Definition
The CAN-SPAM Act (Controlling the Assault of Non-Solicited Pornography And Marketing) is a United States federal law enacted in 2003 that establishes the rules for commercial email messages. It applies to any commercial email sent to or from the United States, regardless of where the sender is based.
The law is enforced by the Federal Trade Commission (FTC) and covers all commercial email whose primary purpose is advertising or promoting a product or service. Transactional or relationship messages are generally exempt. CAN-SPAM preempts state laws that would impose stricter requirements, creating a single national standard.
Key Requirements of CAN-SPAM
| Requirement | Description |
|---|---|
| Accurate subject lines | Subject line must not be deceptive about the email's content |
| Identify as advertisement | Clear disclosure that the email is commercial |
| Physical address | Valid physical postal address of the sender |
| Opt-out mechanism | Clear and conspicuous unsubscribe link or reply option |
| Prompt opt-out processing | Unsubscribes must be honoured within 10 business days |
| Sender identification | Clear identification of who is sending the email |
Penalties for Violations
Each violation of CAN-SPAM is subject to a penalty of up to $51,744 per email. This means a single campaign sent to 10,000 recipients could theoretically result in over $500 million in penalties if each email violates the law. Aggravated violations (such as harvesting email addresses or using automated tools) carry additional criminal penalties including imprisonment.
The FTC, state attorneys general, and Internet service providers can all bring lawsuits under CAN-SPAM. Businesses should take compliance seriously as even unintentional violations can result in significant fines.
How to Stay Compliant with CAN-SPAM
- Never use deceptive subject lines: The subject line must accurately reflect the content of the email. Misleading subject lines that promise one thing and deliver another are a primary enforcement target.
- Include a clear physical address: Every commercial email must include a valid physical postal address. This can be your current street address, a PO Box, or a registered commercial mail receiving agency.
- Make opt-out easy and obvious: Include a clearly visible unsubscribe link in every email. The opt-out mechanism must be easy to find and simple to use. Do not require more than a reply or visiting a single webpage.
- Honour opt-outs within 10 business days: Once a recipient unsubscribes, you have 10 business days to stop sending commercial email to them. This applies to all marketing emails, not just the specific list the recipient opted out from.
- Monitor third-party senders: If you hire a marketing agency to send email on your behalf, you are legally responsible for their compliance. Ensure your contracts include CAN-SPAM compliance obligations and audit their practices.
Related Glossary Terms
A/B Testing
A/B testing in email marketing is the practice of sending two variations of an email to a small sample of your list to determine which version performs better before sending the winner to the remaining subscribers.
Abandoned Cart Email
An abandoned cart email is an automated message sent to customers who added items to their online shopping cart but left without completing the purchase. It is one of the highest-converting email types in ecommerce.
AMP for Email
AMP for Email is a Google-developed framework that allows email messages to include interactive elements like forms, carousels, accordions, and live content. It turns static emails into dynamic, interactive experiences directly inside the inbox.
Click-Through Rate
Click-through rate (CTR) is the percentage of email recipients who clicked one or more links in your email campaign. It measures how compelling your content and call-to-action are.
Click-to-Convert Rate
Click-to-convert rate measures the percentage of email clicks that result in a desired conversion action such as a purchase, signup, or download. It shows how effective your post-click experience is at turning interest into results.
Click-to-Open Rate
Click-to-open rate (CTOR) is the percentage of email opens that resulted in at least one click. It measures how compelling your email content is for people who already opened it.
Frequently Asked Questions
Yes. CAN-SPAM applies to all commercial email, including business-to-business communications. However, transactional or relationship messages (such as order confirmations or account statements) are exempt. If the primary purpose of the email is commercial advertising or promotion, it must comply regardless of whether the recipient is a consumer or a business.
No. Unlike GDPR, CAN-SPAM does not require prior affirmative consent. It is an opt-out law, meaning you can send commercial email to anyone as long as you comply with the law's requirements and honour opt-out requests. However, mailbox providers may still filter unsolicited email as spam regardless of legal compliance.
The original sender is not liable for forwarding by others under CAN-SPAM. However, if you encourage or incentivise forwarding as part of a marketing strategy, you could be held responsible. The law focuses on the party who initiated the commercial email.
Yes, with limited exceptions for transactional or relationship messages. If the primary purpose of the email is commercial, it must include a clear and conspicuous opt-out mechanism. The opt-out cannot be hidden in fine print or require payment to process.
No. Under CAN-SPAM, the opt-out mechanism must be available at no cost to the recipient. You cannot require payment, provide a paid subscription option as the only unsubscribe method, or impose any other barrier that discourages opting out.