CAN-SPAM Act: Email Rules for US Small Businesses

The CAN-SPAM Act is the main federal law for commercial email in the US. Unlike UK and EU rules, it does not require consent before you send, but it sets firm rules on honesty, identification and opt-outs, and it applies to every commercial email, including B2B. Here is what the law requires and how to build compliance into your everyday email marketing.

Smiling man sitting at a table and working on an open laptop computer — CAN-SPAM compliance is mostly a matter of honest headers, a real address and an opt-out that works.

Key takeaways

CAN-SPAM applies to all commercial email, including messages to other businesses.
No false header information, no deceptive subject lines, and a valid physical postal address in every message.
Give a clear opt-out and honor it within 10 business days. It must keep working for at least 30 days after you send.
You stay responsible even if an agency or contractor sends the email for you.
Penalties can be more than $50,000 per violating email, according to the FTC.

Many US small businesses assume CAN-SPAM is a law about mass spammers, not about their monthly newsletter. In fact, it covers almost any email whose main purpose is to promote a product or service. A coffee roaster announcing a sale, a consultant pitching a new package to a client list, and a SaaS startup sending a feature launch to trial users are all sending commercial email.

The good news is that the rules are clear and mostly common sense. This guide explains each requirement, the difference between commercial and transactional messages, and the practical steps to stay compliant. It is general information, not legal advice. Check the FTC's current guidance or ask a qualified adviser for your specific situation, and remember that some states have their own rules too.

What CAN-SPAM covers

The Controlling the Assault of Non-Solicited Pornography and Marketing Act, known as CAN-SPAM, sets national standards for commercial email. The Federal Trade Commission (FTC) enforces it.

Commercial vs transactional messages

The law sorts email by its primary purpose:

Commercial content: advertises or promotes a commercial product or service, including content on a website. These messages must follow all CAN-SPAM rules.
Transactional or relationship content: facilitates an agreed transaction or updates a customer on an existing relationship. Examples include receipts, shipping notices, account statements, warranty information and changes to terms. These are largely exempt, but they still must not contain false or misleading routing information.
Other content: messages that are neither, such as a purely personal note, generally fall outside the law.

When a message mixes both, the question is what the recipient would reasonably conclude is the main purpose. If the subject line suggests a promotion, or most of the email is promotional, treat it as commercial.

B2B email is covered too

There is no exception for business-to-business email. A cold pitch to a procurement manager, a newsletter to trade customers and a promotional email to a partner all fall under CAN-SPAM.

Common mistake

Treating an order confirmation as a free marketing channel. If you add so much promotion that the email reads mainly as an advertisement, it can be classed as commercial, and every CAN-SPAM requirement applies to it, including the opt-out.

The core requirements

CAN-SPAM does not require consent before you send commercial email to someone. It does require every commercial message to meet a set of rules.

No false or misleading header information. Your "From", "To", "Reply-To" and routing information, including the originating domain and email address, must be accurate and identify the business that sent the message.
No deceptive subject lines. The subject line must reflect the content of the message. A subject like "Re: your invoice" on a sales email is deceptive.
Identify the message as an ad. You must clearly disclose that the message is an advertisement, unless the recipient has given consent to receive it. The law allows flexibility in how you do this, but it must be clear.
Tell recipients where you are. Include a valid physical postal address. This can be your street address, a post office box registered with the US Postal Service, or a private mailbox registered with a commercial mail receiving agency under postal regulations.
Tell recipients how to opt out. Include a clear, conspicuous explanation of how to stop future emails from you. Make it easy for an ordinary person to recognize, read and understand.
Honor opt-outs promptly. Process requests within 10 business days, and keep the opt-out mechanism working for at least 30 days after you send the message.
Monitor others who send for you. If you hire an agency or a contractor, both of you can be held responsible.

10 business days The deadline to honor an opt-out request under CAN-SPAM. The opt-out mechanism must work for at least 30 days after each message is sent. FTC, CAN-SPAM Act compliance guidance

Opt-outs: the rule that trips people up

The opt-out requirement is where most small businesses make mistakes, often because their tools or processes add friction without anyone noticing. Under CAN-SPAM:

You cannot charge a fee to opt out.
You cannot require the recipient to give any information other than an email address.
You cannot make them take any step other than sending a reply email or visiting a single page on a website.
Once someone opts out, you cannot sell or transfer their email address to anyone else, except to a company you have hired to help you comply with the law.

A preference center that lets people choose which types of email they get is fine, as long as it also offers a clear option to stop all commercial email from you.

Pro tip

Do not make people log in to unsubscribe. A login wall is a classic way to fail the "single web page" test. Most email platforms provide a one-click unsubscribe link that meets the requirement; leave it switched on in every template.

Smartphone lying on a white surface with an email inbox displayed on the screen — A visible unsubscribe link protects you legally and keeps unhappy recipients from hitting the spam button.

Agencies, affiliates and shared responsibility

Many small businesses outsource email to a marketing agency, a freelancer or an affiliate network. CAN-SPAM makes clear that the company whose product is promoted in the message can be held responsible, and so can the company that actually sends it.

Write it into the contract. Require the agency to follow CAN-SPAM and to share opt-out data with you promptly.
Use one suppression list. Opt-outs collected by your agency must stop emails from you too, and the other way round.
Review affiliate emails. If affiliates email on your behalf, set rules for subject lines, sender names and content, and check samples.

Example

Imagine a small fitness studio, Northside Pilates, hires a freelancer to run a holiday promotion campaign. The freelancer uses a separate email tool and forgets to import the studio's existing unsubscribe list. Former members who opted out months ago receive the promotion and complain. Because the email promoted Northside Pilates, the studio shares responsibility. A simple contract clause and a shared suppression list, checked before every send, would have prevented the problem.

Penalties and enforcement

Each separate email that violates CAN-SPAM can carry its own penalty. According to the FTC, penalties can be more than $50,000 per violating email, and the amount is adjusted for inflation each year. Deceptive practices can also bring other legal consequences.

For most small businesses, the realistic risks are complaints, damaged sender reputation and emails landing in spam folders. Mailbox providers watch complaint rates closely, so a business that ignores opt-outs often finds its legitimate emails stop reaching customers long before any regulator gets involved. Good compliance and good deliverability go hand in hand: honest sender names, accurate subject lines and easy unsubscribes all reduce spam complaints. For the technical side of deliverability, such as SPF, DKIM and DMARC, see our separate guide.

CAN-SPAM vs UK and EU email rules

If you sell internationally, remember that CAN-SPAM is a floor, not a passport. The rules for other countries are stricter in important ways.

Point	US (CAN-SPAM)	UK (PECR and UK GDPR)	EU (GDPR and national ePrivacy rules)
Consent before marketing to individuals	Not required	Required, unless soft opt-in applies	Generally required; varies by country
B2B email	Allowed, with full CAN-SPAM rules	Allowed to corporate subscribers with opt-out	Varies by country; some are strict
Opt-out in every message	Required	Required	Required
Physical postal address	Required	Valid contact address required	Sender identification required

If your list includes people in the UK or EU, the stricter rules apply to them, even if your business is based in the US. Segment contacts by location where you can.

Text messages are a different law

CAN-SPAM is about email. Marketing text messages in the US are mainly governed by the Telephone Consumer Protection Act (TCPA), which generally requires prior express written consent for marketing texts sent with an autodialer, and by carrier rules such as 10DLC registration. Do not assume your email compliance covers SMS. See our guide to TCPA and SMS marketing consent for details.

CAN-SPAM checklist

Sender name and address accurately identify your business
Subject lines match the content of each email
Promotional emails clearly identified as ads where required
Valid physical postal address in every commercial email
Clear unsubscribe link that needs only an email address and no login
Opt-outs processed within 10 business days, and links working for 30+ days
One suppression list shared with every agency, freelancer and affiliate
UK and EU contacts handled under their stricter rules

Frequently asked questions

Do I need permission to send marketing emails in the US?

CAN-SPAM does not require prior consent. However, permission-based lists perform far better, get fewer complaints and are required for many contacts in the UK and EU. Most email platforms also expect you to have permission to email your list.

Can I use a PO box as my postal address?

Yes, if it is a post office box registered with the US Postal Service, or a private mailbox registered with a commercial mail receiving agency under postal regulations.

Does CAN-SPAM apply to one-to-one sales emails?

If the primary purpose of the email is to promote a product or service, it is commercial, even if it is sent to a single person. Include your postal address and an opt-out in sales outreach templates to be safe.

Are receipts and shipping notices exempt?

Mostly. Transactional or relationship messages are exempt from most requirements, but they still must not contain false or misleading routing information. Keep promotion in them light, so they stay transactional.

The bottom line

CAN-SPAM asks for honesty and a way out: accurate sender details, truthful subject lines, a real postal address and an opt-out you honor within 10 business days. Build those into your templates once, share a single suppression list with everyone who sends for you, and your email marketing will be on solid ground in the US.

If you also email people in the UK or EU, or send text messages, follow the stricter rules that apply there, and check the FTC's current guidance or a qualified adviser when in doubt.