CAN-SPAM Act Compliance Checklist

What the CAN-SPAM Act Covers

The CAN-SPAM Act is a federal law enforced by the Federal Trade Commission that applies to any commercial email, meaning any message whose primary purpose is advertising or promoting a product or service, sent to recipients in the United States. It applies to every business that sends marketing email, not just companies that consider themselves email marketers, and it applies regardless of whether the message goes to a consumer or another business.

The Compliance Checklist

Per the FTC's compliance guide, a commercial email has to meet each of the following:

• Accurate header information. The "From," "To," and routing information, including the originating domain name, must accurately identify the person or business that initiated the message.
• A truthful subject line. The subject line has to reflect the content of the message; it can't mislead the recipient about what's inside.
• A clear ad disclosure. The message has to be identifiable as an advertisement.
• A valid physical address. Include your current street address, a P.O. box registered with the U.S. Postal Service, or a registered commercial mail receiving agency address.
• A working opt-out mechanism. Give recipients a clear, conspicuous way to opt out of future email, either a reply-to email address or a one-click web-based mechanism, that keeps working for at least 30 days after you send the message.
• Prompt handling of opt-outs. Honor an opt-out request within 10 business days, and don't sell, transfer, or use the recipient's address for any purpose other than compliance once they've opted out.
• No fee or extra information required to opt out. You can't charge a fee, require the recipient to give more than an email address, or make them take any step other than sending a reply email or visiting a single web page to opt out.
• Monitoring what others do on your behalf. If you hire another company to handle your email marketing, you're still legally responsible for that company's compliance with the law.

The Penalty for Getting It Wrong

The FTC can seek a civil penalty of up to $53,088 for each separate email that violates the Act, an amount adjusted for inflation and current as of January 2024, according to the FTC. Because the penalty is calculated per email rather than per campaign, a single noncompliant send to a large list can create significant exposure. Violations can also trigger liability under the broader FTC Act if the email itself contains deceptive claims.

Subscription and Transactional Email

The opt-out requirement applies to commercial email, including messages sent to your own customers or newsletter subscribers; being a subscriber doesn't waive someone's right to opt out of marketing messages. Purely transactional or relationship messages, such as an order confirmation or an account notice, are treated differently under the FTC's guidance and aren't subject to the same opt-out and ad-disclosure requirements, though they still can't contain false or misleading routing information.

Building This Into Your Email Process

Most email marketing platforms build an opt-out link and a footer address into every template by default, which covers much of the checklist automatically. The parts that still require a human check are the subject line's accuracy, whether the message reads as an advertisement when it's supposed to, and whether your list-cleaning process actually removes opted-out addresses within the 10-business-day window rather than just marking them for later.

State Laws Can Add Requirements on Top of CAN-SPAM

CAN-SPAM sets a federal floor, but some states have their own commercial email or marketing laws that can impose additional requirements. Check whether your state has a relevant statute if you send a high volume of commercial email, rather than assuming federal compliance is the whole picture.

This Overlaps With, but Isn't the Same as, Cookie or Data Privacy Law

CAN-SPAM governs the content and mechanics of commercial email specifically. It doesn't address how you collected the email address in the first place, which is a separate question under state privacy laws and your own privacy policy.

Keep Records of Consent and Opt-Outs

While CAN-SPAM doesn't require opt-in consent before sending a first commercial email the way some other countries' laws do, keeping a record of when someone subscribed and when they opted out gives you something to point to if a complaint or dispute comes up later.

This Is Not Legal Advice

Whether a specific message counts as commercial, transactional, or relationship email under the FTC's rules can be a close call for some business communications. Talk to an attorney if your email program mixes marketing content with account or service notifications, since that mix is one of the more common gray areas under the Act.