The CAN-SPAM Act sets the rules that commercial email senders must follow

The CAN-SPAM Act is a federal law that tells businesses what they must do when they send you marketing email, promotional messages, or newsletters. It does not ban commercial email — it sets the minimum standards for how senders must behave. If a business breaks these rules, the Federal Trade Commission (FTC) can fine them, and in some cases you or your state's attorney general can sue.

The law applies to almost any email sent for commercial purposes: sales pitches, product announcements, newsletters with ads, and promotional content from companies you have never heard of. It does not cover transactional emails — order confirmations, shipping notices, password resets, or account statements — because those are not selling anything.

Understanding what CAN-SPAM requires helps you recognize when a sender is breaking the law, and it explains why legitimate businesses include certain information in their emails that might seem annoying but are actually required.

Key Takeaways

  • Every commercial email must include the sender's physical mailing address and a working unsubscribe link that the sender must honor within ten business days.
  • Subject lines cannot be deceptive — they must accurately reflect the email's content, so a line that hides the fact that it is an advertisement violates the law.
  • Senders must identify the email as an advertisement if it is one, and they must respond to complaints within a reasonable time.
  • The FTC enforces CAN-SPAM, but state attorneys general and private parties can also take action against senders who break the rules.
  • CAN-SPAM does not require senders to ask permission before sending the first email, but it does require them to stop when you unsubscribe.

What must be in every commercial email

CAN-SPAM requires four pieces of information in every marketing email. First, the email must clearly identify itself as an advertisement or promotional message — either in the subject line or at the top of the message body. Second, it must include the sender's physical mailing address. This can be a street address, a private mailbox, or a registered agent's address, but it must be real and current.

Third, the email must include a clear and conspicuous unsubscribe mechanism — usually a link or reply-to address that lets you opt out. The sender must honor that request within ten business days and must not charge you a fee or ask for additional information beyond your email address. Fourth, the sender must include a valid reply-to email address or another way to contact them about the message.

If any of these four elements is missing or false, the sender is breaking the law. Many spam emails fail on the physical address requirement alone — they either omit it or list a fake one.

Subject line rules and deceptive headers

The subject line cannot be misleading about the email's content or purpose. If the subject says "Your account has been compromised" but the email is actually selling discount vitamins, that is deceptive and violates CAN-SPAM. The subject does not have to say "Advertisement" — it just has to be truthful about what is inside.

The sender's name and email address in the "From" field must also be accurate. You cannot send an email that appears to come from someone it does not actually come from, and you cannot use a misleading domain name designed to trick people into thinking the email is from a trusted source.

The FTC has brought cases against senders who used subject lines like "Re: Your recent purchase" when the recipient had never made a purchase, or who spoofed well-known company names in the sender field to make spam look legitimate.

The unsubscribe requirement and how it works

Every commercial email must give you a way to unsubscribe, and that mechanism must work. The most common form is an unsubscribe link at the bottom of the email. When you click it, the sender must remove your address from their mailing list within ten business days. They cannot ask you to log in, pay a fee, or provide information beyond your email address to unsubscribe.

Some senders use a reply-to address instead, where you can email back to request removal. This is legal under CAN-SPAM, but it is less common because it requires more work from you. A link is faster and clearer.

If you unsubscribe and the sender keeps emailing you, they are breaking the law. The same applies if a sender removes you from one list but keeps sending you emails from a different list or under a different sender name — each distinct sender must honor your unsubscribe request separately.

What CAN-SPAM does not require

CAN-SPAM does not require senders to get your permission before sending the first email. This is why you can receive marketing email from companies you have never done business with — they do not need your consent to start. However, some types of email have stricter rules: unsolicited commercial text messages and faxes require prior written consent under a different law called the Telephone Consumer Protection Act (TCPA).

CAN-SPAM also does not require senders to use a specific format or design. There is no rule about font size, color, or layout. The law focuses on truthfulness and the ability to unsubscribe, not on how professional or polished the email looks.

The law does not cover email sent for non-commercial purposes — newsletters from nonprofits, personal messages, or emails from friends. It also does not cover transactional emails like order confirmations or account alerts, even if those emails contain some promotional content.

Who enforces CAN-SPAM and what happens when rules are broken

The FTC is the primary enforcer of CAN-SPAM. They investigate complaints, bring cases against large-scale spammers, and have fined companies millions of dollars for violations. State attorneys general can also sue senders who break the law, and in some cases, you or other recipients can sue for damages if the sender knowingly violates the rules.

Penalties vary. The FTC can impose civil penalties of up to $43,792 per violation (this amount adjusts annually for inflation). If a sender knowingly breaks the law, the penalty can be higher. In private lawsuits, you may be able to recover actual damages or statutory damages of $100 to $25,000 per email, depending on the circumstances and the state where you live.

In practice, most enforcement happens against large-scale spammers and scammers, not against legitimate businesses that make minor mistakes. However, if a sender is deliberately deceptive or ignores unsubscribe requests, they are at risk.

How to report CAN-SPAM violations

If you receive email that breaks CAN-SPAM rules — no unsubscribe link, a fake sender address, a deceptive subject line, or continued emails after you unsubscribed — you can report it to the FTC. Forward the email to spam@uce.gov, which is the FTC's spam reporting address. Include the full email headers if possible, as they help investigators trace the sender.

You can also report spam to your email provider. Gmail, Outlook, Yahoo, and other services have their own spam filters and reporting systems. Marking an email as spam helps train their filters and may prevent similar messages from reaching your inbox in the future.

If you have been harmed by a sender who knowingly violated CAN-SPAM — for example, a sender who continued emailing you after you unsubscribed multiple times — you may want to consult a lawyer about a private lawsuit. Many attorneys handle these cases on a contingency basis, meaning you do not pay unless you win.

Frequently Asked Questions

Does CAN-SPAM explore to email from outside the United States?

CAN-SPAM applies to any commercial email sent to a recipient in the United States, regardless of where the sender is located. If a business in another country sends marketing email to a U.S. address, they must follow CAN-SPAM rules. However, enforcing the law against foreign senders is difficult, which is why much spam originates overseas.

What counts as a deceptive subject line?

A subject line is deceptive if it misleads you about what the email contains or who sent it. Examples include "Urgent: Your account needs attention" when it is actually a sales pitch, or "Re: Your recent order" when you never placed an order. The subject does not have to mention that it is an advertisement, but it cannot hide that fact through trickery.

If I unsubscribe from an email list, can the sender ever email me again?

Not for marketing purposes. Once you unsubscribe, the sender must remove you from their list and cannot send you promotional emails. They can still send transactional emails like order confirmations or account notifications. If they send you marketing email again, they are breaking the law.

Can a business use a P.O. box instead of a street address?

Yes. CAN-SPAM requires a physical mailing address, and a P.O. box counts. A registered agent's address also works. The address must be real and current — a fake or abandoned address violates the law.

What should I do if I keep getting emails after I unsubscribed?

First, check that you unsubscribed from the correct sender — some companies send from multiple addresses. If you unsubscribed and still receive emails from the same sender, forward the unwanted emails to spam@uce.gov and include details about when you unsubscribed. You can also report the sender to your email provider and consider blocking them.