What does CAN-SPAM require?#
The FTC compliance guide for business lists the obligations in the imperative, and they are about the message rather than the mailing list. The table below is those rules with the plain-English version of each next to them.
| What the guide says | What it means for your newsletter |
|---|---|
| Do not use a deceptive subject line | The subject has to match what the email delivers. A subject about a sale that opens into an essay is the one that gets read as a lie. |
| Identify the message as an ad | Only where a reader could mistake a commercial message for something personal. A plainly labelled monthly update from a named shop does not need a banner. |
| Include a valid physical postal address | A real street address in the message. A post office box alone is not enough unless the FTC has accepted it for you. |
| Give a clear way to opt out | One link that works, in every commercial email, that does not ask them to log in or explain why they should stay. |
| Honour opt-outs within 10 business days | Remove them from the mailing list, and from any list you hand to another sender, and stop the scheduled sends. |
Do I need permission before I email someone?#
Under US federal law, no, and that surprises most people. CAN-SPAM is an opt-out regime: it lets a business mail a consumer who never asked, provided the message carries the address, the label and the working unsubscribe link, and the opt-out is honoured.
The reason to mail only people who asked is not the FTC. It is the receiving mailbox, which scores you on complaints and on whether readers open anything. An unasked address is where both of those numbers come from.
What address do I put in the footer?#
The one the guide calls a valid physical postal address: somewhere a letter reaches you. Most small businesses use their shop or office street address. A home address works too, and plenty of sole traders would rather not print it, which is when a registered office or a virtual address you control becomes useful.
It belongs in the footer of every campaign rather than only on your website, because the recipient should not have to visit a page to find out who is mailing them.
What counts as a good unsubscribe link?#
- One click does it. Making somebody sign in to leave is an obstacle, and obstacles get reported as spam instead.
- It keeps working after the click, for at least 30 days, which is the window the guide gives you to keep the option alive.
- It removes them everywhere, including segments and any list that feeds a second sending tool.
- It sits in the footer where a reader expects it rather than buried inside the paragraph about next month's hours.
What exactly goes in the footer of a marketing email?#
The footer is where three of the five rules land, and it is the part people copy once and then never look at again, which is how an old address ships to a thousand inboxes.
| What goes there | Why | What goes wrong |
|---|---|---|
| Your business name, the one you trade as | A reader needs to recognise the sender without opening the message twice | The legal entity nobody has ever seen on your signage |
| A valid physical postal address | The FTC guide requires it inside the message, not on your website | Copied from last year's brand, or left out because it feels unsafe to print a home address |
| One unsubscribe link | The opt-out has to be clear and conspicuous and easy to do | It works for the main list but not for a segment, so the reader keeps getting one campaign |
| A way to reply to a human | Not required, and the cheapest thing that stops a complaint | Nobody is assigned to the mailbox, so a question turns into a report |
A post office box alone does not satisfy the guide for an ordinary business. If printing your real address is the thing stopping you, a registered office or a virtual address you control does the job, and it is a small monthly cost rather than a legal risk.
Can I check my own send against these rules in five minutes?#
- Read your subject line and your first paragraph. Do they describe the same thing the email delivers?
- Scroll to the footer. Is your business name there, and a postal address where a letter reaches you today?
- Click the unsubscribe link from the test send rather than from the editor. Does it work without asking for a login?
- Send yourself one and search the message for the word advertisement or a note about what the mail is. It only matters when a reader could otherwise mistake a promotion for a personal message.
- Check the recipient list against your records. Every address on it should have a source you can say out loud.
Run that five-step check on one campaign and the rest inherit it, provided your footer is set in the sending tool rather than typed by hand each time. A footer you have to rewrite is a footer that will be wrong on one send.
What is the penalty for getting it wrong?#
The FTC guide states a civil penalty of up to $53,088 for each violating email, and that ceiling is adjusted for inflation, so check the figure on the FTC page rather than trusting a blog copy including this one. The practical exposure for a small sender is not one lawsuit. It is that each campaign you mail to an unasked list is a separate message, and the complaint rate arrives long before the lawyer.
Does CAN-SPAM cover every email I send?#
It divides commercial messages from transactional ones. A receipt, a booking confirmation or a password reset sits under the transactional rules and carries a lighter set of obligations, while anything that promotes a product or service is commercial and takes the full list.
The FTC guide warns that the label follows the primary purpose of the message, and that a transactional email with a promotion bolted on can be read as commercial. Before you rely on an exemption for a message to customers or members, read that page rather than a summary of it.
What if my readers are outside the US?#
Then CAN-SPAM is the smaller of your two rules. UK and EU guidance asks for a lawful basis, and where that basis is consent, GDPR Article 7 puts the burden of demonstrating it on you. Canada, Australia and several US states each add their own requirements on top.
The single habit that keeps all of them quiet is a list made only of people who asked, a record of when they asked, and a footer that gives them your address and one way out.
How do these rules compare with GDPR and Canada's CASL?#
They answer the same three questions in different orders, which is why one habit satisfies all of them. The table is the difference in what each regime asks for before you are allowed to send.
| The question | CAN-SPAM, United States | UK and EU | Canada, CASL |
|---|---|---|---|
| May I mail someone who never asked? | Yes, provided the message carries the address, the label and a working opt-out | Generally no for individuals. Companies and other corporate subscribers are treated more loosely | No, unless you hold express consent or a defined implied consent |
| What must be in the message? | Postal address, clear opt-out, honest subject, ad label where needed | Sender identity, a way to opt out, and the address is standard practice | Sender identity, contact details and an unsubscribe mechanism |
| How long is an unsubscribe link expected to work? | The guide says honour it within 10 business days and keep the mechanism live for at least 30 days after the send | No fixed window in the marketing rules; consent has to be as easy to withdraw as it was to give | The mechanism must remain usable after the send and removal happens promptly |
| Who is the riskiest sender? | Someone mailing a purchased list | Someone mailing without a record of consent | Someone mailing a list they bought at a trade show |
The figures each regime charges for a breach change and are stated by the regulators themselves, so read the FTC guide and the ICO guidance rather than a summary of either, including this one.
How do I keep proof that somebody asked?#
Four fields, kept per address, cover nearly every dispute and cost nothing to store. This is the record an evidence duty wants, and it is also the record that tells you which part of your list is safe to mail after a change of brand.
- The address itself, and how it joined: form, import, checkout, or a paper list.
- The date and time of that join, in a real format rather than a vague one.
- Where it came from, which for an import means the name of the file and who supplied it.
- Any later confirmation click, unsubscribe or complaint, each with its own date.
Does CAN-SPAM apply when I email other businesses?#
Yes. The rules are about whether a message promotes a commercial product or service, not about whether the reader is a consumer or a company, so a business-to-business offer carries the same obligations. The practical difference is in who complains: a stranger on a purchased list presses report spam, and a company that already buys from you writes and asks to be taken off.
Text messages are not quietly exempt either. The FTC treats a commercial mobile message as inside the same law, so a promotional SMS carries an identification and opt-out duty as an email does.
What breaks most often in a real small business send?#
- A footer copied from an old brand with the previous address still in it.
- An unsubscribe link that works for the main list and not for a segment, so the reader keeps getting one campaign.
- A subject line written for curiosity and a body that never mentions the thing it promised.
- A spreadsheet imported from a trade show mailed to everyone at once.
- Someone removed manually before the scheduled send left, which is how a 10-day clock starts and stops.
Campaign Kicker puts your postal address and a one-click unsubscribe in every campaign footer, and will not send at all until the address is filled in your account. Unsubscribes remove the contact from future sends, and bounce and complaint reports come back to you per campaign.
Set your footer once