What is CAN-SPAM?
The US federal law setting the baseline rules for commercial email, enforced by the FTC.
CAN-SPAM — CAN-SPAM is the United States law governing commercial email: it requires accurate headers, a physical address, a working opt-out honoured within ten business days, and no deceptive subject lines, and it does not require prior consent. It is enforced by the FTC with per-message penalties.
Why it matters
CAN-SPAM sets the floor for commercial email sent to recipients in the United States. It requires accurate "from" and routing information, so a recipient can tell who actually sent a message, a valid physical postal address in the message, a working opt-out mechanism that is honoured within ten business days, and subject lines that do not misrepresent the message's content. Notably, it does not require the sender to have prior consent before the first message, which is why cold email to a business address is legal under CAN-SPAM in a way it is not under stricter regimes elsewhere.
The law is enforced by the Federal Trade Commission, and penalties apply per individual message, which is what makes violations expensive at scale rather than in any single instance. A sales team running outbound at volume is the exact use case where an unmonitored honest mistake, such as an opt-out link that silently fails, turns into a large aggregate liability. CAN-SPAM sets the minimum for US email specifically; it says nothing about SMS, calling, or contacts outside the United States, which are each governed by their own rules.
What CAN-SPAM requires of a message
- 1
Accurate header information
The from address and routing data must not be false or misleading.
- 2
A non-deceptive subject line
The subject must reflect what the message actually contains.
- 3
Disclosure that it is an ad
The message must be identifiable as an advertisement where applicable.
- 4
A valid physical address
A real postal address for the sender must appear in the message.
- 5
A working opt-out honoured within ten business days
Recipients must be able to opt out, and that request must take effect within the required window.
The mistake to watch for
Questions
- How is CAN-SPAM different from GDPR?
- CAN-SPAM is a US law that does not require consent before the first commercial email, only an honest identity and a working opt-out. GDPR is an EU regulation that requires a lawful basis, such as consent or legitimate interest, before processing a person's data at all.
- Does CAN-SPAM require opt-in consent before sending?
- No. CAN-SPAM permits sending a first commercial email without prior consent, as long as the message meets its identity, address and opt-out requirements. This distinguishes it from consent-based regimes.
- Who enforces CAN-SPAM?
- The Federal Trade Commission enforces CAN-SPAM in the United States, with penalties that apply on a per-message basis. This is not legal advice.