Checklist · Technology

CAN-SPAM Compliance for Commercial Email: A Practical Checklist

Type
Checklist
Jurisdiction
National
Date
2025-03-30
Topic
Technology

The CAN-SPAM Act (15 U.S.C. §§ 7701–7713) and the FTC's implementing rule (16 C.F.R. Part 316) do not outlaw unsolicited commercial email; they impose a disclosure-and-opt-out code of conduct on every commercial message, whether it goes to one recipient or ten million, B2B or B2C. This checklist turns that code into an operating procedure: classify each message under the primary-purpose test, keep the routing data and subject line honest, label a pitch as a pitch, publish a valid physical postal address, offer a one-step opt-out that stays live for at least thirty days, honor unsubscribes within ten business days and treat them as permanent, never sell or transfer a suppressed address, and scrub every send against one company-wide suppression list. It allocates sender and initiator liability that no contract can transfer away, works through affiliate marketing and the single-sender designation, adds the four aggravated-violation traps and the criminal spam statute, and layers in the TCPA for texts and GDPR, CASL, and state law for cross-border and in-state recipients. Each phase pairs checkboxes with the reason behind the rule and the trap that catches the careless. Because the per-email civil penalty is inflation-adjusted every year, confirm the current maximum in the FTC's latest adjustment notice before you rely on any figure quoted here.

CAN-SPAM Compliance for Commercial Email: A Practical Checklist

Technology > Advertising and Marketing | Published 30 March 2025 - Updated 15 July 2025 | UpLaw - uplaw.us

A field-tested compliance workflow for anyone who sends commercial email in or into the United States: how to classify each message, satisfy the seven substantive requirements, build opt-out and suppression machinery that survives an FTC audit, place liability on the right party, and stack the TCPA, GDPR, CASL, and surviving state law on top of the federal floor.

Keywords: CAN-SPAM Act, email marketing compliance, commercial email, transactional message, primary-purpose test, opt-out mechanism, suppression list, physical postal address, deceptive subject line, header information, FTC enforcement, 16 C.F.R. Part 316, civil penalty, sender/initiator liability, affiliate marketing, aggravated violations, TCPA, GDPR, CASL, preemption

The Statute That Does Not Do What Its Name Says

Say the name out loud and you would bet the house that Congress banned junk email. It did not. Controlling the Assault of Non-Solicited Pornography And Marketing — the acronym was reverse-engineered to spell CAN-SPAM — permits exactly what a casual reader assumes it forbids. A stranger may email you a sales pitch with no prior relationship, no consent, and no invitation, and the law is fine with it, provided the sender follows a short list of honesty-and-exit rules. There is no federal do-not-email registry. There is no opt-in requirement. There is no cap on how many uninvited pitches may land in your inbox.

What the Act actually does is set the terms of engagement for commercial email: tell the truth about who is writing and what the message is, label a solicitation as a solicitation, give every recipient a working way to leave, and stop mailing anyone who takes it. That is a disclosure-and-opt-out regime, and it is the photographic negative of the consent-first regimes that govern most of the rest of the developed world. Europe's rule is "do not email me unless I asked." America's rule is "email me all you like, but be honest and let me go." Understanding that inversion is the beginning of wisdom here, because a marketer who assumes the U.S. works like the EU will over-comply and lose business, and one who assumes the EU works like the U.S. will under-comply and collect fines.

Three structural features shape everything that follows. First, the Act reaches all commercial email, not just bulk campaigns — a single hand-typed sales note from a founder to one prospect is a "commercial electronic mail message" subject to the same requirements as a ten-million-address blast. Volume is irrelevant to coverage; it matters only to exposure, because each separately addressed unlawful message is a separate violation. Second, it applies to business-to-business email exactly as it applies to business-to-consumer email. The myth that CAN-SPAM is a consumer-only statute has cost a lot of B2B marketers a lot of money; the recipient's status as a corporate purchasing manager rather than a household shopper changes nothing. Third, the Act is a floor, not a ceiling and not a safe harbor. Perfect CAN-SPAM compliance does not immunize a deceptive email from Federal Trade Commission Act § 5, from the Lanham Act, from a state consumer-fraud statute, or from a state computer-crime law. You can do everything on this checklist and still be liable for what the email says.

The statutory spine is the CAN-SPAM Act of 2003, 15 U.S.C. §§ 7701–7713. Congress laid out its findings and purposes in § 7701, defined its terms in § 7702, imposed the substantive prohibitions in § 7704, allocated enforcement in § 7706, and set the preemption boundary in § 7707. The operating detail lives in the FTC's rule, 16 C.F.R. Part 316, which supplies the primary-purpose test (§ 316.3), the opt-out mechanics (§ 316.5), the Adult Labeling Rule (§ 316.4), and the definitions that make the statute usable (§ 316.2). A separate criminal statute, 18 U.S.C. § 1037, backstops the civil scheme for fraud-based spamming. Work this checklist for every campaign, every drip sequence, and every one-off blast, and keep the FTC's plain-language "CAN-SPAM Act: A Compliance Guide for Business" within reach as the agency's own gloss on its rule.

How to use this checklist

The checklist runs in eight phases, and the order is deliberate. Phase 1 answers the threshold question — is this even a commercial message? — because a wrong answer there voids everything after it. Phases 2 and 3 cover the seven substantive requirements and the opt-out machinery that is the heart of the bargain. Phase 4 places liability on the correct party or parties, which is where sophisticated marketers most often go wrong. Phase 5 covers the aggravated violations and the criminal statute. Phase 6 handles special content. Phase 7 stacks the other regimes — the TCPA, GDPR, CASL, and surviving state law — on top of the federal floor. Phase 8 is governance: testing, documentation, training, and monitoring. Each phase gives you the checkboxes, then the reason the rule exists, then the trap that catches people, then a worked hypothetical. When you are unsure whether a rule applies, the safe move is almost always to treat the message as fully regulated commercial email and include the entire apparatus. Over-compliance is never itself a violation.

Phase 1 — Classify Every Message: The Primary-Purpose Test

  • [ ] Sort the message into one of three buckets: commercial, transactional or relationship, or other (informational, editorial, political, or charitable).
  • [ ] If you think it is transactional or relationship, confirm it fits one of the five enumerated categories in 15 U.S.C. § 7702(17)(A): (1) facilitating or confirming an agreed transaction; (2) warranty, recall, safety, or security information about a purchased product; (3) account, subscription, membership, or ongoing-relationship notices, including changes in terms or balance; (4) information about an employment relationship or employee benefit; or (5) delivery of goods or services the recipient is entitled to under a prior transaction.
  • [ ] For a message that mixes commercial and transactional content, apply the FTC's primary-purpose rule at 16 C.F.R. § 316.3: it is commercial if a recipient reading the subject line would likely conclude the message contains an advertisement, or if the transactional content does not appear at the beginning of the body.
  • [ ] Run the subject-line-and-top-screen test: if someone who read only your subject line and the first screenful of the email would think you are selling something, build it as a commercial message.
  • [ ] When classification is genuinely close, treat the message as commercial and include the full compliance apparatus. Doing so never violates the Act.

This is the single most consequential decision in the entire framework. Get the classification right and every downstream requirement falls into place. Get it wrong and you can violate the statute while sincerely believing you are exempt — the most dangerous posture in all of compliance, because it removes the instinct to check.

The three-bucket taxonomy comes straight from the definitions. A commercial message is one whose primary purpose is "the commercial advertisement or promotion of a commercial product or service," 15 U.S.C. § 7702(2)(A). A transactional or relationship message is one whose primary purpose fits one of the five § 7702(17)(A) categories. Everything else — a newsletter that is purely editorial, a candidate's campaign email, a nonprofit's fundraising appeal, a purely informational notice — falls outside the commercial-message regime, though other law may reach it. Crucially, transactional and relationship messages are not exempt from the Act altogether. They are exempt from the labeling, opt-out, and postal-address requirements, but they remain bound by the header-honesty prohibition of § 7704(a)(1). A shipping confirmation with a forged "From" line violates CAN-SPAM even though it sells nothing.

The transactional categories are read narrowly, and this is where marketers stumble. A customer relationship does not convert every message to that customer into a transactional one. The five categories are a closed list, and the FTC and courts resist attempts to smuggle promotion into them. The classic maneuver — and the primary-purpose test exists precisely to police it — is bolting a pitch onto a transactional shell. The order confirmation that also announces a flash sale. The password-reset email that also recommends a premium upgrade. The shipping notice whose subject line reads "Your order shipped — and here's 20% off your next one." Each of those is a mixed message, and the rule in § 316.3 decides which way it tips.

Under that rule, a mixed message is commercial if either of two things is true. First, if a recipient reading the subject line would likely conclude the body contains an advertisement, the whole message is commercial — no matter how much genuine transactional content sits inside. Second, even if the subject line is clean, the message is commercial unless the transactional content appears at the beginning of the body. Lead with the receipt; bury the promotion below it; keep the subject line focused on the transaction. Flip any of those and you have manufactured a commercial email that now needs a label, a postal address, and a working unsubscribe — none of which your transactional template includes.

Worked example. Imagine a hypothetical meal-kit company, "Thistle & Thyme." Its logistics system sends every customer a delivery confirmation. Version A has the subject line "Your Thistle & Thyme box arrives Thursday" and a body that opens with tracking details, then, three screens down, mentions a referral credit. Version B has the subject line "Your box is coming — plus 30% off our new dessert line!" and a body that opens with the promotion above the tracking number. Version A is transactional: the subject line signals a delivery update, and the transactional content leads. It needs only honest headers. Version B is commercial: the subject line advertises, so the primary-purpose test tips it over, and now it needs the advertisement disclosure, a valid physical postal address, and a functioning one-step opt-out. The difference between a compliant transactional email and a non-compliant commercial one came down to one clause in a subject line and the order of two paragraphs. That is the level of granularity the statute operates at, and it is why classification is Phase 1.

Phase 2 — The Seven Substantive Requirements

  • [ ] 1. No false or misleading header information. Confirm the "From," "To," "Reply-To," and originating routing data accurately identify the person who initiated the message. This applies to every email, transactional messages included. 15 U.S.C. § 7704(a)(1).
  • [ ] 2. No deceptive subject lines. Confirm the subject line does not mislead the recipient about a material fact regarding the contents or subject matter of the message. 15 U.S.C. § 7704(a)(2).
  • [ ] 3. Identify the message as an advertisement. Give clear and conspicuous notice that a commercial message is an advertisement — unless the recipient gave prior affirmative consent to receive it. 15 U.S.C. § 7704(a)(5)(A)(i).
  • [ ] 4. Provide a valid physical postal address. Include the sender's current physical postal address: a street address, a Postal Service post office box, or a private mailbox registered with a commercial mail-receiving agency under USPS regulations. 15 U.S.C. § 7704(a)(5)(A)(iii); 16 C.F.R. § 316.2(p).
  • [ ] 5. Tell recipients how to opt out, and give them a working, one-step mechanism. Provide a functioning return email address or a single web page that lets a recipient unsubscribe, kept operational for at least 30 days after the message is sent, requiring no fee, no login, and no information beyond the recipient's email address and opt-out preferences. 15 U.S.C. § 7704(a)(3), (a)(5)(A)(ii)–(iv); 16 C.F.R. § 316.5.
  • [ ] 6. Honor opt-outs promptly and permanently. Make each opt-out effective within 10 business days, treat it as never expiring, and mail the address again only if the recipient later affirmatively opts back in. 15 U.S.C. § 7704(a)(4)(A)(i).
  • [ ] 7. Never sell, exchange, or transfer an opt-out address. Once a recipient opts out, the address may not be sold, leased, exchanged, or otherwise transferred, except to a party hired to help comply with the Act or as required by law. 15 U.S.C. § 7704(a)(4)(A)(iv).

These seven duties are the substance of CAN-SPAM. The first two are honesty rules that reach every message; the last five are the disclosure-and-exit apparatus that attaches to commercial messages. Take them in turn.

Header honesty: the one rule with no exceptions

Section 7704(a)(1) forbids initiating any message — commercial or transactional — that "contains, or is accompanied by, header information that is materially false or materially misleading." Header information means the source, destination, and routing data: the "From," "To," "Reply-To," and the originating IP and domain information. "Materially" does the work: a header is materially misleading if it fails to identify accurately the computer or the person that initiated the message, or if it was obtained through false or fraudulent registration or pretenses. Using a recognizable brand name or trade name in the "From" line is perfectly fine — "Thistle & Thyme" rather than the legal entity "T&T Provisions, LLC" is not deceptive. What is forbidden is disguising who is really sending: spoofed domains, forged routing, "From" lines that impersonate a bank or a shipping carrier, or accounts opened under false registration to obscure the sender. Because this prohibition has no consent exception and no transactional exception, it is the requirement most likely to be violated inadvertently by a company that thinks a particular message stream is outside the Act.

Subject-line honesty

Section 7704(a)(2) forbids a subject line "likely to mislead a recipient, acting reasonably under the circumstances, about a material fact regarding the contents or subject matter of the message." The paradigm violation is the bait-and-switch: "Your invoice is attached" atop a message with no invoice and a pitch inside; "RE: our conversation" to a stranger you never spoke with; "Your account will be suspended" as a device to force an open on a promotional email. The test is objective and turns on materiality — a subject line that oversells within the bounds of recognizable puffery ("The best coffee you'll ever taste") is not deceptive, but one that misrepresents what the message is crosses the line. Deceptive subject lines also travel in packs: the same email that lies in the subject line often lies to the FTC under § 5, and to competitors under the Lanham Act's false-advertising provision, so the subject-line rule is frequently the thread regulators pull first. See False Advertising Under Lanham Act Section 43(a): Competitor Claims in Tech Marketing for the parallel private-competitor exposure that rides alongside CAN-SPAM.

The advertisement disclosure

For commercial messages, § 7704(a)(5)(A)(i) requires "clear and conspicuous identification that the message is an advertisement or solicitation." The Act does not prescribe magic words — you need not write "ADVERTISEMENT" in a red banner — but the fact that the message is an ad must be obvious to a reasonable recipient. In practice, a message that is manifestly promotional on its face satisfies this without a separate label, but relying on that judgment call is riskier than simply including plain disclosure language in the footer. The one carve-out: if the recipient gave prior affirmative consent to receive the message, the ad-identification requirement drops away. That consent exception is narrow and worth documenting, because the burden of proving it will fall on the sender.

The valid physical postal address

Section 7704(a)(5)(A)(iii) requires every commercial message to include the sender's "valid physical postal address." The FTC's rule, 16 C.F.R. § 316.2(p), defines what qualifies: a current street address, a Postal Service post office box the sender has accurately registered, or a private mailbox the sender has accurately registered with a commercial mail-receiving agency established under USPS regulations. This requirement trips up purely online businesses that have no storefront and no interest in publishing a founder's home address. The solution is a registered P.O. box or a commercial-mail-receiving-agency mailbox — cheap, lawful, and privacy-preserving. A defunct address, a vague "somewhere in Delaware," or no address at all is a per-message violation regardless of how honest the rest of the email is.

The opt-out mechanism, the label, and the sale-of-address ban

Requirements five through seven are the opt-out machinery, and because they are the operational core of the statute they get their own phase below. In brief: the message must contain a working return address or single web-based mechanism (§ 7704(a)(3)); that mechanism must remain functional for at least 30 days after the message is sent (§ 7704(a)(5)(A)(ii)); the sender must give effect to an opt-out within 10 business days and honor it forever (§ 7704(a)(4)); and opt-out addresses may not be sold or transferred except to a compliance vendor or as legally required (§ 7704(a)(4)(A)(iv)). The FTC's 2008 rule amendments hardened two points worth flagging here: a sender may not require a recipient to pay a fee, provide any information beyond an email address and opt-out preferences, or take any step other than sending a reply email or visiting a single web page in order to unsubscribe; and the definition of "sender" was refined so that multi-advertiser messages can designate one responsible sender (more on that in Phase 4). 16 C.F.R. § 316.5.

Worked example. Suppose "Vellum," a hypothetical B2B analytics vendor, sends a prospecting email to a purchasing manager it has never dealt with. To comply, Vellum's email must: use a "From" line and routing that truthfully identify Vellum; carry a subject line that does not misrepresent the contents; be recognizable as a solicitation (or carry a short "This is an advertisement" line); print Vellum's registered P.O. box in the footer; contain an "Unsubscribe" link to a single page that removes the manager with one click and no login; keep that page live for at least a month; and land the manager on a suppression list that Vellum honors within ten business days and forever after. Vellum needed no consent to send that first email — this is the U.S., not the EU — but the moment the manager clicks unsubscribe, the relationship is over unless the manager later opts back in. Note that none of this changes because the recipient is a business rather than a consumer.

Phase 3 — Build, Scrub, and Defend the Suppression List

  • [ ] Maintain one central, company-wide do-not-email suppression list that captures opt-outs from every brand, list, channel, and campaign.
  • [ ] Scrub every outgoing send against that list at the last commercially reasonable moment before transmission.
  • [ ] Confirm that no one — no team, no business unit, no vendor, no affiliate — re-mails or transfers a suppressed address absent a later opt-in.
  • [ ] Wire opt-out requests received through any channel (a reply email, a web form, a customer-service call, a text "STOP") into the same central list.
  • [ ] Retain records showing when each opt-out was received and when mailing to that address stopped, to prove the 10-business-day compliance if challenged.

Dollar for dollar, a clean suppression list is the highest-return compliance measure in the entire program, because the opt-out is where the FTC concentrates its attention and where the statute's bargain actually lives. Everything else — headers, labels, addresses — is about honesty at the front end. The opt-out is the promise that honesty comes with an exit, and the agency treats a broken exit as a broken promise.

Three failures recur in enforcement, and all three are suppression-list failures. The first is the preference maze: a company offers a "manage your preferences" center instead of a one-click unsubscribe, forcing the recipient to log in, re-enter an email address, uncheck a dozen categories, or answer "why are you leaving?" That is unlawful. A preference center is permitted, but only if it also offers a genuine one-step way to stop all of the company's commercial email. The line is between offering choices and obstructing exit. The second failure is list fragmentation: the recipient unsubscribes from the "Product Updates" list, and the company keeps mailing from the "Special Offers" list, the "Newsletter" list, and three co-brands, on the theory that the opt-out applied only to the one list the recipient happened to be reading. Unless the sender clearly offered a menu and the recipient chose to leave only one list, an opt-out is presumed to cover all commercial email from that sender, which is why the suppression list must be central and authoritative, not a per-list flag. The third failure is latency: mailing past the ten-business-day deadline. That deadline is a grace period for the queued pipeline — the batch already loaded, the drip already scheduled — not a license to squeeze in a few more sends. After ten business days, every message to a suppressed address is a fresh violation.

The prohibition on selling or transferring opt-out addresses, § 7704(a)(4)(A)(iv), deserves emphasis because it surprises people. Once a recipient opts out, the address becomes radioactive: it may not be sold, leased, exchanged, or given to another marketer, full stop. The only exceptions are transfer to a party the sender hires to help it comply — for instance, a suppression-list vendor whose entire job is to make sure the address is never mailed — or a transfer required by law. A marketer who monetizes its unsubscribe file by selling it to a list broker has committed a clean violation for each address.

Because the suppression list is fundamentally a personal-data asset, its governance overlaps with the broader privacy program. A company that already maintains a data inventory, retention schedule, and vendor-management process under a privacy framework should fold the suppression list into that structure rather than running it as an orphan spreadsheet. See Standing Up a Privacy Compliance Program: A Practical Checklist and Building a Privacy Compliance Program: Governance, Data Mapping, and the Legal Patchwork for the governance scaffolding, and Data Minimization and Storage Limitation for the tension between keeping suppression records forever (a CAN-SPAM necessity) and deleting personal data promptly (a privacy-law instinct). The reconciliation is that a suppression entry is retained precisely so that the data is not used — a purpose most privacy regimes recognize as legitimate.

Phase 4 — Put Liability on the Right Party

  • [ ] Identify every initiator — anyone who originates, transmits, or procures the transmission of the message — and the sender, the initiator whose product, service, or website the message advertises. 15 U.S.C. § 7702(9), (16).
  • [ ] Recognize that hiring an email service provider does not transfer your duties. The business and the vendor can each be an initiator, each independently liable.
  • [ ] Distinguish procuring transmission (paying, providing consideration to, or inducing another to send — which makes you an initiator) from routine conveyance (merely relaying, routing, or delivering — which does not). 15 U.S.C. § 7702(9), (12).
  • [ ] For affiliate marketing, push your suppression list across the affiliate network, monitor affiliate practices, terminate non-compliant affiliates promptly, and keep records proving good-faith enforcement.
  • [ ] In vendor and affiliate contracts, allocate compliance duties expressly, require honoring your suppression list, demand indemnification, and reserve audit rights — while understanding that no contract transfers the statutory duty itself.
  • [ ] For a message advertising multiple businesses, either treat each advertiser as a sender or validly designate a single sender by meeting all of the FTC's requirements. 16 C.F.R. § 316.2(o).

The hardest question in CAN-SPAM practice is usually not what the rules are but who has to follow them. The Act answers with two overlapping defined terms. An initiator is anyone who "originates or transmits" a message or who "procures the origination or transmission" of it. 15 U.S.C. § 7702(9). A sender is the initiator whose product, service, or website is advertised or promoted in the message. 15 U.S.C. § 7702(16). A single email can have several initiators — the advertiser, its agency, the email service provider — and each initiator has its own independent duties. The header and subject-line prohibitions bind every initiator; the labeling, address, and opt-out duties bind the sender.

The word doing the heavy lifting is procure. Section 7702(12) defines procuring as "intentionally to pay or provide other consideration to, or induce, another person to initiate [a] message on one's behalf." This is the doctrine that defeats the "we hired someone else, so it's their problem" defense. An advertiser who pays a marketing partner to send emails promoting the advertiser's product has procured those messages and is a sender, independently liable, even if it never drafted or saw the specific emails. The FTC drove this home in FTC v. Cyberheat, Inc., No. CV-05-457-TUC (D. Ariz. 2007), refusing to let an advertiser escape liability for its affiliates' spam by pointing to an unenforced no-spam clause in its affiliate agreement. The lesson: a paper prohibition you do not police is worth nothing. The advertiser that recruits affiliates on a pay-per-lead or pay-per-sale basis has procured whatever those affiliates send in its name, and it earns a defense only by actually monitoring and enforcing — pushing its suppression list to the network, auditing affiliate practices, and cutting off bad actors fast enough to show good faith. Compare United States v. ValueClick, Inc., No. CV-08-01711 (C.D. Cal. 2008), where an online marketer's deceptive practices drew a substantial civil penalty and permanent injunctive terms, underscoring that the FTC pursues the entity that controls and profits from the campaign.

The counterweight to procurement is the routine conveyance exception. A party "involved solely in routine conveyance" — the ISP, the mail relay, the pure infrastructure that transmits a message without any role in choosing recipients or content — is not an initiator. 15 U.S.C. § 7702(9), (12). This is what separates the pipe from the advertiser. It also governs the perennial "forward-to-a-friend" question. If a company offers a neutral "email this to a friend" button and does nothing more, it is engaged in routine conveyance and does not become the initiator of the forwarded message; the forwarding recipient is. But if the company offers consideration — money, a coupon, a sweepstakes entry, loyalty points — to induce the forward, it has procured that transmission and becomes responsible for it, label, address, opt-out and all. The incentive is the whole ballgame.

For messages that promote more than one business, the default rule is that each advertised business is a sender, with all the duties that entails. The FTC's rule offers an escape valve: the businesses may designate a single sender if they satisfy every element of 16 C.F.R. § 316.2(o) — the designated business must meet the statutory definition of "sender," must be identified in the "From" line, and must itself comply with the initiator provisions (honest headers, opt-out, and so on). The single-sender designation is a convenience for co-marketing arrangements, not a liability shield. If the designated sender botches the opt-out or forges a header, the designation does not insulate the other advertisers from their own exposure, and it certainly does not stop the FTC from asking who paid for the campaign.

The through-line of Phase 4 is a single sentence: you cannot contract away a statutory duty. Indemnification clauses, no-spam warranties, and audit rights are worth having — they allocate the economic risk and give you a claim against a vendor who burns you — but they do not move the legal duty off your shoulders. If your name is on the pitch and your money funded the send, you are a sender, and the FTC can name you regardless of what your master services agreement says.

Phase 5 — Aggravated Violations and Criminal Exposure

  • [ ] Confirm your list acquisition uses no harvested addresses — no automated scraping of email addresses posted on websites, social networks, forums, or chat rooms. 15 U.S.C. § 7704(b)(1).
  • [ ] Confirm you use no dictionary attacks — no automated generation of possible addresses by combining names, letters, or numbers. 15 U.S.C. § 7704(b)(1).
  • [ ] Use no automated creation of multiple email accounts to send commercial messages. 15 U.S.C. § 7704(b)(2).
  • [ ] Use no unauthorized relay or retransmission (spoofing through others' computers accessed without authorization) to disguise origin. 15 U.S.C. § 7704(b)(3).
  • [ ] Understand that the four practices above can triple statutory damages and that fraud-based spamming is a federal crime under 18 U.S.C. § 1037.

CAN-SPAM's aggravated-violation provision, § 7704(b), singles out four practices that so reliably accompany the worst spam operations that Congress attached enhanced penalties to them. Address harvesting is the automated capture of email addresses that people have posted publicly — on websites, social media, blogs, message boards, newsgroups, and chat rooms — for the purpose of sending them commercial email. Dictionary attacks are the automated generation of candidate addresses by mechanically combining names, letters, and numbers in the hope of hitting live inboxes. Automated creation of multiple accounts is the mass generation of email accounts to launder the origin of a campaign. Unauthorized relay or retransmission — spoofing — is bouncing messages through other people's computers accessed without permission to hide where the mail really comes from. When any of these accompanies an otherwise-unlawful commercial email, the statutory damages available to certain plaintiffs can be trebled. § 7704(b).

Harvesting and dictionary attacks are worth a special note because they sit at the intersection of CAN-SPAM and computer-intrusion law. The same automated collection that makes a list "harvested" under § 7704(b) may also implicate the Computer Fraud and Abuse Act and the contract terms of the sites being scraped — a body of law that has shifted considerably after hiQ Labs, Inc. v. LinkedIn Corp. and Van Buren v. United States. A marketer tempted to build a list by scraping should read the scraping exposure alongside the CAN-SPAM exposure; see Web Scraping and the Law After hiQ v. LinkedIn: Where the CFAA, Contract, and Copyright Collide. The compliance answer is simple: build lists from opt-in signups, purchased-with-provenance data, and genuine business relationships — never from a scraper.

The criminal statute, 18 U.S.C. § 1037, adds real teeth for the fraud end of the spectrum. It criminalizes, among other things, accessing a protected computer without authorization to send commercial email, using false header information with intent to deceive, falsifying registration information for accounts or domains used to send bulk commercial email, and relaying spam through others' machines to disguise origin. Penalties escalate with the volume and the underlying conduct and can include imprisonment. This is the province of true bad actors — botnet operators, phishing rings, criminal spam gangs — and a legitimate marketer running an honest program is nowhere near it. But the statute's existence is a reminder that CAN-SPAM is not only an FTC civil-penalty regime; its worst-case tail is a federal prison sentence.

Phase 6 — Special Content: Adult Material and Wireless Devices

  • [ ] For commercial email containing sexually oriented material, keep all sexually oriented material out of the subject line and place the phrase "SEXUALLY-EXPLICIT:" in capital letters as the first 19 characters of the subject line. 16 C.F.R. § 316.4(a).
  • [ ] Structure the message so that no sexually oriented material is visible in the initially viewable area — the electronic "brown paper wrapper" — absent the recipient's affirmative action to view it. 16 C.F.R. § 316.4(a).
  • [ ] Confirm the adult-labeling rules do not apply where the recipient gave prior affirmative consent to receive the specific messages. 15 U.S.C. § 7704(d).
  • [ ] For commercial messages sent to wireless-device email addresses, follow the FCC's rules requiring the recipient's express prior authorization; do not confuse this with texting a phone number (that is the TCPA — see Phase 7).

The Adult Labeling Rule, 16 C.F.R. § 316.4, layers extra duties on the narrow category of commercial email containing "sexually oriented material." Two mechanisms do the work. First, the subject line must be sanitized — no sexually oriented material in it — and must begin with the mandatory marker "SEXUALLY-EXPLICIT:" in capital letters as its first nineteen characters, a warning label the recipient sees before opening. Second, the initially viewable content of the message may not contain sexually oriented material; the explicit content must sit behind an affirmative click, the electronic equivalent of a brown paper wrapper. These duties fall away if the recipient gave prior affirmative consent to receive the sender's sexually oriented messages, 15 U.S.C. § 7704(d), and the definition of "sexually oriented material" tracks the obscenity-adjacent statutory language, exempting material where the sexual content is not a significant part of the whole. Most marketers will never touch this rule; those who do should treat the nineteen-character marker as exact and non-negotiable.

The wireless-device wrinkle is a frequent source of confusion. CAN-SPAM directed the Federal Communications Commission to protect subscribers from unwanted "mobile service commercial messages" — commercial email sent to an address that references an internet domain associated with a wireless device (the carrier-provided email-to-handset addresses). The FCC's rules require express prior authorization before such messages may be sent and maintain a list of wireless domains that senders must scrub against. This is genuinely different from sending a text message to a telephone number, which is governed by the Telephone Consumer Protection Act and lives in Phase 7. The distinction — commercial email to a wireless email address (FCC/CAN-SPAM) versus an SMS to a phone number (TCPA) — is the one to burn into memory, because the two regimes have opposite default rules and wildly different damages.

Phase 7 — Stack the Other Regimes on Top of the Floor

  • [ ] For text messages to mobile numbers, apply the TCPA, 47 U.S.C. § 227: prior express consent for informational autodialed texts, and prior express written consent for marketing texts, honoring opt-outs and the FCC's rules at 47 C.F.R. § 64.1200.
  • [ ] For recipients in the European Union / EEA, obtain GDPR/ePrivacy opt-in consent (or another lawful basis) before sending marketing email, and honor data-subject rights.
  • [ ] For recipients in Canada, comply with CASL, which requires express or implied consent and prescribed identification and unsubscribe content.
  • [ ] For recipients in California and other states with surviving anti-fraud email statutes, avoid falsity in headers and subject lines; the CAN-SPAM preemption clause preserves those laws. 15 U.S.C. § 7707(b)(1).
  • [ ] Architect the program to tag each contact's jurisdiction, capture granular time-stamped consent where required, apply the strictest applicable rule per recipient, and route every channel through one global suppression list that no campaign can override.

CAN-SPAM governs commercial email. It does not govern calls, texts, or the rest of the world, and a program that treats it as the whole of the law is exposed on three flanks.

The TCPA governs texts, and its philosophy is the opposite of CAN-SPAM's

The Telephone Consumer Protection Act, 47 U.S.C. § 227, regulates calls and text messages to telephone numbers, and its default is consent-first with real enforcement muscle. Autodialed or prerecorded calls and texts require the recipient's prior express consent; marketing calls and texts require prior express written consent. Unlike CAN-SPAM, the TCPA carries a private right of action and statutory damages of $500 per violation, trebled to $1,500 for willful or knowing violations — per message, with no cap — which is why TCPA class actions are a cottage industry and CAN-SPAM class actions do not exist. The Supreme Court narrowed the definition of "automatic telephone dialing system" in Facebook, Inc. v. Duguid, 141 S. Ct. 1163 (2021), holding that an autodialer must use a random or sequential number generator, which trimmed some exposure for equipment that dials from stored lists — but the marketing-consent and opt-out rules remain formidable, and the FCC continues to tighten them. The operational takeaway: never text your email list. An email address and a phone number are different channels under different statutes with different consent rules, and a "STOP" reply must flow into the same central suppression logic as an email unsubscribe. For the broader multi-channel and platform picture, see Social Media Law: A Field Guide to the Legal Stack.

GDPR, ePrivacy, and CASL govern the recipients CAN-SPAM never reached

The United States is now the most permissive major jurisdiction for commercial email, and jurisdiction follows the recipient, not the sender. A U.S. company with contacts in the EU faces the General Data Protection Regulation (Regulation (EU) 2016/679) and the ePrivacy Directive (2002/58/EC), which generally require opt-in consent before marketing email — the mirror image of the U.S. rule — plus a lawful basis for processing, transparency, and honoring data-subject rights. A U.S. company with contacts in Canada faces Canada's Anti-Spam Legislation (CASL, S.C. 2010, c. 23), which requires express or implied consent, prescribed sender identification, and a working unsubscribe, backed by administrative monetary penalties that reach into the millions. Because these regimes attach to where the recipient sits, a U.S. sender that treats its entire list as governed by CAN-SPAM alone will violate EU and Canadian law the moment it emails a Berlin or Toronto address without consent.

Cross-border email also implicates data-transfer law: moving EU personal data (including an email list) to U.S. servers requires a lawful transfer mechanism after Schrems II. See Moving Personal Data Out of the EU After Schrems II: SCCs and Transfer Impact Assessments and, for the overall architecture, The Privacy and Data Protection Toolkit: Building and Operating a Compliance Program. Mobile-first senders should also map app-side collection duties; Mobile App Privacy Law: A Compliance Map for Founders and Counsel covers the consent and disclosure obligations that feed a lawful email list.

The practical architecture is the same one privacy engineers already build: tag each contact with a jurisdiction, capture and time-stamp consent where a jurisdiction requires it, apply the strictest applicable rule to each recipient, and geo-segment sends so that no EU or Canadian address ever receives a message the U.S. rules would allow but the local rules would not. One global suppression list sits underneath all of it, and no campaign — however urgent — is permitted to override it.

Preemption and surviving state law

Section 7707(b)(1) preempts state statutes that "expressly regulate the use of electronic mail to send commercial messages" — except to the extent a state law "prohibits falsity or deception" in commercial email. The exception is where the action is. States may not run parallel opt-out or labeling regimes, but they may — and do — punish falsity. California's statute, Cal. Bus. & Prof. Code § 17529.5, forbids commercial email with falsified, misrepresented, or forged header information or misleading subject lines, and California courts have read CAN-SPAM not to preempt it, on the theory that a falsity-based state claim fits squarely within the § 7707(b)(1) carve-out. See Hypertouch, Inc. v. ValueClick, Inc., 192 Cal. App. 4th 805 (2011). The Supreme Court of California separately clarified the outer edge of what counts as "deception" for the exception in Kleffman v. Vonage Holdings Corp., 49 Cal. 4th 334 (2010), holding that merely sending advertisements from multiple, randomly generated domain names — without more — is not, by itself, deceptive within the meaning of the statute. The upshot for a compliance program: honest headers and honest subject lines are not just federal requirements; they are also the moat against non-preempted state-law claims that carry their own remedies.

Phase 8 — Test, Document, Train, and Monitor

  • [ ] Before every campaign, render-test across major email clients and devices to confirm the opt-out link works, the advertisement disclosure and postal address display, and the message is not silently broken.
  • [ ] Verify the suppression scrub actually ran on the final send list — not the staging list, the final one.
  • [ ] Document how and when each address was obtained. CAN-SPAM does not require opt-in, but provenance records are invaluable for GDPR/CASL, for defending state falsity claims, and for list hygiene.
  • [ ] Train everyone who touches the email program — marketing, product, engineering, customer success — on classification and the opt-out rules, since a single rogue transactional-template edit can create a commercial-message violation.
  • [ ] Track the FTC's annual penalty adjustment and any amendments to 16 C.F.R. Part 316.
  • [ ] Consider best practices above the floor: double opt-in, list-hygiene and bounce management, sender-authentication (SPF, DKIM, DMARC), and sender-reputation monitoring. Deliverability and legal compliance push in the same direction.

Compliance is not a document; it is a repeatable operation, and the operation fails at the seams — the untested template, the staging list that shipped instead of the scrubbed one, the well-meaning engineer who "improved" the unsubscribe flow by adding a confirmation login. Phase 8 is the discipline that catches those failures before the FTC does. Render-testing matters because an opt-out link that works in the developer's browser can be dead in a corporate Outlook client, and a broken unsubscribe is a violation no matter how good the intent. Documentation matters because the burden of proving consent (where consent is the defense) and provenance (where a state or foreign regulator asks) falls on the sender, and reconstructing it after the fact is miserable. Training matters because CAN-SPAM violations are usually committed by people who have never heard of CAN-SPAM — the product manager who wants to "add a little promo" to the receipt email, the growth marketer who bought a list of dubious origin.

The above-the-floor practices deserve their own word. CAN-SPAM does not require opt-in, but double opt-in dramatically improves both list quality and legal posture, and it happens to be what EU and Canadian recipients require anyway, so a global program often adopts it uniformly. Sender authentication — SPF, DKIM, and DMARC — is not a CAN-SPAM requirement, but the major mailbox providers now effectively demand it for bulk senders, and the same authentication that gets your mail delivered also makes it harder for anyone to spoof your domain (a § 7704(a)(1) problem if it happens in your name). The legal incentives and the deliverability incentives point the same way, which is a rare and welcome alignment.

Enforcement, Penalties, and the Absence of a Private Right of Action

Who can sue, and for how much, is what turns this checklist from good hygiene into risk management.

No private right of action for recipients. An individual who receives a non-compliant email cannot sue the sender under CAN-SPAM. The Act deliberately withholds a consumer private right of action, and courts have enforced that choice; the leading decision, Gordon v. Virtumundo, Inc., 575 F.3d 1040 (9th Cir. 2009), also read narrowly the one private-enforcement channel Congress did create — suits by an "internet access service" adversely affected by violations — holding that a plaintiff must be a bona fide provider of internet access, not someone who set up a nominal service to manufacture standing. That is why there are no CAN-SPAM class actions of the kind that flood TCPA dockets.

Who can enforce. The Federal Trade Commission is the lead enforcer, treating a CAN-SPAM violation as an unfair or deceptive act or practice under the FTC Act and seeking civil penalties as though the violation broke a trade-regulation rule. 15 U.S.C. § 7706(a). A roster of other federal agencies enforces against the entities they regulate — banking regulators, the FCC for common carriers, the Department of Transportation for airlines, and others — under § 7706(b). State attorneys general may sue on behalf of their residents, § 7706(f), and internet access services adversely affected by violations may bring the private suits Gordon cabined, § 7706(g). Layer on top of that the non-preempted state falsity statutes (Phase 7), the FTC Act § 5 exposure for what the email says, and Lanham Act false-advertising claims by competitors, and a single deceptive campaign can draw fire from several directions at once. For the small-business-facing overview of that broader advertising-law perimeter, see Advertising Law for Small Businesses: A Practical FAQ.

The penalty math. Each separately addressed message that violates the Act is a separate violation carrying its own civil penalty, and the maximum per-message penalty is adjusted for inflation every year under 16 C.F.R. § 1.98. The figure has climbed past $50,000 per email in recent adjustments — the Practical Law source underlying older guidance still shows a $43,792 figure, while more recent adjustments have exceeded $51,000 — which is exactly why you should never quote a stale number. Confirm the current maximum in the FTC's most recent civil-penalty adjustment notice before you rely on it. The point that survives every adjustment is the multiplier: because liability accrues per message, a single non-compliant campaign to a large list carries theoretical exposure in the tens or hundreds of millions of dollars. Regulators rarely seek the arithmetic maximum, but the number is the leverage, and it is why the opt-out machinery in Phase 3 — the thing most likely to fail at scale — is the thing most worth getting right.

Common Mistakes

  • Believing the name. Assuming CAN-SPAM bans spam, requires opt-in, or creates a do-not-email registry. It does none of those things.
  • Treating compliance as a safe harbor. Assuming a CAN-SPAM-compliant email is immune from FTC Act § 5, the Lanham Act, or state fraud law. It is a floor, not a ceiling.
  • Riding a pitch on a receipt. Bolting a promotion onto a transactional shell and signaling it in the subject line, flipping a transactional message into a regulated commercial one under the primary-purpose test.
  • Thinking B2B is exempt. It is not; the recipient's corporate status is irrelevant.
  • Assuming a vendor or affiliate contract transfers the duty. It transfers economic risk, not the statutory obligation; both initiators remain independently liable, and an unenforced no-spam clause is worthless.
  • Running a preference maze. Requiring a login, extra information, or a category-by-category slog instead of offering a genuine one-step unsubscribe from all commercial email.
  • Fragmenting the opt-out. Treating an unsubscribe as applying to one list while continuing to mail from others, or letting it "expire," or honoring it slowly past the ten-business-day window.
  • Monetizing the unsubscribe file. Selling or transferring opt-out addresses, which has no exception beyond a compliance vendor or a legal requirement.
  • Confusing channels. Texting the email list without TCPA consent, or emailing EU and Canadian recipients without GDPR or CASL consent.
  • Sourcing lists badly. Harvesting or dictionary-attacking addresses, which is an aggravated violation and may also breach the CFAA and site terms.

Primary Authority

Statute. CAN-SPAM Act, 15 U.S.C. §§ 7701–7713 — especially § 7701 (findings and policy); § 7702 (definitions, including "commercial," "transactional or relationship," "initiator," "sender," "procure," and "routine conveyance"); § 7704 (prohibitions and the substantive requirements, with aggravated violations at subsection (b)); § 7705 (businesses that knowingly promote or permit promotion); § 7706 (enforcement by the FTC, other agencies, state attorneys general, and internet access services); and § 7707 (preemption, with the falsity/deception carve-out at (b)(1)).

Rule. FTC CAN-SPAM Rule, 16 C.F.R. Part 316 — § 316.2 (definitions, including the physical-postal-address and single-sender-designation provisions); § 316.3 (the primary-purpose test); § 316.4 (the Adult Labeling Rule and the mandatory "SEXUALLY-EXPLICIT:" marker); § 316.5 (opt-out mechanics and the ban on fees or extra information). Civil-penalty inflation adjustment under 16 C.F.R. § 1.98.

Criminal. 18 U.S.C. § 1037 (fraud and related activity in connection with electronic mail).

Cases. Gordon v. Virtumundo, Inc., 575 F.3d 1040 (9th Cir. 2009) (no consumer private right of action; narrow reading of "internet access service" standing); FTC v. Cyberheat, Inc., No. CV-05-457-TUC (D. Ariz. 2007) (advertiser liability for affiliates' spam despite an unenforced no-spam clause); United States v. ValueClick, Inc., No. CV-08-01711 (C.D. Cal. 2008) (FTC civil penalty and injunctive relief against a deceptive email marketer); Kleffman v. Vonage Holdings Corp., 49 Cal. 4th 334 (2010) (multiple randomly generated sender domains not, standing alone, deceptive under state law); Hypertouch, Inc. v. ValueClick, Inc., 192 Cal. App. 4th 805 (2011) (CAN-SPAM does not preempt California's falsity-based anti-spam statute).

Related regimes. Telephone Consumer Protection Act, 47 U.S.C. § 227, and the FCC rules at 47 C.F.R. § 64.1200 (Facebook, Inc. v. Duguid, 141 S. Ct. 1163 (2021)); FTC Act § 5, 15 U.S.C. § 45; GDPR, Regulation (EU) 2016/679, and the ePrivacy Directive, 2002/58/EC; Canada's Anti-Spam Legislation, S.C. 2010, c. 23; California Bus. & Prof. Code § 17529.5. Secondary: FTC, CAN-SPAM Act: A Compliance Guide for Business. Verify the current per-email civil penalty and any Part 316 amendments in the FTC's latest notices before relying on a specific figure.

Related UpLaw Resources

Related Guides

Related Checklists

Related Toolkits

Related Articles

This checklist is general information, not legal advice. The CAN-SPAM Act, its implementing regulations, and the inflation-adjusted civil penalty change over time, and application always depends on the specific facts. Confirm the current per-email penalty and any rule amendments in the FTC's latest notices, and consult qualified counsel before acting on any matter discussed here.