A No Nonsense Guide to CAN-SPAM

If you’re sending emails to promote your business, products, or services, here’s a question worth asking: are your emails legal?

It’s not a scare tactic; it’s the real deal. The CAN-SPAM Act is a U.S. federal law that sets rules for commercial emails in the United States, and if you’re not following them, you could be risking more than your inbox reputation. We’re talking fines that can hit five figures per email. Yikes.

As a lawyer for online business owners, I’ve seen how easy it is for well-meaning business owners to break these rules without realizing it. But don’t worry, email compliance doesn’t have to be confusing or kill your creative flow.

Here’s what the CAN-SPAM Act actually requires, how it affects everything from newsletters to cold emails, and what you can do to stay legal while still landing in inboxes (not spam folders).

Legal Disclaimer: This post is for educational purposes only and does not constitute legal advice. Read full disclaimers.

What Is the CAN-SPAM Act, Really?

The CAN-SPAM Act (short for “Controlling the Assault of Non-Solicited Pornography and Marketing”) was passed in 2003 to stop deceptive, unwanted, and abusive email practices that were swamping inboxes in the early 2000s.

But here’s what a lot of marketers don’t realize: CAN-SPAM doesn’t ban unsolicited emails. You’re allowed to send commercial messages without prior consent in the U.S., as long as you follow the rules. And there are quite a few of them.

The law applies to any email whose primary purpose is promotional or commercial. That includes:

• Announcements for a new product or service
• Affiliate marketing promotions
• Launch emails for courses or digital products
• Sponsored newsletter content
• Even holiday sales or discount codes

And yes, it applies whether you’re a Fortune 500 company or a solo blogger running your business out of a cozy corner of your kitchen.

The 7 CAN-SPAM Rules You Must Follow

Here’s the heart of email marketing law in the U.S., broken down simply, with real-world context to help you avoid costly mistakes.

1. Use Accurate Header Information

Your “From,” “To,” “Reply-To,” and routing info must reflect who’s actually sending the message. In other words, don’t impersonate someone else or disguise your identity.

This rule is about transparency and accountability. If your email says it’s coming from “help@yourbrand.com,” that needs to be legit. Don’t use misleading aliases or borrowed domains just to seem more official or anonymous.

2. Don’t Use Deceptive Subject Lines

Your subject line must be a truthful preview of the message. If it says “Here’s your free download,” there better be a free download inside, not a pitch to buy something else.

You don’t need to be boring, but you do need to be honest. Misleading subject lines are not only illegal, they’re also one of the fastest ways to trigger spam filters and lose subscriber trust.

3. Disclose That It’s an Ad (When It Is)

If your email is primarily promoting something for sale, it must be clearly identified as an advertisement.

This doesn’t mean shouting “THIS IS AN AD” in all caps, but it does mean avoiding shady tricks, like pretending an email is a personal message from a friend, or hiding your sales pitch under the guise of a “newsletter update.”

You can meet this requirement with a short, honest intro. Something like, “We’re sharing this offer with our subscribers because we think you’ll love it,” works fine.

4. Include Your Physical Postal Address

Every commercial email must include a valid physical mailing address somewhere in the message, usually in the footer.

This can be:

• Your business address
• A registered P.O. Box
• A rented mailbox at a commercial mail receiving agency (like a UPS Store box or iPostal address)

It must be current and reachable. Not only is this a legal requirement, but it also helps establish credibility and legitimacy.

5. Provide a Clear Way to Unsubscribe

You must include an easy-to-find, easy-to-use unsubscribe link or mechanism in every email.

That means no hiding it behind a login wall, no making people scroll through paragraphs of fine print, and no sneaky tactics like labeling it “click here for communication preferences” if that doesn’t actually let people opt out.

Best practice? One click, one confirmation. And no questions asked.

6. Honor Unsubscribes Promptly

If someone unsubscribes, you have 10 business days to remove them from your list, and you must keep them off.

You can’t:

• Charge a fee to unsubscribe
• Require users to fill out a form
• Ask them to explain why they’re leaving
• Sell, share, or transfer their email afterward

You can offer email frequency options or other choices on the unsubscribe page, but they must be optional and respectful of the user’s right to fully opt out.

7. You’re Responsible for What Others Send on Your Behalf

If you outsource your email marketing to a VA, agency, or affiliate partner, and they break the law while promoting your brand, you’re still on the hook.

That means you need to:

• Vet their practices
• Set expectations and policies
• Review the content they send
• Use tools that help you stay in control of branding and compliance

This “joint liability” rule ensures that no one can hide behind third-party services to avoid responsibility. If your name is on the campaign, the law sees you as accountable.

Is Cold Emailing Legal?

Yes, but only if you do it right.

The CAN-SPAM Act does not technically prohibit cold emails. You can legally email someone without prior consent as long as:

• You identify yourself and your business
• Your subject line and message are truthful
• You offer a way to opt out
• You promptly honor opt-outs

So what makes a cold email legal, not spammy?

A good cold email should:

• Be tailored to the recipient (not a generic mass blast)
• Provide a legitimate reason for reaching out
• Offer something of potential value (a collaboration, service, resource, etc.)
• Respect boundaries, especially if the recipient says “no thanks”

Want to increase your chances of success and avoid legal trouble? Use verified business email addresses (not personal Gmail accounts), make your outreach human and respectful, and always, always include an opt-out.

How Does CAN-SPAM Compare to GDPR and CASL?

This is where international email laws get interesting.

The U.S. is one of the few countries where opt-out email marketing is legal. But that won’t fly everywhere. If you’re emailing people outside the U.S. (especially in Canada or the EU) you need to follow their stricter rules.

Here’s a quick comparison:

CAN-SPAM (U.S.):

• Allows unsolicited emails
• Requires clear opt-out
• Enforced by the FTC
• Penalties up over $50k per email

GDPR (EU):

• Requires explicit, informed opt-in consent
• Requires proof of consent
• Focused on data rights and processing transparency

CASL (Canada):

• Requires either express or implied consent
• Implied consent can expire (e.g. 2 years after a purchase)
• Heavily enforced, with penalties up to $10 million

If you’re building a global email list, the safest approach is to adopt the strictest standard: opt-in consent with clear disclosures and easy unsubscribe options. Bonus: it also improves your deliverability and engagement.

Can You Actually Get Fined for Violating CAN-SPAM?

Yes, and it happens more than most people realize.

The Federal Trade Commission has fined companies millions of dollars for failing to follow the CAN-SPAM Act. Offenses include:

• Sending deceptive or misleading emails
• Ignoring unsubscribe requests
• Failing to include an opt-out option
• Using harvested or purchased email lists

And while big cases grab headlines, smaller businesses have been penalized too, especially when they work with sketchy email marketing vendors or affiliates.

Even if you’re not getting fined, noncompliance can trigger:

• Email blacklisting
• Lower deliverability rates
• Subscriber distrust
• Permanent damage to your sender reputation

It’s simply not worth the risk.

How to Stay Compliant With CAN-SPAM

Here’s your go-to checklist for CAN-SPAM compliance that’s also human-friendly:

• Use a legit, professional email address (not “noreply@” unless absolutely necessary)
• Write subject lines that match your message
• Include your mailing address in every email
• Add a working unsubscribe link in a visible place
• Don’t buy email lists. Build your own, ethically
• Keep opt-in records when possible
• Make sure your email platform handles unsubscribes correctly
• Review your automations and funnels for compliance gaps
• Educate anyone emailing on your behalf, your affiliates, your VA, your agency