CAN-SPAM Act (United States)

The CAN-SPAM Act sets the rules for commercial email in the United States. It establishes requirements for commercial messages, gives recipients the right to have a sender stop emailing them, and spells out penalties for violations. The FTC enforces the Act and the accompanying CAN-SPAM Rule.

Not legal advice — verify penalties and thresholds against the primary source (below) and counsel before relying on them. See compliance/README.md.

Key scope facts:

• Despite its name, CAN-SPAM does not apply just to bulk email. It covers all commercial messages, defined as "any electronic mail message the primary purpose of which is the commercial advertisement or promotion of a commercial product or service," including email that promotes content on commercial websites.
• There is no business-to-business exception. A message to former customers announcing a new product line must comply.
• CAN-SPAM is an opt-out regime: prior consent is not required to send commercial email, but opt-outs must be offered and honored. (Contrast with the opt-in regimes in Canada's CASL and the UK's PECR.)

Penalties

Exposure	Detail
Civil penalty	Up to $53,088 per separate email in violation (FTC Act §5(m)(1)(A) inflation-adjusted maximum; $53,088 took effect 17 January 2025 — the earlier figure was $51,744 — and remains current: the annual 2026 adjustment was cancelled after the CPI-U lapse, so verify against 16 CFR 1.98)
Multiple liability	More than one person can be liable for the same message — both the company whose product is promoted and the company that originated/sent the message
Deceptive claims	Misleading product/service claims may additionally violate deceptive-advertising law (Section 5 of the FTC Act)
Consumer redress	Under Section 19 of the FTC Act, redress may include what consumers paid plus the value of their lost time
Aggravated violations	Certain violations carry additional fines
Criminal penalties	Including imprisonment — see below

Criminal penalties (including imprisonment) apply to:

• accessing someone else's computer to send spam without permission;
• using false information to register for multiple email accounts or domain names;
• relaying or retransmitting multiple spam messages through a computer to mislead others about the origin of the message;
• harvesting email addresses or generating them via dictionary attack (sending to addresses made of random letters/numbers hoping to hit valid ones);
• taking advantage of open relays or open proxies without permission.

The seven main requirements

#	Requirement	Detail
1	No false or misleading header information	"From," "To," "Reply-To," and routing information — including originating domain name and email address — must be accurate and identify the person or business who initiated the message
2	No deceptive subject lines	Subject line must accurately reflect the content of the message
3	Identify the message as an ad	Disclose clearly and conspicuously that the message is an advertisement (the law allows leeway in how)
4	Include a valid physical postal address	Current street address, a P.O. box registered with the U.S. Postal Service, or a private mailbox registered with a commercial mail receiving agency established under Postal Service regulations
5	Tell recipients how to opt out	Clear and conspicuous explanation, easy for an ordinary person to recognize, read, and understand; give a return email address or another easy Internet-based way to communicate the choice
6	Honor opt-out requests promptly	See detailed rules below
7	Monitor what others do on your behalf	Legal responsibility cannot be contracted away to an email marketing vendor; both the promoted company and the sending company may be held responsible

Opt-out mechanics

• The opt-out mechanism must be able to process requests for at least 30 days after the message is sent.
• Opt-out requests must be honored within 10 business days.
• A sender may not: charge a fee; require any personally identifying information beyond an email address; or require any step other than sending a reply email or visiting a single web page.
• A preference menu (opting out of certain message types) is allowed, but it must include an option to stop all marketing messages.
• Ensure the sender's own spam filter does not block incoming opt-out requests.
• Once someone opts out, their address may not be sold or transferred, even as part of a mailing list — the only exception is transfer to a company hired to help comply with CAN-SPAM.
• Subscribers and members can opt out too. A subscription or membership does not remove the right to opt out of marketing email. Before sending a message with no unsubscribe link to subscribers/members, verify its primary purpose fits one of the five transactional/relationship categories below; otherwise an opt-out must be included.

Commercial vs. transactional or relationship messages

Coverage is determined by the primary purpose of the message. An email can contain three kinds of content:

1. Commercial content — advertises or promotes a commercial product or service, including content on a website operated for a commercial purpose;
2. Transactional or relationship content — facilitates an already agreed-upon transaction or updates a customer about an ongoing transaction;
3. Other content — neither of the above.

If the message contains only commercial content, it is commercial and all CAN-SPAM requirements apply. If it contains only transactional/relationship content, it is exempt from most provisions — but it still must not contain false or misleading routing information.

The five transactional/relationship categories

A message's primary purpose is transactional or relationship only if it consists only of content that:

1. facilitates, completes, or confirms a commercial transaction the recipient already agreed to;
2. gives warranty, recall, safety, or security information about a product or service the recipient bought;
3. notifies the recipient about a change in terms or features of a membership, subscription, account, loan, or other ongoing commercial relationship; or a change in the recipient's standing in that relationship; or provides regular, periodic account balance information;
4. provides information about an employment relationship or employee benefits;
5. delivers goods or services as part of a transaction the recipient already agreed to.

The FTC views these categories narrowly. Do not assume every message to subscribers or members is transactional. Test: would a reasonable consumer reading the email understand its primary purpose to fit one of the five categories?

Mixed commercial + transactional content

The message is commercial for CAN-SPAM purposes if either:

• a recipient reasonably interpreting the subject line would likely conclude it contains an advertisement or promotion; or
• the transactional/relationship content does not appear mainly at the beginning of the message.

Illustration from the FTC guide: an account statement with shipping/payment details first and a one-line website plug at the end is most likely transactional; the same subject line over a message that opens with promotions and buries the delivery notice at the end is most likely commercial.

Mixed commercial + "other" content

The primary purpose is commercial if:

• a recipient reasonably interpreting the subject line would likely conclude the message advertises or promotes a product or service; or
• a recipient reasonably interpreting the body would likely conclude its primary purpose is to advertise or promote.

Relevant factors: location of the commercial content (e.g., at the beginning?), how much of the message is commercial, and use of color, graphics, type size, and style to highlight the commercial content.

Who is the "sender" when multiple marketers appear in one message?

When one email advertises the goods, services, or websites of more than one marketer, the marketers can designate a single "sender" for compliance purposes, provided the designee:

1. meets the Act's definition of "sender" (initiates a commercial message advertising or promoting its own goods, services, or website);
2. is specifically identified in the "From" line; and
3. complies with the initiator provisions — no deceptive transmission information or deceptive subject heading, valid postal address, working opt-out link, and proper identification of the message's commercial or sexually explicit nature.

If the designated sender fails these duties, all marketers in the message may be held liable as senders.

Forward-to-a-friend messages

Whether the seller or the forwarder is the "sender"/"initiator" depends on the facts — chiefly whether the seller pays or offers a benefit for forwarding. If the seller offers money, coupons, discounts, awards, sweepstakes entries, or the like in exchange for forwarding — or pays/benefits anyone for generating web traffic or any form of referral — the seller likely has compliance obligations. (The UK reaches a similar result via "instigation" — see UK PECR.)

Sexually explicit email

An FTC rule under CAN-SPAM adds requirements for messages with sexually oriented material:

• The subject line must begin with the warning "SEXUALLY-EXPLICIT:".
• The message body must use the electronic equivalent of a "brown paper wrapper": when opened, the only viewable content may be the words "SEXUALLY-EXPLICIT:" plus the standard commercial-email disclosures (ad identification, physical postal address, opt-out procedure). No graphics are allowed on the wrapper; explicit content must require an affirmative act (scrolling, clicking) to view.
• The wrapper requirement does not apply if the recipient gave prior affirmative consent to receive the sender's sexually oriented messages.

Deliverability relevance

CAN-SPAM is a legal floor, not an inbox-placement strategy: mailbox providers' filtering standards (complaint rates, engagement) are far stricter than opt-out law. Sending "legal" mail that recipients never asked for still generates the complaints and low engagement that destroy sender reputation — see Foundations of Email Deliverability and Two Worlds of Email Deliverability.