What Is CAN-SPAM?
Definition
The CAN-SPAM Act is the United States law that sets rules for commercial email, enforced by the Federal Trade Commission. It does not ban cold email. It sets conditions every commercial message has to meet.
It is a conduct law, not a consent law. You do not need permission before you send, but each message must identify itself honestly, carry a real postal address, and offer a working opt-out that you act on quickly.
Which Emails CAN-SPAM Covers
The test is primary purpose, not volume. The FTC is explicit that the law “doesn’t apply just to bulk email” and covers all commercial messages, so a single prospecting email counts.
Every message falls into one of three buckets.
- Commercial. The main purpose is advertising or promoting a product or service. Full rules apply.
- Transactional or relationship. Exempt from most provisions, but the routing information still cannot be false or misleading.
- Mixed. Judged on the subject line and whether the transactional part appears near the top.
Transactional Categories Are Read Narrowly
Only five things qualify: completing an agreed transaction, warranty or safety notices, changes to an ongoing relationship or an account balance, employment and benefits information, and delivering something already agreed.
Having customers or members does not make your marketing transactional. The FTC warns these categories are viewed narrowly, and that is where most people get this wrong.
There is no business-to-business exemption. The FTC states plainly that the law “makes no exception for business-to-business email”, and gives a product announcement to former customers as an example of a message that still has to comply. If you run cold email outreach to work addresses, CAN-SPAM applies to every send.
Eight Rules CAN-SPAM Requires
The FTC lists eight, not the seven most summaries give. The eighth is the one teams forget.
- No false or misleading headers. From, To, Reply-To and routing details must be accurate and identify you.
- No deceptive subject lines. The subject has to reflect what is actually in the message.
- Identify the message as an ad. Disclose it clearly and conspicuously.
- Give a physical postal address. A valid one, in every commercial message.
- Explain how to opt out. Clearly, with a reply address or an easy web method.
- Let subscribers and members opt out too. A subscription does not remove opt-out rights.
- Honour opt-outs promptly. Within 10 business days.
- Monitor what others do for you. Agencies and sending partners do not carry your liability.
How To Handle Opt-Outs
This is the part that creates most enforcement exposure, and the rules are specific.
- Keep the mechanism working 30 days. It has to process requests for at least 30 days after the message went out.
- Act within 10 business days. That is the deadline for honouring a request.
- Charge nothing, ask nothing. No fee, no personal details beyond an email address, and nothing more than a reply or a single web page.
- Never sell an opted-out address. Not even inside a list, except to a vendor helping you comply.
One practical trap: the FTC specifically tells senders to check that their own spam filter is not blocking incoming opt-out replies. A filtered unsubscribe is still a missed unsubscribe.
CAN-SPAM Penalties and Who Pays Them
The FTC states that “each separate email in violation of the CAN-SPAM Act is subject to penalties of up to $53,088”. Per email, not per campaign, which is what makes a bad list expensive rather than embarrassing.
Liability spreads. More than one party can be held responsible, and hiring an agency does not move the risk off you. The FTC puts it directly: you cannot contract away your responsibility, and both the company being promoted and the company pressing send can be liable.
Aggravated conduct, such as harvesting addresses or hijacking machines to send, can carry criminal penalties including prison.
This is a plain-language summary of published FTC guidance, not legal advice. The figures and rules here come from the FTC’s own compliance guide for business, which is the document to check before you make a decision, because the penalty maximum is adjusted for inflation. Anything with real money attached is worth running past a lawyer.
What CAN-SPAM Does Not Require
Here is where it differs from the privacy laws people lump it together with.
CAN-SPAM does not require consent. There is no opt-in, no double opt-in, no prior relationship needed before a first message. That is why cold email is legal in the United States while the same send can be unlawful elsewhere.
It also does not require a plain-text version, a specific unsubscribe wording, or a particular sending domain. Those are deliverability practices, not legal duties, and mixing the two is how teams end up confident about the wrong things.
CAN-SPAM vs GDPR vs CASL
If you send across borders, the strictest law that applies to a given recipient governs that message.
| Law | Where | Consent before sending | Opt-out window |
|---|---|---|---|
| CAN-SPAM | United States | Not required | 10 business days |
| GDPR and ePrivacy | EU and EEA | Consent or legitimate interest, documented | Without undue delay |
| CASL | Canada | Express or implied consent required | 10 business days |
Practical consequence: a list that is fine to mail in Texas may be unlawful to mail in Toronto or Berlin. Segment by recipient country before you send, not after a complaint.
Bottom Line
CAN-SPAM lets you send cold email in the United States without asking first. In exchange it asks for honesty and a fast exit.
Put a real postal address in every commercial message, say clearly that it is an ad, keep headers and subject lines accurate, and make unsubscribing a one-click job you act on inside 10 business days.
Then check two things most teams skip: that your spam filter is not swallowing opt-out replies, and that whoever sends on your behalf is following the same rules, because their mistake is still your penalty.
FAQs
1- What does CAN-SPAM stand for?
Controlling the Assault of Non-Solicited Pornography and Marketing Act of 2003. It is the United States law governing commercial email, enforced by the Federal Trade Commission.
2- Is cold email legal under CAN-SPAM?
Yes. The law requires no consent before a first message. It requires accurate headers, a clear ad disclosure, a physical address and a working opt-out you honour within 10 business days.
3- Does CAN-SPAM apply to B2B email?
Yes. The FTC says the law makes no exception for business-to-business email, so messages to work addresses carry exactly the same obligations as messages to consumers.
4- How much is a CAN-SPAM fine?
Up to $53,088 for each separate email in violation, and more than one party can be held responsible. The maximum is adjusted for inflation, so confirm the current figure with the FTC.
5- How quickly must I process an unsubscribe?
Within 10 business days, and your opt-out mechanism must keep working for at least 30 days after the message was sent. You cannot charge a fee or ask for details beyond an email address.
6- Am I liable if an agency sends the email?
Yes. The FTC says you cannot contract away your responsibility. Both the company whose product is promoted and the company that sends the message can be held legally responsible.