CAN-SPAM. The US email law that sounds permissive and isn't.

01What CAN-SPAM actually is

CAN-SPAM stands for "Controlling the Assault of Non-Solicited Pornography And Marketing Act of 2003" — a backronym so awkward that it tells you something about how the law was rushed through Congress in response to an early-2000s commercial spam epidemic. It became effective January 1, 2004, and remains the primary federal law governing US commercial email.

The law has two important conceptual decisions baked into it that shape every operational question:

First, it's opt-out, not opt-in. Unlike GDPR (which requires a lawful basis before processing) or Canada's CASL (which requires express or implied consent), CAN-SPAM permits commercial email without prior consent. The legal theory was that mandatory opt-in would impose excessive burdens on legitimate marketing; the practical effect is that US-based cold outreach is legal in a way most other major jurisdictions don't permit.

Second, it preempts state law. CAN-SPAM specifically preempts state anti-spam laws that conflict with it, with carve-outs for state laws addressing fraud and deception. This means there's a single federal standard for most purposes (California has carved out additional consumer-protection requirements that survive preemption; covered briefly later).

The combination — opt-out permitted + federal preemption — makes the US the most-permissive major jurisdiction for cold outreach. But "permissive" is not the same as "no rules", and the rules CAN-SPAM does impose are precise, automatically enforced via per-email fines, and easy to violate by accident.

02What it covers (and doesn't)

CAN-SPAM applies to any "commercial electronic mail message" — defined as email whose primary purpose is the commercial advertisement or promotion of a commercial product or service. The "primary purpose" framing matters: an email can have multiple purposes (transactional + commercial, or relationship + commercial) and only counts as "commercial" under the law if commercial is dominant.

The categories the law explicitly distinguishes:

Commercial messages — full CAN-SPAM compliance required. Examples: cold outreach, marketing newsletters, product announcements, sales follow-ups.

Transactional or relationship messages — exempt from most CAN-SPAM requirements (but still subject to the header-accuracy rule). Examples: order confirmations, account statements, employment notifications, prior-relationship customer service. The key distinction: the message must be primarily about a transaction or relationship the recipient has already established with you.

Dual-purpose messages — judged on which purpose is dominant. A receipt that includes a small upsell at the bottom is transactional; a marketing email that mentions the recipient's account status is commercial. The FTC has issued guidance suggesting that what's in the subject line and the top of the message is the primary indicator of which purpose dominates.

Important: B2B is not exempt

A common misconception: CAN-SPAM only applies to consumer email. It doesn't — B2B commercial email is fully covered. The law's exemption is for transactional/relationship messages, not for B2B in general. A US-based SDR's cold email to a US-based VP is commercial; CAN-SPAM applies in full.

Another misconception: addresses obtained from publicly-available sources are exempt. They're not. The source of the email address doesn't change whether the message is commercial; it just changes whether your data acquisition itself was lawful (which is a separate question).

03The seven requirements

Every commercial email subject to CAN-SPAM must meet all seven of the following. Missing any one is a per-email violation:

The seven requirements collectively make sense as a coherent system: identify yourself accurately, tell the recipient what they're getting, give them a way out, respect their decision, and don't outsource your obligations. The teams that violate CAN-SPAM aren't usually disagreeing with the principles; they're cutting corners on operational implementation.

04CAN-SPAM vs. GDPR side-by-side

The two regimes are often confused. For any team running outbound in both the US and EU, understanding the differences is non-optional:

For US-based teams doing global outbound, the practical implication is: build to GDPR standards, and CAN-SPAM compliance is largely automatic. GDPR's requirements are a strict superset of CAN-SPAM's for most operational purposes — except for the opt-out window, where CAN-SPAM is actually stricter (10 business days vs. GDPR's general 30 calendar days). The reverse is not true: a CAN-SPAM-compliant program is usually nowhere near GDPR-compliant.

05The fine math

What a CAN-SPAM violation actually costs. The math is structured around per-email penalties — which makes even modest campaigns potentially catastrophic if the violation is systemic:

The actual enforcement record is much more moderate than the theoretical maximum — the FTC rarely pursues the per-email cap, settling instead for amounts in the $25K-$2M range for serious cases. But the theoretical exposure exists, and a hostile actor (e.g., a competitor filing a complaint, a state AG pursuing a politically-motivated case) can push toward the cap. The asymmetric structure of the fine — small prevention cost vs. unbounded violation cost — is exactly why CAN-SPAM violations are operationally indefensible.

06FTC enforcement reality

The Federal Trade Commission is the primary enforcer of CAN-SPAM. Their enforcement record over the last decade shows a clear pattern of who gets pursued and how:

The FTC pursues spammers, not legitimate marketers who slip up. The headline cases — multi-million dollar settlements — almost always involve high-volume actors with multiple, willful violations: spoofed sender info combined with fake unsubscribe combined with deceptive subject lines combined with no physical address. A legitimate B2B sender with a single accidental violation has not historically been a target.

State AGs are increasingly active. California, Washington, and New York have been more aggressive than the FTC in pursuing email-marketing violations under state consumer-protection laws. California's CCPA + CPRA add additional requirements for sales of personal information that interact with CAN-SPAM in messy ways. Practical implication: don't assume FTC enforcement record is your only exposure.

Private rights of action are limited but exist. CAN-SPAM doesn't generally let private parties sue under federal law, but ISPs (Gmail, Yahoo, etc.) have explicit standing and have pursued cases against high-volume spammers — usually for amounts that match their actual deliverability costs. More common: state-law consumer-protection claims based on the same conduct.

The synthesis: moderate exposure for legitimate B2B teams that mostly comply, severe exposure for high-volume actors with multiple willful violations. The line between the two is mostly about systematic vs. accidental — the FTC reads "systemic" patterns as evidence of intent to violate, which is what triggers high settlements.

07Three places teams violate accidentally

Most CAN-SPAM violations in serious B2B outbound programs happen in three specific places. Each is fixable in well under an hour:

1. Sequencer alias addresses that don't trace back to the sending entity. Many sequencers offer "send from" aliases like [email protected] when the actual sending entity is a different company. If the recipient can't trace the email back to the real sender entity through the "from" and "reply-to" fields, that's a Req 1 violation. Fix: ensure the "from" field and reply-to are at the actual sender's domain.

2. Opt-out propagation lag across systems. Recipient unsubscribes from a Sequencer A sequence, gets removed from Sequencer A's send list, but is not removed from the CRM that feeds Sequencer B. Within a week, Sequencer B kicks off a different sequence and emails the same recipient. That's a Req 6 violation (failure to honor opt-out within 10 business days). Fix: a centralized suppression list above all sending tools that every send checks against.

3. Third-party SDR firms or list brokers acting on your behalf without compliance verification. If you hire an outsourced SDR firm to send cold emails in your name, their non-compliance is your non-compliance. This is the Req 7 catch — many outsourcing arrangements transfer the operational work but not the legal responsibility. Fix: contractual compliance representations + audit rights + actual monitoring of what gets sent.

Each of these is a "we set up the system years ago and didn't think about it" violation, not a deliberate corner-cut. That's why the FTC's enforcement record suggests audits — sometimes the right time to look at the system is when nothing's wrong yet.

08The 8-item compliance checklist

What 30 minutes of one-time work looks like to get a US-based outbound program CAN-SPAM compliant:

1. Audit every "from" address used in commercial email. Each must resolve to an entity that is actually the sender. Sequencer aliases that obscure the sender are violations.
2. Add a footer to every commercial email template. Footer must include valid physical postal address (street address or P.O. box). Same footer in every commercial email; updated whenever the address changes.
3. Verify the unsubscribe link in every template works. One-click ideal; multi-step OK as long as not deceptive. Page must function. Process must complete in under 24 hours.
4. Build a centralized suppression list above all sending tools. Every send by every tool checks the list before going. Opt-outs propagate within minutes, not days. List retained 5+ years.
5. Audit subject lines for deception. No "RE:" without a prior thread. No "FWD:" without an actual forward. No fake urgency ("URGENT") or fake personal indicators ("Your invoice"). The subject must accurately describe the message.
6. Document and monitor third-party senders. Every vendor, contractor, or partner sending email in your name must contractually represent compliance. Audit their compliance quarterly. Sample their sends.
7. Train sales teams on the basics. Reps need to know not to forge "from" names, not to use deceptive subject lines, and to forward any opt-out requests to the central suppression system. 15-minute training, refreshed annually.
8. Set up a complaint-investigation process. If an FTC complaint or state AG inquiry arrives, you need a defined responder and process. Most companies discover they don't have one when they get the first letter — at which point response time matters.

The teams that run through this checklist once and then enforce it discover that CAN-SPAM compliance is essentially zero ongoing operational cost. The teams that don't discover that "we'll get to it" tends to coincide with the FTC also getting to it.

09Common mistakes

10Related terms

CAN-SPAM is one of several jurisdictional regimes covering commercial email. To go deeper: