Email Marketing Compliance Requirements

What Counts as a Commercial Email

The CAN-SPAM Act applies to any email whose primary purpose is commercial advertising or promotion of a product or service, including a single promotional send, an automated drip sequence, or a newsletter that mixes content with ads. It applies to business-to-business email as well as email sent to consumers; there's no exception for a smaller list or an infrequent sender.

Required Header and Routing Information

Per the FTC's CAN-SPAM Act compliance guide, the "From," "To," "Reply-To" and routing information, including the originating domain name and email address, must be accurate and identify the person or business that initiated the message. Disguising who actually sent the email, even through a technical routing trick, is itself a violation separate from anything else in the message.

Subject Lines Can't Be Misleading

The subject line has to accurately reflect the content of the message. A subject line implying a reply to a previous conversation, a personal message, or an entirely different offer than what's inside the email can violate the Act on its own, regardless of what the body of the email says.

Disclose That It's an Advertisement

The FTC requires that a commercial email "disclose clearly and conspicuously that your message is an advertisement." There's flexibility in how you phrase this, but it has to be noticeable to an ordinary recipient, not buried in fine print at the bottom.

Include a Valid Physical Postal Address

Every commercial email must include a valid physical postal address, which the FTC says can be your current street address, a registered post office box, or a private mailbox you've registered with a commercial mail-receiving agency. A missing or outdated address is a common and easily avoidable compliance gap.

Give Recipients a Way to Opt Out, and Honor It

Every commercial email needs a clear and conspicuous way for the recipient to opt out of future messages, such as a reply-to address or a link to an unsubscribe page. Once a recipient opts out, you must stop sending to them within 10 business days, per the FTC, and you can't charge a fee, require more information than an email address, or make the recipient take any step beyond visiting a single page or sending a single reply to opt out.

Monitor What Others Send on Your Behalf

If you hire another company or an email service to send marketing on your behalf, you can still be held responsible if those emails violate the Act. The FTC's guidance notes that more than one person may be held responsible for the same violation, which commonly includes both the business whose product is advertised and whoever actually sent the email.

What a Violation Can Cost

The FTC can pursue a civil penalty of up to $53,088 per email that violates the Act as of 2026, an amount that adjusts periodically for inflation. Because the penalty applies per message rather than per campaign, a single non-compliant send to a large list can create outsized exposure compared to the cost of getting compliant in the first place. Criminal penalties, including imprisonment, can apply to more serious violations, such as using another person's computer to send bulk email without permission or falsifying header information.

CAN-SPAM Doesn't Require Prior Consent for Every Email

Unlike some other countries' email laws, the CAN-SPAM Act doesn't require someone to opt in before you can email them commercially; it instead focuses on disclosure and the right to opt out after the fact. That said, sending unsolicited email to a purchased or scraped list carries its own deliverability and reputation risks even where the Act itself might technically be satisfied.

State and International Rules Can Add Requirements

Some states have their own commercial email laws, and if you email recipients outside the United States, laws such as Canada's Anti-Spam Legislation can require opt-in consent that CAN-SPAM doesn't. Check whether your recipient list crosses into a jurisdiction with stricter rules before assuming federal compliance is enough.

Transactional and Relationship Emails Are Treated Differently

An email whose primary purpose is to complete a transaction, such as a receipt or a shipping notification, is generally not treated as a commercial email under the Act, even if it also contains some marketing content. Mixing substantial marketing content into what's meant to be a transactional email can shift how it's classified, so keep marketing content clearly secondary in those messages.

This Is Not Legal Advice

Email marketing compliance intersects with other laws, including state privacy statutes and, if you also text your list, the Telephone Consumer Protection Act. Talk to a business attorney if your email program is large, automated across many lists, or sent on your behalf by a third-party platform or agency.