least 30 days after each send. Check your links regularly, especially after changing platforms.
Are newsletters "commercial"? If the primary purpose is promoting your products or services, yes. A newsletter with mostly helpful content and a small promotional section may be judged by its primary purpose — when in doubt, follow the rules anyway; they're good practice.
"You're receiving this email because you signed up at sunnybakery.com or made a purchase. Unsubscribe · Update your preferences. Sunny Bakery, 123 Main Street, Springfield, IL 62701, USA."
That single footer covers identification, the postal address and the opt-out requirement.
What happens if you get it wrong
Most enforcement targets deceptive senders, but each violating email can bring a fine of more than $50,000 — and both the business promoted and the business that sent the email can be held responsible. Beyond fines, the practical cost is deliverability: non-compliant habits (hidden unsubscribes, misleading subjects) cause spam complaints that harm every future email.
How Reepio helps
Every Reepio marketing email automatically includes your postal address and a one-click unsubscribe link, unsubscribes are honoured instantly, and suppressed contacts are never emailed again. Start free.
Frequently asked questions
Does CAN-SPAM require consent before emailing?
No. CAN-SPAM is an opt-out law: you may email people until they unsubscribe, provided every email follows its rules. Permission-based lists still perform far better and avoid spam folders.
Can I use a PO box as my postal address?
Yes. The FTC accepts a current street address, a post office box registered with the US Postal Service, or a private mailbox registered with a commercial mail receiving agency.
How quickly must I honor an unsubscribe?
Within 10 business days. Gmail and Yahoo expect bulk senders to process one-click unsubscribes within two days, and good platforms do it instantly.