CAN-SPAM Act & Email Spam Laws

The 8 Requirements of the CAN-SPAM Act

Every commercial email must comply with all eight of the following requirements:

1. No false or misleading header information. The "From," "To," "Reply-To," and routing information must accurately identify the sender. Using someone else's domain or spoofed headers is illegal.
2. No deceptive subject lines. The subject line must accurately reflect the content of the message. "Re: Your account" used to initiate unsolicited contact is deceptive.
3. Identify the message as an advertisement. If the message is advertising a commercial product or service, it must be clearly identified as an advertisement — unless the recipient has given prior affirmative consent.
4. Include a valid physical postal address. Every commercial email must include the sender's current street address, P.O. Box, or private mailbox registered with a commercial mail-receiving agency.
5. Honor opt-out requests promptly. Every commercial email must contain a clear and conspicuous explanation of how the recipient can opt out of future messages. You must process opt-out requests within 10 business days and must never charge a fee, require more than a single step, or ask for personal information to unsubscribe.
6. Opt-out mechanism must work for at least 30 days. The unsubscribe link or mechanism must remain functional for at least 30 days after the email is sent.
7. Never sell or transfer opted-out email addresses. After someone opts out, their address may not be sold, leased, or transferred to any other entity — even for purposes the original sender considers non-commercial.
8. Monitor third-party email marketing. If you hire a third party to handle your email marketing, both you and the third party can be held legally responsible for CAN-SPAM compliance.

Source: FTC – CAN-SPAM Act: A Compliance Guide for Business

Penalties for CAN-SPAM Violations

Each separate email that violates the CAN-SPAM Act is subject to civil penalties:

• $53,088 per email (2026 FTC-adjusted amount, increased annually for inflation under 15 U.S.C. § 45(m)).
• Multiple parties — the company sending the email AND any officers, directors, or employees who approved the campaign — can each be held separately liable.
• Criminal penalties apply for aggravated violations: using false header information, harvesting addresses from websites, using dictionary attacks, relaying messages through computers without authorization, or sending sexual content without required warning labels. Criminal penalties include imprisonment up to 5 years.
• The FTC, DOJ, state attorneys general, and internet service providers can all bring enforcement actions.

State Anti-Spam Laws — Overview

The CAN-SPAM Act expressly preempts most state spam laws — states cannot enact laws that specifically regulate commercial email content or transmission. However, states can still enforce:

• Laws against deceptive computer practices (most states have computer fraud laws that cover email spoofing).
• TCPA-analogous laws for text messages — state texting spam laws are not fully preempted by CAN-SPAM, which only covers email.
• State consumer protection acts — used to challenge deceptive email campaigns independent of CAN-SPAM.

Notable recent state activity:

• California: California Business and Professions Code § 17529 provides a private right of action for receiving spam — consumers can sue for $1,000 per email if the spam originated from California or was sent to a California resident. This law is not preempted because it targets deception, not spam content generally.
• New Jersey: Effective December 1, 2024, New Jersey expanded consent requirements for text message marketing under its TCPA-parallel state law. See 2026 Guide to State Regulations.
• Washington, Virginia, Connecticut, Colorado: State comprehensive privacy laws (similar to GDPR) include provisions affecting email marketing consent and opt-out obligations beyond CAN-SPAM minimums.

CAN-SPAM vs. GDPR vs. CASL

U.S. businesses sending email to EU residents must comply with GDPR. U.S. businesses emailing Canadian residents must comply with CASL. CAN-SPAM governs email to U.S. residents.

How to Report Spam

• FTC ReportFraud.ftc.gov — Forward spam emails to spam@uce.gov or file an online report. The FTC uses these reports to track and investigate violators.
• Spamhaus Submit Spam — Report spam to the Spamhaus Project, which maintains the world's most widely used spam blocklists.
• Your email provider: Gmail, Outlook, Yahoo, and Apple Mail all have built-in "Report Spam" buttons that feed into their automated filtering systems and may escalate egregious cases to authorities.
• Internet Service Providers: Most major ISPs have abuse reporting addresses (e.g., abuse@comcast.net). Find the ISP responsible for an IP using ARIN WHOIS.