CAN-SPAM rules apply to every commercial email you send, including cold email to business addresses. The law makes no exception for business-to-business messages. If the main purpose of your email is to promote a product or service, you must follow seven requirements, and each email that breaks them can cost up to $50,120.
This guide explains those seven requirements in plain words. It is general information for teams that send sales email, not legal advice. For questions about your own program, ask a lawyer.
Who the law covers
The CAN-SPAM Act sets the rules for commercial email. Despite its name, it is not only about bulk email. It covers all commercial messages. In the law's terms, a message is commercial when its main aim is to advertise or promote a commercial product or service. That includes email that promotes content on a commercial website.
Business-to-business email gets no pass. A note to former customers about a new product line must follow the law. So must a cold email from a sales rep to a stranger at another company.
The penalty is steep. Each separate email that breaks the law can bring a penalty of up to $50,120. A list of 1,000 contacts is 1,000 chances to break the rules.
Sources: FTC, "CAN-SPAM Act: A Compliance Guide for Business"
The seven requirements
The FTC boils the law down to seven points. Use them as a checklist before any campaign goes out.
- No false or misleading header information. Your "From," "To," and "Reply-To" fields, plus the routing data, must be accurate. They must show who really sent the message.
- No deceptive subject lines. The subject must match what is inside the email.
- Say it is an ad. You can choose how, but the disclosure must be clear and easy to see.
- Give your location. Include a valid physical postal address.
- Explain how to opt out. Tell people how to stop future email from you, in a way an ordinary person can understand.
- Honor opt-outs fast. Act on each request within 10 business days.
- Watch your helpers. You stay responsible for email sent on your behalf.
The next sections look closer at the points that trip teams up most.
Sources: FTC, "CAN-SPAM Act: A Compliance Guide for Business"
Headers, subject lines and the ad label
Cold email teams often send from several domains and inboxes. The law says the sender details must be accurate. That includes the originating domain name and email address. They must identify the person or business that started the message.
Subject lines must be honest too. A subject like "Re: our call" on a first-touch email that you never discussed with the person is the kind of trick the rule targets. Keep the subject tied to the real content.
The ad label is the least strict point. The FTC says the law gives you a lot of leeway in how to disclose that a message is an advertisement. It only has to be clear and conspicuous. A plain line in the body can do the job.
Sources: FTC, "CAN-SPAM Act: A Compliance Guide for Business"
Your address and your opt-out
Every commercial email must carry a valid physical postal address. The FTC lists three kinds that work:
- Your current street address.
- A post office box registered with the US Postal Service.
- A private mailbox registered with a commercial mail receiving agency under Postal Service rules.
The opt-out notice must be easy to spot, read and understand. The FTC notes that type size, color and placement can all help. Give a return email address or another simple internet-based way to say "stop." You may offer a menu of choices, such as fewer emails, but you must also offer a way to stop all commercial messages from you.
Check your own filters, too. If your spam filter blocks the replies that carry opt-out requests, you are not meeting the rule.
Sources: FTC, "CAN-SPAM Act: A Compliance Guide for Business"
How to handle opt-out requests
Your opt-out method must keep working for at least 30 days after you send the message. When someone asks to stop, you have 10 business days to honor the request.
You may not make it hard. The FTC says you cannot:
- Charge a fee.
- Ask for any personal details beyond an email address.
- Make the person do more than reply to the email or visit one web page.
Once someone opts out, you cannot sell or transfer that address, even as part of a mailing list. The one exception is a company you hired to help you comply with the law.
Sources: FTC, "CAN-SPAM Act: A Compliance Guide for Business"
Outside vendors and mixed messages
Hiring an agency or a sales tool to send email does not move the risk away from you. The FTC says you cannot contract away your legal duty. Both the company whose product is promoted and the company that sends the message may be held responsible. Ask vendors how they handle opt-outs, and check their work.
Some messages mix sales content with account updates. The FTC calls updates about a deal the person already agreed to "transactional or relationship" content. Email with only that kind of content is exempt from most of the law, but it still cannot carry false routing information. For mixed messages, the primary purpose decides. A message counts as commercial if a reader of the subject line would likely think it is an ad, or if the transactional content does not appear mainly at the start.
The safe habit is simple. If a message sells anything, treat it as commercial and meet all seven points.
Sources: FTC, "CAN-SPAM Act: A Compliance Guide for Business"
A quick pre-send checklist
- Is the From name and address real and yours?
- Does the subject line match the email?
- Is it clear the email is an ad?
- Is a valid postal address in the footer?
- Is there a plain, working way to opt out?
- Is your suppression list updated within 10 business days?
- Do your sending partners follow the same steps?
If you can answer yes to all seven, you have covered what the FTC lists as the main requirements of the law.
Sources
- Federal Trade Commission, "CAN-SPAM Act: A Compliance Guide for Business." ftc.gov