What Is the CAN-SPAM Act?

What the law covers

CAN-SPAM, the Controlling the Assault of Non-Solicited Pornography And Marketing Act, applies to commercial electronic mail messages, meaning messages whose primary purpose is advertising or promoting a commercial product or service. The Federal Trade Commission enforces it. It applies to all commercial messages, including business-to-business email, with no general exception for B2B outreach. Transactional or relationship messages, such as receipts and account notices, are largely exempt from most requirements but must not contain false or misleading routing information.

The main requirements

The FTC's compliance guidance summarises the law's main requirements for commercial messages as follows.

Responsibility for others

Companies remain responsible for complying with CAN-SPAM even when they hire someone else to send email on their behalf, such as an agency, contractor, or independent rep. Both the company whose product is promoted and the company that sends the message can be held legally responsible. This makes oversight of outsourced outreach important.

Opt-out mechanics

The opt-out mechanism must be easy to use and must keep working for at least thirty days after a message is sent. Once someone opts out, you cannot send them further commercial email, and you cannot sell or transfer their address, except to a company helping you comply. Maintaining a permanent suppression list ensures that people who opt out are never contacted again by anyone on your team.

Penalties

Each separate email that violates the law can be subject to civil penalties, with amounts adjusted periodically for inflation, so violations across a campaign can become very costly. Deceptive practices can also lead to other legal action. Beyond penalties, ignoring the rules damages sender reputation and deliverability.

CAN-SPAM and cold email

Because CAN-SPAM does not require prior consent, cold email to US recipients is generally permitted if each message complies. In practice, compliant cold email identifies the sender honestly, uses accurate subject lines, includes a postal address and opt-out, and honours opt-outs quickly. Compliance with the law is a minimum; deliverability also depends on recipient engagement and complaint rates.

How CAN-SPAM compares with other laws

Other jurisdictions are often stricter. Canada's anti-spam law, CASL, generally requires express or implied consent before sending commercial electronic messages. The EU and UK combine data protection law with electronic marketing rules that often require consent, with differences between business and individual recipients. If you email internationally, apply the rules for each recipient's location rather than assuming CAN-SPAM is enough.

Building compliance into your process

Make compliance automatic rather than relying on memory. Use templates that include the postal address and opt-out link, check every message against your suppression list before it sends, record the recipient's region to apply the right rules, and log sending decisions. Systems that enforce these checks for every sender, including AI agents and external reps, prevent individual mistakes from becoming campaign-wide violations.

Common CAN-SPAM mistakes

Common mistakes include omitting the postal address in cold email templates, using subject lines that imply an existing relationship, such as a fake reply prefix, hiding or breaking the unsubscribe link, taking longer than ten business days to process opt-outs, and failing to share suppression lists with agencies or reps who send on your behalf.

CAN-SPAM and AI-sent email

Messages drafted or sent by AI agents are subject to the same rules as any other commercial email. The sending system, not the agent's instructions, should guarantee that every message includes the required address and opt-out, and that suppressed recipients are never contacted.

Keeping records

Keep records of opt-out requests, when they were processed, and which messages were sent to whom. Logs make it possible to show compliance if questions arise and help diagnose problems quickly.

This page is general information about what the Act requires, not legal advice. Enforcement turns on specifics, and other countries' rules may apply to the same campaign, so take advice on your own sending.