The CAN-SPAM Act sets baseline rules for every commercial email sent to or from the United States. Truthful headers, a clear opt-out, a physical postal address, and no deception in the subject line. Miss any of them and the FTC can seek civil penalties of up to $53,088 per non-compliant email, with parallel state and ISP causes of action layered on top. This page turns the FTC CAN-SPAM compliance guide into a working checklist for email senders: the primary purpose test, a compliant footer template, and how to set up the unsubscribe link in the platform you already use.
CAN-SPAM Act · Controlling the Assault of Non-Solicited Pornography and Marketing Act of 2003 · 15 U.S.C. §§ 7701-7713 · Enforced by the FTC, with state Attorneys General and ISPs as parallel plaintiffs · Applies to commercial email sent to or from US recipients, including B2B and foreign senders · Max civil penalty $53,088 per email (as currently listed by the FTC; adjusted for inflation each year) · Aggravated conduct (address harvesting, dictionary attacks, hijacked computers, open relays) can also be prosecuted criminally under 18 U.S.C. § 1037.
What CAN-SPAM requires
The FTC compliance guide lists seven main obligations that apply to every commercial email:
- Truthful From, To, and routing headers. The sender domain, IP, reply-to, and From name must accurately identify the actual sender.
- No deceptive subject line. The subject must reflect the content of the message.
- Clear advertising identification. The recipient must be able to tell the message is an advertisement.
- Valid physical postal address. A current postal address, PO box, or Commercial Mail Receiving Agency address in every message.
- Clear opt-out mechanism. Working for at least 30 days after the send.
- Prompt honoring of opt-outs. Within 10 business days. No fee, no information required beyond the email address, no multi-step forms.
- Third-party accountability. If a marketing agency, affiliate, or ESP sends on your behalf, both parties can be held liable.
Who must comply
CAN-SPAM applies to any commercial email, a message whose primary purpose is commercial advertisement or promotion of a product or service, sent to or from a US recipient. That includes B2B email (the FTC has been explicit on this since 2005) and foreign senders whose messages reach US recipients. Transactional and relationship messages (order confirmations, account notifications, service alerts, receipt-of-purchase updates) are exempt from most requirements but still must carry accurate header information.
Both the initiator and the sender share liability. If you outsource sending to an ESP or affiliate network, the FTC can pursue both parties for the same violations. Contractual disclaimers between them do not extinguish either party’s exposure to the FTC.
Commercial or transactional: the FTC primary purpose test
Everything in CAN-SPAM hinges on one question: what is the primary purpose of the message? The FTC sorts email content into three types. Commercial content promotes a product or service. Transactional or relationship content serves an existing deal. Other content is neither. A purely transactional message is exempt from most of the Act, but its routing information must still be accurate.
The FTC reads the transactional category narrowly. A message only qualifies if it does one of these five things:
- Facilitates, completes, or confirms a transaction the recipient already agreed to (order and payment confirmations).
- Gives warranty, recall, safety, or security information about a product or service the recipient bought.
- Reports a change in terms, features, account standing, or gives periodic account balance information for an ongoing subscription or account.
- Provides information about an employment relationship or employee benefits.
- Delivers goods or services the recipient is entitled to under an existing agreement (a download link, a license key).
Mixed messages are where senders get caught. When one email combines transactional and promotional content, the FTC treats it as commercial if a recipient reading the subject line would likely think it advertises something, or if the transactional part does not appear mainly at the beginning. A shipping confirmation that opens with a discount banner and “You will love these” in the subject line is a commercial email, and needs the full set of CAN-SPAM elements.
Penalties and enforcement
Per-email liability. The FTC assesses civil penalties at up to $53,088 per individual email, not per campaign. A 100,000-recipient send that fails a single requirement has a theoretical exposure of over $5 billion. Settlements typically land far below the ceiling, Verkada paid $2.95M for disguising marketing emails as transactional, Experian paid $650,000 for similar violations, but the per-email structure gives the FTC leverage in every negotiation. Aggravated conduct such as address harvesting, dictionary attacks, relaying spam through another computer, or registering accounts and domains with false information can also lead to criminal penalties, including imprisonment, under 18 U.S.C. § 1037.
Compliance checklist
A CAN-SPAM compliant email footer template
Most compliance failures come from the footer. This template covers the identification, address, and opt-out elements in one block. Replace the bracketed values with your own; the merge tags differ by platform, so check the guide for your ESP below.
You are receiving this email because you signed up at [yourdomain.com].
[Company Legal Name], [Street Address or registered PO Box], [City, State ZIP], [Country]
Unsubscribe from all marketing emails: [UNSUBSCRIBE_LINK]
Change which emails you receive: [PREFERENCE_CENTER_LINK]
This message is an advertisement from [Company Name].- The unsubscribe link must work for at least 30 days after the send, and requests must be honored within 10 business days.
- A preference center is allowed, but it must include an option to stop all marketing email, and it cannot require a login, a fee, or any information beyond the email address.
- The advertisement disclosure can be dropped only if the recipient gave prior affirmative consent to receive your marketing.
- Add a List-Unsubscribe header too. CAN-SPAM does not require it, but Gmail and Yahoo require one-click unsubscribe for bulk senders. See the List-Unsubscribe header guide.
How to add a compliant unsubscribe link in your email platform
Every major email platform inserts the unsubscribe link with its own merge tag, and several block sending until one is present. SMTPedia documents the exact tag and setup for each platform:
Using another platform? The unsubscribe merge tag reference lists the tag for each email tool SMTPedia covers.
CAN-SPAM vs GDPR vs CASL
| Rule | CAN-SPAM (US) | GDPR + ePrivacy (EU) | CASL (Canada) |
|---|---|---|---|
| Model | Opt-out: no prior consent needed | Legal basis required; marketing to individuals generally needs consent | Opt-in: express or implied consent |
| Unsubscribe deadline | 10 business days | Without undue delay (right to object) | 10 business days |
| Physical address | Required in every commercial email | Sender identity required; address depends on national law | Required, plus phone, email, or web contact |
| B2B email | Covered, no exception | Covered; rules vary by country | Covered; limited exemptions |
| Maximum penalty | Up to $53,088 per email | Up to EUR 20M or 4% of worldwide turnover | Up to CAD 10M per violation for businesses |
If you send to recipients in more than one region, build to the strictest regime you reach. In practice that means collecting consent (GDPR and CASL) and keeping the CAN-SPAM footer elements, which are a subset of what the other laws expect.
Common misconceptions
B2B is not exempt. CAN-SPAM applies to every commercial email including business-to-business marketing. The FTC has stated this explicitly since 2005. Sending cold outreach to work addresses does not remove any compliance obligation.
Transactional does not mean any email to a customer. Order confirmations, account updates, and service alerts qualify. A newsletter or promotional message to existing customers is commercial and must comply in full.
Consent is not required to start sending. Unlike CASL and GDPR, CAN-SPAM operates on an opt-out model rather than opt-in. Compliance means recipients can leave the list, not that they consented to join it.
Frequently asked questions
Does CAN-SPAM apply to cold outreach and B2B email?
Yes. The FTC’s official guidance is that CAN-SPAM makes no exception for business-to-business email. Every commercial email sent to or from a US recipient must satisfy all seven requirements, whether the recipient is a personal or work address.
Are foreign senders subject to CAN-SPAM?
Yes when the message reaches a US recipient. The FTC has pursued cases against foreign senders including affiliate networks based in Europe and Asia. Using a US-based ESP does not shift the compliance burden away from the initiator.
Can I add promotional content to a transactional email?
Only if the primary purpose remains transactional. The FTC uses a primary-purpose test: if the transactional content dominates the message (subject line, first screen, main body) the message stays transactional. If the promotional content dominates, the entire message is commercial and must comply in full. The Experian $650,000 settlement turned on exactly this distinction.
Is a link to an unsubscribe preference center enough?
Yes provided the preference center accepts opt-out with no more than one additional step, requires no login, and does not ask for information beyond the email address. Preference centers that require account creation, force users through multiple opt-out categories, or fail to include a global opt-out have all generated FTC enforcement.
How does CAN-SPAM interact with state laws like California CCPA or Colorado CPA?
CAN-SPAM preempts state statutes that would impose different or additional requirements for commercial email specifically. It does not preempt broader privacy statutes like CCPA that regulate data collection and sharing. State AGs retain enforcement authority under CAN-SPAM itself and can bring parallel actions alongside the FTC.
Where to go next
- CASL Canada compliance guide, opt-in model contrast with CAN-SPAM opt-out
- GDPR compliance guide, EU rules for senders reaching European recipients
- Email unsubscribe laws worldwide, global overview of opt-out obligations
- Australian Spam Act 2003, opt-in regime with per-day AUD 2.22M penalty ceiling
- Platforms that accept purchased and third-party lists, and the CAN-SPAM duties that still apply to every address on them
Pre-validating your list before you press send catches disposables, catch-alls, and dead mailboxes that generate CAN-SPAM opt-out complaints from recipients who never signed up. SMTPing gives you thirteen validation types with twenty-five free checks daily, no card required. Try SMTPing free.
Did this guide save you time?
SMTPedia is free and independent. A coffee helps keep every guide accurate.
Buy SMTPedia a coffeeAbout the Author
Alaa · LinkedIn
Email infrastructure specialist with 8+ years of hands-on experience in SMTP, deliverability, and email verification. I’ve configured and troubleshot mail systems across Postfix, Exchange, and cloud relays, managed IP reputation and warmup campaigns, and built verification pipelines processing millions of addresses. My work spans DNS authentication (SPF, DKIM, DMARC, BIMI), bounce handling, blocklist monitoring, and compliance frameworks including CAN-SPAM and GDPR. I write every article on SMTPedia to give email professionals, developers, and marketers the accurate, RFC-grounded reference they need.
About SMTPedia
SMTPedia is an independent email industry reference covering SMTP, IMAP, POP3, email deliverability, marketing platforms, DNS authentication, and email verification. Every article is researched from official provider documentation, IETF RFCs, and industry best practices. Settings and configurations are verified quarterly.
We are cited as a source by ChatGPT, Microsoft Copilot, and thousands of email professionals worldwide. Learn more about our editorial process.