Short answer: The CAN-SPAM Act sets the rules for commercial email in the US. It covers every commercial message, business-to-business email included, not only bulk mail. Each one needs honest headers and subject lines, a clear ad disclosure, your postal address and a working way to opt out. The FTC’s guide puts the penalty at up to $53,088.00 for each email that breaks the law.
It isn’t legal advice: confirm your case with your lawyer.
The emails the law covers
The law covers any email whose primary purpose is to advertise or promote a commercial product or service. An email can carry commercial content, transactional or relationship content, and other content.
A message with only transactional or relationship content, such as a purchase confirmation, is exempt from most of the law. Its routing information still can’t be false or misleading. The FTC reads those categories narrowly.
| What the email carries | What the law asks |
|---|---|
| Only commercial content | Every requirement |
| Only transactional or relationship content, such as a purchase confirmation | Routing information that isn’t false or misleading |
| Commercial and transactional content | Every requirement if the subject line reads as an ad or the transactional part isn’t mainly at the beginning |
| Commercial and other content | Every requirement if the subject line or the body reads as an ad |
| Offers from several companies | One of them can act as the sender; if it fails, all of them may be liable |
From the FTC’s “CAN-SPAM Act: A Compliance Guide for Business”, read November 2, 2026.
CAN-SPAM’s main requirements
- Keep your header information honest. Your From, To and Reply-To, and the domain and address that send the message, must identify you.
- Write a subject line that matches the content of the message.
- Say clearly that the message is an ad. The law leaves the wording up to you.
- Include your valid physical postal address: a street address, a post office box registered with the US Postal Service, or a private mailbox registered with a commercial mail receiving agency.
- Explain clearly how to opt out of your marketing email, with a reply address or another easy online way.
- Honor each opt-out within 10 business days, and keep your opt-out working for at least 30 days after you send. Don’t charge for it or ask for more than an email address. Once someone opts out, don’t sell or pass on their address.
- Watch what others send for you. If another company sends your email, both of you can be held responsible.
From the FTC’s “CAN-SPAM Act: A Compliance Guide for Business”.
Subscribers, penalties and other rules
Subscribers and members can opt out of your marketing email too. The FTC says you don’t need their consent to send it, but they keep the right to opt out.
Harvesting email addresses or using someone else’s computer to send spam without permission can also bring criminal penalties. The FTC notes its penalty figure reflects the inflation-adjusted maximums.
For commercial messages sent to phones, the FCC writes its own rules under the same law. For text messages, see our guide to TCPA text message rules.
CAN-SPAM doesn’t ask for email authentication, but Gmail asks anyone who sends to its personal accounts for SPF or DKIM. Our guide to SPF, DKIM and DMARC explains them.
From the FTC’s compliance guide, the FCC’s “CAN-SPAM” page and Gmail Help’s “Email sender guidelines”.
What our own emails show
On November 2, 2026, we read the email our site sends when someone writes to us. Its subject is “Thanks, (your name). We have your message”, and it opens by saying when we’ll reply.
A button to book a call comes after that. Its footer names our company and city, says you got the email because you wrote to us, and links to our privacy policy.
The FTC looks at the subject line and at what comes first to decide whether a message is an ad.
Before you send your next campaign
- The From name, the address and the sending domain are yours.
- The subject line matches what the email says.
- If the email promotes something, it says it is an ad.
- Your postal address is in the footer.
- The opt-out works with a reply or a single web page.
- Opt-outs are honored within 10 business days, with an option to stop all your marketing email.
RememberSay the email is an ad, put your postal address in the footer, and honor every opt-out within 10 business days. Check what any agency sends for you.
If you want us to run your email marketing, see our email and SMS marketing service.
Quick answers about the CAN-SPAM Act
What is the CAN-SPAM Act?
It is the US law that sets the rules for commercial email, from the header and the subject line to the opt-out. The Federal Trade Commission enforces it together with the CAN-SPAM Rule, and it covers business-to-business email too.
Does CAN-SPAM require opt-in?
The FTC’s main requirements ask for a clear way to opt out and for opt-outs honored within 10 business days, not for consent before the first email. The FCC writes separate rules for some text messages sent to phones.
Are there penalties for violating the CAN-SPAM Act?
Yes. The FTC’s guide puts the penalty at up to $53,088.00 for each separate email that breaks the law. More than one company can be held responsible, for example the one promoted and the one that sends.
Does CAN-SPAM apply to business-to-business email?
Yes. The FTC says the law makes no exception for business-to-business email, and that it covers all commercial messages, not only bulk email. Its example is a message to former customers about a new product line.
Do I need a street address in my marketing emails?
You need a valid physical postal address. The FTC accepts your street address, a post office box registered with the US Postal Service, or a private mailbox registered with a commercial mail receiving agency.
Sources
All read on November 2, 2026. Federal Trade Commission: CAN-SPAM Act: A Compliance Guide for Business. Federal Communications Commission: CAN-SPAM. Gmail Help: Email sender guidelines. Our own case: the email our site sends after a message, read on November 2, 2026.