Email Marketing and the CAN-SPAM Rules Senders Overlook

The federal CAN-SPAM Act does not require permission before you send commercial email. That surprises most marketers, and it is the starting point for understanding the statute. What the law requires instead is honesty and an exit: truthful headers and sender address, a subject line that matches the message, a statement that the message is an advertisement, a real postal address, a working way to opt out, and removal within ten business days. The rules live at 15 U.S.C. § 7701 and the sections that follow it.

Three beliefs that cause most of the trouble

"We need opt-in consent." Not under this statute. Consent-based sending is good deliverability practice and is required by some other countries' laws, but U.S. federal law does not make prior permission the trigger for lawful commercial email. Confusing the two leads teams to build consent records while leaving an unsubscribe link broken.

"Our vendor handles compliance." The statute reaches the advertiser whose product or service is promoted, not only the party that pressed send. Hiring an agency or a list broker changes who does the work, not who answers for it.

"It is transactional, so the rules do not apply." Messages that are genuinely transactional or relationship messages carry lighter obligations, but the category is decided by the message's primary purpose. A shipping notice with a promotion attached can move across the line.

Note: The opt-in myth persists because deliverability guidance and legal requirements get blended together. Mailbox providers do block senders with poor list hygiene — a commercial consequence, not a legal one. Both matter; they are not the same rulebook.

The duties the statute actually imposes

The core obligations are short and mechanical. A message aimed at commercial advertising or promotion has to satisfy all of them, not most of them.

• Accurate header information. The "from", "to", routing data and originating domain or address must identify the sender truthfully.
• A non-deceptive subject line. The subject has to reflect what the message actually contains.
• Identification as an advertisement. The message must make clear, in some reasonable way, that it is an ad.
• A valid physical postal address. A current street address or a registered post office box for the sender belongs in the message.
• A clear opt-out mechanism. A visible, workable way to say stop, explained in language a reader can find and understand.
• Prompt honouring of opt-outs. Requests must be processed within ten business days of receipt.

The opt-out mechanism carries constraints that are easy to breach through interface design. Unsubscribing cannot require a fee, cannot require personal information beyond an email address, and cannot force the reader through more than a single page. A flow demanding a login, a survey, a password reset or a phone call is the classic failure. The FTC's business guidance hub collects the agency's material for senders.

The opt-out clock

The timing rule usually fails because of a technical gap between a marketing platform and a customer database. Mapping it out helps.

1. On send

   A functioning opt-out mechanism must already be in the message. It cannot be added later or point at a page that is not yet live.

2. When a request arrives

   It reaches your commercial messages generally, not only the campaign the reader happened to click from.

3. Within 10 business days

   The address must stop receiving commercial messages from you. Business days, not calendar days — but the practical answer is to process immediately.

Ten business days is a ceiling, not a target. Where a company runs several sending systems — marketing platform, sales tool, support desk, product notifications — the suppression list has to reach all of them. A reader who unsubscribes from a newsletter and then hears from a salesperson's automation has a legitimate complaint even though two different tools were involved.

Traps that catch experienced senders

Rented and purchased lists. Buying a list does not make the recipients yours or transfer any compliance history with them. Every message still needs the full set of duties satisfied under your name, and the accuracy requirements apply to your sending infrastructure regardless of where the addresses came from. Data acquired from brokers also carries its own obligations in several states, including registration duties and consumer deletion rights — covered in our explainer on data broker registration and deletion requests.

Referral and forward-to-a-friend campaigns. When a company induces users to message their contacts, who counts as sender and who as advertiser gets complicated fast. The more the company controls the content and rewards the forwarding, the harder it is to call the resulting email a purely personal note.

Sender versus advertiser. One email can promote several businesses, and more than one party can carry duties for the same message. Multi-brand newsletters, affiliate blasts and co-marketing sends all raise the question of who answers for what, and settling it in the contract beforehand is far easier than after a complaint. Where those contracts are formed through an online signup flow, the formation questions in our analysis of when an online agreement binds apply directly.

Sender reputation is not a legal defense. Warming a subdomain, tuning authentication records and keeping complaint rates low are deliverability work. They do not substitute for a postal address or a working unsubscribe, and a clean reputation does not answer a regulator's question about a deceptive subject line.

Federal preemption, state law, and the separate wireless rule

CAN-SPAM is a federal statute, and it preempts most state anti-spam laws. That preemption has a stated limit: state laws that target falsity or deception in commercial email survive it. So a state statute imposing its own consent or labelling scheme is generally displaced, while a state law prohibiting forged headers or fraudulent subject lines generally is not.

The practical result is a two-layer picture. Federal law sets the operating rules nationwide, while state law remains available for deceptive email practices that state attorneys general pursue under consumer-protection statutes. California, for example, has an anti-spam statute litigated repeatedly over exactly where the preemption line falls, with results that have not been uniform. As of mid-2026, treat the scope of that exception as unsettled rather than fixed.

A separate federal regime governs commercial messages sent to wireless devices. The Federal Communications Commission administers rules for messages directed at mobile service accounts, and they do not work like CAN-SPAM. Treat a campaign touching mobile messaging as a distinct compliance question with its own consent expectations, not as email with a shorter character limit.

Content rules layer on top of all of this. An email that promotes a product still has to be truthful and substantiated under general advertising law — see the FTC's advertising and marketing guidance — and endorsements inside a newsletter need the same disclosures as any other channel, as set out in our guide to endorsement disclosures under FTC advertising rules. Email that sells a recurring plan also has to meet the separate rules on negative-option billing and canceling recurring charges.

Common questions

Can I email people who never signed up for my list?

Under federal law, yes — CAN-SPAM has no prior-consent requirement, so cold commercial email is not automatically unlawful. Every other duty still applies in full: truthful headers, an honest subject line, ad identification, a postal address, and a working opt-out honoured within ten business days. Whether it is a sensible commercial decision is a separate question, since unsolicited mail drives complaint rates that damage your ability to reach any inbox.

How fast do I actually have to remove someone who unsubscribes?

The statutory outside limit is ten business days from the request. In practice most platforms suppress immediately, and the risk sits in the gaps between systems rather than in the timing itself. Check that the suppression list is shared with every tool that can send mail under your brand, including sales automation, support software and product notification services, because a request covers your commercial messages generally.

Does a shipping confirmation with a coupon in it count as advertising?

It depends on the message's primary purpose. A genuine transactional or relationship message carries lighter obligations, but adding promotional content can shift the classification, particularly when the promotion dominates the subject line or the top of the message. The safest structure keeps the transactional information first and prominent, with any offer clearly secondary — and treats a message built mainly around an offer as commercial.

We hired an agency to run the campaign, so are we off the hook?

No. The statute reaches the advertiser whose product or service is promoted as well as the party that transmitted the message. Outsourcing the sending does not outsource the responsibility. A contract allocating the work and requiring compliance is worth having, and it can matter between you and the agency, but it will not answer a regulator asking why your promotion went out with no postal address.

Auditing a sending program, in order

1. Inventory every system that can send mail. Marketing platform, sales tools, support desk, billing, product notifications, and anything an agency operates for you.
2. Send yourself one message from each. Read it as a recipient and check the six duties against the actual rendered email, not the template.
3. Click your own unsubscribe. Time it, count the pages, and note anything it asks for beyond an email address.
4. Confirm suppression is shared. Opt out of one list and verify the address stops receiving commercial mail from every other system.
5. Classify borderline messages. Decide, in writing, which templates are transactional and why, and review any that carry promotional blocks.
6. Fix the postal address once. Put a current, valid address in the shared footer so no template can be published without it.

Practical step: Keep a dated record of what a campaign looked like when it went out — the rendered message, the list source, and the suppression state. Reconstructing that months later from a platform that has since been reconfigured is the part that usually proves impossible. The FTC's consumer site shows how recipients are told to report problem mail, which is a useful view of what a complaint looks like from the other side.