What is CAN-SPAM?
The US federal law setting the baseline rules for commercial email, enforced by the FTC.
Want to see it first? Book a demo
CAN-SPAM — CAN-SPAM is the United States law governing commercial email: it requires accurate headers, a physical address, a working opt-out honoured within ten business days, and no deceptive subject lines, and it does not require prior consent. It is enforced by the FTC with per-message penalties.
Why it matters
CAN-SPAM sets the floor for commercial email sent to people in the United States. The "from" and routing details must be accurate, so the reader can tell who sent the message. Each email needs a real postal address and an opt-out that works. You must honour each opt-out within ten business days. Subject lines can't mislead about what's inside. Note what's missing: you don't need consent before the first message. That's why cold email to a work address is legal under CAN-SPAM, when stricter laws elsewhere would block it.
The Federal Trade Commission enforces the law, and fines apply to each message. So one slip costs little, but the same slip at scale costs a lot. Picture a sales team sending at volume. An honest mistake nobody checks, like an opt-out link that quietly breaks, turns into a large bill. CAN-SPAM only sets the minimum for US email. It says nothing about SMS, calls, or contacts outside the US, which each have their own rules.
What CAN-SPAM requires of a message
- 1
Accurate header information
Your from address and routing data can't be false or misleading.
- 2
A non-deceptive subject line
A subject must match what the message actually says.
- 3
Disclosure that it is an ad
Where it applies, readers must be able to tell the email is an ad.
- 4
A valid physical address
A real postal address for the sender must appear in the message.
- 5
A working opt-out honoured within ten business days
Recipients must be able to opt out, and that request must take effect within the required window.
The mistake to watch for
Questions
- How is CAN-SPAM different from GDPR?
- CAN-SPAM is a US law that needs no consent before the first sales email, only an honest sender name and a working opt-out. GDPR is an EU law. It needs a lawful basis, such as consent or legitimate interest, before you use a person's data at all.
- Does CAN-SPAM require opt-in consent before sending?
- No. CAN-SPAM lets you send a first sales email without consent, as long as the message meets its rules on sender name, address and opt-out. That sets it apart from laws that start from consent.
- Who enforces CAN-SPAM?
- The Federal Trade Commission enforces CAN-SPAM in the United States, with penalties that apply on a per-message basis. This is not legal advice.