CAN-SPAM, the US federal law governing commercial email, is often misunderstood as requiring prior opt-in consent before sending marketing email — it does not. CAN-SPAM is fundamentally an opt-out framework: a business can generally send unsolicited commercial email as long as it meets a specific set of formatting and disclosure requirements and honors opt-out requests promptly. This is a meaningfully lower bar than GDPR's opt-in consent standard, which is why a US-only email program can be CAN-SPAM compliant while still being non-compliant for EU recipients — the two laws are not interchangeable, and a business emailing an international list needs to satisfy the stricter standard for whichever audience it reaches. Note that state-level and other countries' laws can layer additional requirements on top; treat this as a conceptual overview and consult counsel for specifics relevant to your situation.

CAN-SPAM core requirements at a glance

Requirement	What it means in practice	Common violation
Accurate header information	From/To/routing info must not mislead about the sender	Spoofed or misleading "From" names
Non-deceptive subject line	Subject must reflect the actual email content	Clickbait subject unrelated to the body
Clear identification as an ad	Message must be identifiable as a commercial email	Disguising ads as personal or transactional email
Physical postal address	A valid physical address must be included	Omitting it or using a non-functional address
Visible, working opt-out mechanism	A clear way to unsubscribe, easy to find	Buried or non-functional unsubscribe link
Honor opt-outs promptly	Opt-out requests processed within the required window	Continuing to send after the honor deadline

The opt-out mechanism is where most violations happen

The requirement that draws the most enforcement attention is the opt-out mechanism itself: it has to be clearly and conspicuously displayed, has to remain functional for a meaningful period after the email is sent, and the business has a limited window to actually process the request and stop sending once it's received — continuing to email someone past that honor window is a violation even if the unsubscribe link itself worked fine. A second common failure is charging a fee, requiring the recipient to provide more information than their email address, or requiring login to opt out — any of these can be treated as not providing a legitimate opt-out option at all. The law describes the honor timeframe in specific terms; treat the exact number of days as something to verify against current FTC guidance or counsel rather than relying on memory, since compliance details like this are the kind of thing worth confirming rather than assuming.

can_spam_send_checklist.txt

text

Before sending a commercial email campaign:

[ ] From name/address accurately identifies the sending entity
[ ] Subject line matches the actual email content
[ ] Email is identifiable as an advertisement where required
[ ] Valid physical postal address included (registered address
    or PO box accepted under the law)
[ ] Unsubscribe link visible, not buried in tiny footer text
[ ] Unsubscribe mechanism requires no fee, login, or extra info
    beyond what's needed to identify the recipient
[ ] Suppression list updated and enforced across ALL sending
    tools/ESPs before the honor deadline
[ ] Transactional emails (receipts, shipping) not bundled with
    promotional content in a way that disguises the ad content

"Transactional" email isn't a free pass for promotional content

A receipt or shipping notification is generally exempt from some CAN-SPAM commercial-email requirements because its primary purpose is transactional, not promotional. But stuffing that same email with prominent cross-sell banners and marketing copy can shift its primary purpose in a way that pulls it back under the full commercial-email rules, including the opt-out requirement. If a transactional email carries meaningful marketing content, the safer approach is to treat it as commercial email for compliance purposes rather than assume the transactional label protects it.

Multiple senders, one message: who's responsible

CAN-SPAM holds both the business whose product is being advertised and any third party actually sending the email on its behalf potentially responsible for violations — outsourcing email sends to an ESP, affiliate, or agency doesn't transfer away the underlying compliance obligation. This matters for affiliate marketing and co-branded campaigns in particular: a brand can be exposed by a non-compliant email an affiliate sent promoting its product, which is why vetting affiliate/partner sending practices and contract language addressing compliance is a real risk-management step, not boilerplate.

CAN-SPAM vs. GDPR consent model (quick contrast)

Dimension	CAN-SPAM (US federal)	GDPR (EU)
Default posture	Opt-out — can send until recipient objects	Opt-in — consent generally required before sending
Core mechanism	Working unsubscribe link + accurate headers	Affirmative consent record per purpose
Applies to	Commercial email sent to US recipients	Processing of EU residents' personal data

Compliant isn't the same as deliverable

An email can satisfy every CAN-SPAM requirement and still get filtered to spam or blocked outright by mailbox providers whose own policies (engagement-based filtering, sender reputation, authentication requirements like SPF/DKIM/DMARC) are stricter and enforced independently of the law. CAN-SPAM compliance is a legal floor, not a deliverability strategy — treat list hygiene and sender reputation as a separate, ongoing discipline.

What's next

Email's opt-out-by-default model is notably more permissive than the consent bar text messaging has to clear. Next: TCPA & SMS Marketing Compliance →

I build these systems professionally.

Whether it's a RAG pipeline, analytics migration, or AI workflow — let's talk.

Work With Me →

Need production AI or MarTech expertise? I build custom LLM workflows, server-side GTM tagging, and analytics infrastructures professionally.

Need custom AI or MarTech setup? Let's build together.

Let's talk →