CAN-SPAM Act Compliance Checklist for Marketing Emails

You finally have an email list, a promotion ready to go and a “Send” button staring back at you. Then the doubt creeps in: is this legal? Do you need permission? What happens if someone unsubscribes and you forget to remove them?

In the US, the answer starts with the CAN-SPAM Act. It’s the federal law that sets the rules for commercial email, and it applies to every business that sends marketing messages, from a 2-person bakery to a national retailer. The good news is that the rules are short and practical. The bad news is that the penalties are steep, and “my email platform handles it” isn’t a full defense.

This guide explains each requirement in plain English, shows where businesses usually slip up and ends with a pre-send checklist you can copy into your workflow.

This is not legal advice. For questions about your specific situation, talk to a qualified attorney.

What the CAN-SPAM Act is and who it covers

The CAN-SPAM Act of 2003 (Controlling the Assault of Non-Solicited Pornography And Marketing Act) is codified at 15 U.S.C. 7701 and following, with the Federal Trade Commission’s implementing rule at 16 CFR Part 316. It took effect on January 1, 2004.

Despite the name, it doesn’t only cover bulk spam. The FTC’s compliance guide is clear that it applies to any “commercial electronic mail message”, meaning an email whose primary purpose is to advertise or promote a product or service. That includes:

• Newsletters with promotions in them
• Sale announcements and coupon emails
• Emails promoting content on a commercial website
• Business-to-business marketing emails, which get no exemption

There’s no minimum list size. One promotional email to one person is covered.

Key takeaway: CAN-SPAM is an opt-out law, not an opt-in law. You don’t need permission to send the first marketing email, but you must make it easy to stop, honor that choice quickly and never mislead anyone about who you are or what you’re sending.

Commercial, transactional or “other”: why the label matters

How a message is classified decides which rules apply.

Transactional or relationship messages are mostly exempt. The FTC lists 5 narrow categories: messages that complete a transaction the person already agreed to, warranty, recall, safety or security information, notices about changes to an ongoing account or subscription, employment or benefit plan information, and delivery of goods or services the person is entitled to. These still need truthful routing and header information, but they don’t need an unsubscribe link or ad label.

Commercial messages must follow every rule below.

Mixed messages are where businesses get caught. The FTC looks at the “primary purpose”. A message that mixes a receipt with a promotion is treated as commercial if the subject line would make a reasonable person expect an ad, or if the transactional part doesn’t appear mainly at the start of the message. Placement, proportion and visual emphasis all count.

If you’re unsure, treat the email as commercial and include the full set of elements. It costs you nothing.

The 7 core CAN-SPAM requirements in plain English

The FTC’s guide boils the law down to these requirements.

1. Don’t use false or misleading header information

Your “From”, “To”, “Reply-To” and routing information must be accurate and identify the person or business that sent the message. A “From” name like “Your Bank” when you’re a furniture store breaks the rule.

2. Don’t use deceptive subject lines

The subject line must reflect what’s actually in the email. “Re: your order” on a cold promotional email is a classic violation. Clever is fine. Misleading is not.

3. Identify the message as an ad

You must disclose clearly and conspicuously that the message is an advertisement. The law gives you flexibility on how. Many senders handle it with a footer line or by making the promotional nature obvious from the content itself. Ask counsel if you rely on the content alone.

4. Tell recipients where you’re located

Include a valid physical postal address. That can be your street address, a PO box registered with the US Postal Service or a private mailbox registered with a commercial mail receiving agency under Postal Service rules.

5. Tell recipients how to opt out

Explain clearly how to stop receiving your marketing email, using a return email address or another easy internet-based method. You can offer a preference menu, such as “only send me event news”, but there must also be an option to stop all commercial messages. Make sure your own spam filter doesn’t block opt-out replies.

6. Honor opt-out requests promptly

This is where the specific numbers live:

• Your opt-out mechanism must work for at least 30 days after you send the message.
• You must honor a request within 10 business days.
• You can’t charge a fee, ask for any personal information beyond an email address, or make someone do more than send a reply email or visit a single web page.
• Once someone opts out, you can’t sell or transfer their address, except to a company you’ve hired to help you comply.

7. Monitor what others do on your behalf

You can’t contract away responsibility. If an agency, affiliate or email service sends marketing for you, both the company whose product is promoted and the company that sends the message can be held legally responsible.

Penalties and enforcement

The FTC enforces CAN-SPAM. According to its compliance guide, each separate email that violates the law can bring a civil penalty of up to $53,088. A Federal Register notice from the FTC says its civil penalty amounts for 2026 stay at the 2025 levels, so that figure still applies this year. Amounts are adjusted for inflation over time, so check the FTC’s guide for the current number.

The law also has stricter provisions for aggravated conduct, such as harvesting addresses from websites or generating addresses automatically, and some deceptive practices can bring criminal penalties. Other federal agencies and state attorneys general can also enforce parts of the law, and internet service providers can sue in some cases.

Because penalties are counted per email, a single broken unsubscribe link on a 10,000-person send is a serious problem, not a rounding error.

What CAN-SPAM doesn’t cover, and the rules that sit beside it

CAN-SPAM is the federal floor, not the whole picture.

• Text messages. SMS marketing falls mainly under the Telephone Consumer Protection Act, which does require prior consent. Our guide to SMS marketing for small businesses covers those rules.
• Email to wireless domains. Under CAN-SPAM, the Federal Communications Commission adopted rules (47 CFR 64.3100) restricting commercial messages sent to email addresses at wireless carrier domains without express prior authorization. These are rare today, but they exist.
• State privacy laws. Comprehensive state privacy laws affect how you collect and use the data behind your list. See our guide to US state data privacy laws.
• International recipients. If you email people in the EU, UK or Canada, their laws generally require consent first. CAN-SPAM’s opt-out model does not satisfy them.
• Inbox provider rules. Gmail’s sender guidelines require bulk senders (5,000 or more messages a day to Gmail accounts) to authenticate with SPF, DKIM and DMARC, support one-click unsubscribe on marketing messages and keep user-reported spam rates below 0.3%. Google recommends processing unsubscribes within 48 hours, which is far faster than CAN-SPAM’s 10 business days. These aren’t laws, but missing them will hurt delivery. Our email deliverability guide and SPF, DKIM and DMARC explainer cover the setup.

In practice, if you meet Gmail’s requirements, you’ll comfortably meet CAN-SPAM’s timing rules too.

Where to start: setting up a compliant email program

If you’re building your email program now, these 6 steps put compliance into the system instead of relying on memory.

1. Choose a platform with compliance built in. Mainstream email marketing tools add an unsubscribe link and your postal address to every campaign footer and suppress unsubscribed contacts automatically. If you’re still comparing tools, our guide on how to choose an email marketing platform lists what to check.
2. Set up a single suppression list. Every unsubscribe, from any form, reply or phone call, should land in one list that all your sending tools check.
3. Record where each contact came from. CAN-SPAM doesn’t require consent, but a clean source record helps you defend complaints and comply with stricter laws. Build your list from real sign-ups, as covered in how to build an email list, never from purchased or scraped lists.
4. Write a vendor clause. If an agency or affiliate sends for you, put CAN-SPAM compliance and suppression-list sharing in the contract, and spot-check their sends.
5. Create footer and subject-line templates. Lock the footer into your template so nobody can delete it by accident.
6. Test the unsubscribe path monthly. Click it yourself, confirm the address is removed and check that replies to your sending address are monitored.

Pre-send CAN-SPAM checklist

Run this before every commercial send. It takes 2 minutes.

Print it, pin it or paste it into your campaign template.

Conclusion

The CAN-SPAM Act asks for honesty and an easy exit. Tell people who you are, don’t trick them with subject lines, show your address and stop emailing anyone who asks. Build those rules into your templates and suppression list once, and every future campaign inherits them. Then layer on inbox provider rules, which are stricter, and any state or international laws that apply to your list.

For more background on email and privacy terms, browse the glossary.

This is not legal advice.

Sources

• FTC: CAN-SPAM Act: A Compliance Guide for Business — the 7 requirements, opt-out timelines, transactional categories, primary purpose test, $53,088 penalty
• eCFR: 16 CFR Part 316, CAN-SPAM Rule — the FTC’s implementing regulation
• Federal Register: FTC Civil Penalty Inflation Adjustments notice (2026-18853) — FTC civil penalty amounts unchanged in 2026, 2025 levels still apply
• Google Workspace Admin Help: Email sender guidelines — bulk sender authentication, one-click unsubscribe and spam rate requirements
• Google Workspace Admin Help: Email sender guidelines FAQ — 48-hour unsubscribe recommendation
• eCFR: 47 CFR 64.3100 — FCC rule on commercial messages to wireless domains