Email marketing in the US: what the CAN-SPAM Act requires, and how it differs from the rules at home

European marketers usually arrive in the US expecting a free-for-all, because they have heard that American law does not require consent before a marketing email. That part is true. What surprises them is how precise the rest of the law is: every commercial email needs an honest sender and subject line, a postal address, a working unsubscribe that is honored within ten business days, and liability reaches the company being promoted as well as the agency pressing send. The federal law is the CAN-SPAM Act of 2003, enforced by the Federal Trade Commission.

Opt-out instead of opt-in: the big difference

In much of Europe the default is permission. The UK's Information Commissioner's Office, to take one example, tells businesses they must not send marketing emails or texts to individuals without specific consent, with a narrow soft opt-in for existing customers who were given a clear chance to refuse. Business addresses of companies are treated more freely, but sole traders count as individuals.

The US works the other way around. CAN-SPAM does not require consent before you send a commercial email to anyone, consumer or business. Instead it regulates how you send and gives every recipient a right to say stop, which you must respect.

Two consequences follow. First, we treat every European address on a list under the rules of the recipient's home country, and we advise clients to do the same; selling through a US entity does not change where the recipient lives. Second, the American model rewards discipline rather than paperwork: you can start a campaign quickly, but one broken unsubscribe link can turn every email you send into a separate violation.

Which emails the law covers

CAN-SPAM regulates the commercial electronic mail message: an email whose primary purpose is the commercial advertisement or promotion of a product or service, including content on a commercial website. It separately defines a transactional or relationship message, which is largely exempt. The statute lists five kinds:

1. completing or confirming a transaction the recipient already agreed to;
2. warranty, recall, safety or security information about a product or service the recipient bought or uses;
3. notice of changes to an ongoing subscription, membership, account or loan, or a regular account statement;
4. information directly related to the recipient's employment or an employee benefit plan;
5. delivery of goods or services, including updates or upgrades, the recipient is entitled to under an existing agreement.

Many real emails mix the two. The FTC's rule in 16 CFR 316.3 settles it by primary purpose. An email that combines commercial and transactional content counts as commercial if a reasonable recipient reading the subject line would think it is an advertisement, or if the transactional part does not appear at or near the beginning of the message. An email that mixes advertising with other content, such as a newsletter article, is commercial if the subject line reads like an ad or if a reasonable recipient would conclude from the body that its main purpose is promotion, judged by where the promotion sits, how much space it takes and how prominently it is styled.

Our practical rule: an order confirmation with a small cross-sell banner at the bottom stays transactional. A "Your order has shipped, plus 30 percent off everything" subject line does not.

Even transactional emails must not have false or misleading header information. That rule applies to both categories.

Seven rules for every marketing email

The statute, 15 U.S.C. 7704, and the FTC's compliance guide boil down to seven requirements.

1. Honest header information. The From, To and Reply-To lines and the routing information must be accurate and identify who sent the message. A From line that accurately identifies the sender is not misleading; routing mail through other computers to hide its origin is.
2. An honest subject line. You may not use a subject heading that you know, or should reasonably know, would mislead an ordinary recipient about a material fact in the message.
3. Identification as an advertisement. The message must clearly and conspicuously say it is an advertisement or solicitation, unless the recipient gave prior affirmative consent to receive it. The law does not prescribe the words, but they must be clear.
4. A valid physical postal address. Your current street address, a post office box registered with the Postal Service, or a private mailbox registered with a commercial mail receiving agency.
5. A clear notice of the right to opt out. Explained in a way an ordinary person will see and understand.
6. A working opt-out mechanism. A return email address or web-based mechanism that works for at least 30 days after you send the message.
7. Responsibility for your vendors. If an agency or platform sends on your behalf, both of you can be held legally responsible.

A US business address matters here. A European company that uses its Munich or Madrid address is compliant, but American recipients trust a US address more, and many email platforms ask for one. Our guide to a US business address covers the options.

Unsubscribes: the rule that causes most trouble

Most enforcement problems we see start with a broken or slow unsubscribe process, usually because a list was copied between tools. The rules are strict and simple:

• Ten business days. Once someone opts out, you may not send them commercial email more than ten business days after the request. Neither may anyone acting on your behalf.
• Thirty days of availability. The mechanism in each email must keep accepting requests for at least 30 days after the message was sent.
• No hurdles. Under 16 CFR 316.5 you may not charge a fee, ask for any information other than the email address and opt-out preferences, or require any step other than sending a reply email or visiting a single web page.
• A menu is allowed. You may let people choose which kinds of messages to stop, as long as one option is to stop all commercial messages from you.
• No selling the address. After an opt-out you may not sell, lease, exchange or otherwise transfer the address, except to comply with the law.
• Consent can restart the relationship. If the person later gives affirmative consent, you may email them again.

Keep one suppression list that every tool and every agency uses. When you migrate platforms, export it first and import it before the first send. It sounds obvious; it is the step people skip.

Who enforces the law, and what violations cost

CAN-SPAM treats a violation as an unfair or deceptive act under the FTC Act. The FTC states that each separate email in violation is subject to penalties of up to $53,088, the inflation-adjusted figure currently in the FTC's civil penalty table at 16 CFR 1.98. A campaign of 10,000 non-compliant emails is, in theory, 10,000 violations.

The statute gives these rights to government enforcers and to internet access providers; it does not list individual recipients among those who can sue under it. Courts can reduce damages for senders who had commercially reasonable compliance practices, which is one more reason to document yours.

Certain practices are aggravated violations that raise the stakes: harvesting addresses from websites that prohibit it, generating addresses by combining names, letters or numbers, using scripts to register multiple accounts for sending, and relaying messages through computers accessed without authorization. Sexually oriented material needs a prescribed label in the subject line unless the recipient consented, and knowing violations of that rule are a crime.

States, mobile email and text messages

State law. CAN-SPAM supersedes state statutes that expressly regulate commercial email, except to the extent they prohibit falsity or deception. General state laws on contracts, torts, fraud and computer crime still apply. In practice this means one national standard for compliant senders, and state remedies for deceptive ones.

Email to mobile phones. The Federal Communications Commission adopted a separate rule under CAN-SPAM for commercial messages sent to wireless devices. Under 47 CFR 64.3100 you may not send a mobile service commercial message without the subscriber's express prior authorization. The FCC keeps a list of wireless domain names, the addresses that deliver directly to phones; a commercial message to an address on a domain that has been on the list for at least 30 days is presumed to be such a message. The authorization request must identify the sender, warn that the carrier may charge for messages and say that consent can be revoked at any time, and opt-outs must be honored within 10 days.

Text messages. SMS marketing to phone numbers runs under the FCC's telephone marketing rules in 47 CFR 64.1200, which expressly address telemarketing calls and text messages to wireless numbers, including the revocation of consent. Their consent requirements, such as prior express written consent for certain advertising calls to mobile numbers, are a different regime from CAN-SPAM. Treat text marketing as a separate project with its own consent process.

If your US market entry includes a broader compliance review, our overview of US legal requirements and red tape puts email marketing in context with the other rules a new market entrant meets.

The inbox providers set the practical bar

Legal compliance gets you out of trouble with the FTC. It does not get you into the inbox. The large mailbox providers now publish their own requirements, and for a high-volume sender they are stricter than the statute.

Google's sender guidelines for Gmail ask every sender to authenticate its domain with SPF or DKIM and to keep the spam rate reported in Google's Postmaster Tools below 0.3 percent. Senders of more than 5,000 messages a day to Gmail accounts must set up SPF and DKIM, publish a DMARC policy, and support one-click unsubscribe for marketing and subscribed messages through the List-Unsubscribe and List-Unsubscribe-Post headers; Google advises keeping the spam rate below 0.10 percent and never reaching 0.30 percent.

Our recommendation to every client starting email in the US: set up all three authentication records and one-click unsubscribe from the first send, whatever your volume. It costs an afternoon with your email platform and avoids the far harder job of repairing a domain's reputation later. If you sell online, the same discipline belongs in your US e-commerce setup alongside sales tax and payments.

A checklist before your first US campaign

Run through it once with your marketing team and once with whoever runs the email platform. In our experience the problems are almost never in the copy; they are in the plumbing. And if the US entity behind the campaign is still being set up, our guide to entering the US market lists what comes first.