CAN-SPAM Act

CAN-SPAM (the Controlling the Assault of Non-Solicited Pornography And Marketing Act of 2003) is enforced primarily by the Federal Trade Commission and applies to any commercial email message, business to business included. Unlike European rules, it is an opt-out law: you may email someone with no prior relationship, provided you follow its requirements and stop when they ask.

The core requirements are concrete. Header information, meaning the from name, from address, and routing data, must be accurate and identify the actual sender. Subject lines cannot mislead about the content of the message. Unless the recipient has given prior affirmative consent, the message must also be identifiable as an advertisement, though the law leaves leeway in how that disclosure is worded and placed. Every message must include a valid physical postal address for the sender, and every message must offer a clear, conspicuous way to opt out of future email, which can be a working reply address or an internet-based mechanism such as an unsubscribe link.

Opt-out handling has its own rules. The mechanism must keep working for at least 30 days after the message is sent, requests must be honored within 10 business days, and you cannot charge a fee, ask for anything beyond an email address, or require more than a visit to a single web page. Once someone opts out, their address cannot be sold or transferred except to a vendor helping you comply.

Responsibility does not transfer. If an agency or contractor sends on your behalf, both the company whose product is promoted and the company doing the sending can be held liable. Each separate violating email can draw a civil penalty in the tens of thousands of dollars, a cap the FTC adjusts periodically for inflation, and state attorneys general and internet service providers can also bring actions. This page is general information, not legal advice; talk to a lawyer about your specific program.

For US B2B outreach, CAN-SPAM is the baseline that makes cold email lawful when done correctly. No opt-in is needed, but a real sender identity, an honest subject line, a postal address, and a working opt-out are not optional, and the deadlines are maximums rather than targets. The same habits the law requires, truthful headers and disciplined suppression of opt-outs, overlap heavily with what mailbox providers reward, so compliance and deliverability usually rise and fall together.

If your list includes prospects outside the US, CAN-SPAM is not the only law that applies. Regimes like GDPR in the EU and CASL in Canada are stricter, and consent rules differ by country, so check the rules for every market you target.