Email Marketing Laws: What the CAN-SPAM Act Requires

Is email marketing legal in the US?

Yes. The main federal law is the CAN-SPAM Act, enforced by the Federal Trade Commission (FTC). It covers any commercial message, meaning email whose main purpose is to advertise or promote a product or service. It applies to business-to-business email as well as email to consumers, so there is no exception for B2B lists.

CAN-SPAM is an opt-out law: it does not require you to get permission before the first email. It does require that every commercial email meets a set of rules, and that you stop emailing people who ask you to.

The core CAN-SPAM requirements

These are the main rules every commercial email must follow:

• Accurate header information: the From, To, Reply-To and routing details must correctly identify the person or business sending the message.
• Honest subject lines: the subject line must reflect what is in the email. No misleading teasers.
• Identify the message as an ad: the email must make clear that it is advertising, though the law does not dictate exact wording.
• Include your physical postal address: a valid street address, a post office box registered with the USPS, or a registered private mailbox.
• Explain how to opt out: give a clear, easy way to unsubscribe, such as a link or a reply address.
• Honor opt-outs quickly: process unsubscribe requests within 10 business days, and keep your opt-out method working for at least 30 days after you send.
• Do not make unsubscribing hard: you cannot charge a fee, ask for more than an email address and preferences, or make people do more than reply or visit one page.

Who is responsible if an agency sends the email?

Both can be. Under CAN-SPAM, the business whose product is promoted is responsible for compliance even if another company sends the email on its behalf. That is one reason to work with a partner who knows the rules. We always follow best practices and applicable laws, and compliance is built into the setup of every campaign rather than checked at the last minute.

Penalties are set per violating email and adjusted by the FTC each year. They can reach tens of thousands of dollars for a single message, so a large send with a basic mistake can be very costly.

Transactional emails versus marketing emails

Emails that confirm an order, send a receipt, deliver account updates or provide warranty information are transactional or relationship messages. They are largely exempt from CAN-SPAM, but they still cannot contain false or misleading routing information.

Be careful with mixed emails. If an order confirmation is mostly a promotion with a receipt attached, it may count as commercial. The FTC looks at the primary purpose, which includes what the subject line and the top of the email suggest.

Consent best practices beyond the law

Meeting the legal minimum is not the same as running a good list. Sending to people who never asked for your emails leads to spam complaints, poor deliverability and damage to your sender reputation, which can push even your wanted emails into spam folders.

If you email people outside the US, other laws may apply. Canada and the European Union, for example, generally require consent before you send marketing email, so an opt-in approach is the safer default.

• Use opt-in sign-up forms and say clearly what people will receive and how often.
• Consider double opt-in, where new subscribers confirm by clicking a link.
• Never buy or rent email lists.
• Keep a record of when and how each person signed up.
• Remove inactive and bouncing addresses regularly.
• Make the unsubscribe link easy to find, not hidden in tiny grey text.

A quick compliance check before you hit send

Before each campaign, check that the sender name is clearly yours, the subject line matches the content, your postal address is in the footer, the unsubscribe link works, and everyone who opted out has been removed. This guide covers the basics and is not legal advice; for specific questions about your business, speak to a lawyer.