The CAN-SPAM Act of 2003 (15 U.S.C. §§ 7701–7713) and the FTC's implementing rule (16 C.F.R. Part 316) govern all commercial email, not merely bulk spam, through a disclosure-and-opt-out model rather than a consent requirement. This guide explains the "primary purpose" test that separates regulated commercial messages from exempt transactional or relationship messages, the seven operational requirements every message must satisfy, and how liability is divided between "senders" and "initiators" so that neither an advertiser nor its email vendor can outsource its statutory duties. It maps the full enforcement architecture—FTC civil penalties exceeding $51,000 per offending email under 16 C.F.R. § 1.98, sector-regulator authority, state attorney general suits, and internet-access-service claims—together with the criminal offenses under 18 U.S.C. § 1037 and the effect of AMG Capital Management on FTC monetary remedies. It explains why individual recipients cannot sue under the Act after Gordon v. Virtumundo, how the preemption clause of 15 U.S.C. § 7707 leaves state anti-fraud statutes standing, and how CAN-SPAM interacts with the consent-first regimes of the TCPA, the GDPR, and Canada's CASL. It closes with a build-your-program blueprint, a worked cross-border scenario, and a practitioner FAQ.