The CAN-SPAM Act

What it is

CAN-SPAM is the US federal law for commercial email. It's been around since 2003, and it applies to any business that sends marketing email, with no size exemption. A one-person shop sending a monthly newsletter is covered the same way a national retailer is. Email to other businesses is covered too.

I'm not a lawyer and this isn't legal advice. But the rules are short, and the Federal Trade Commission explains them in plain English in its CAN-SPAM compliance guide for business.

Which emails count

The law covers email whose main purpose is to advertise or promote something: newsletters, announcements, sale notices, "here's what's new" emails.

It doesn't cover transactional email, the messages that complete something the customer already started: receipts, order confirmations, appointment reminders, password resets.

What the rules require

• Honest "From" and "Reply-To" lines that say who's actually sending.
• A subject line that matches the email. No bait.
• A clear signal that it's an ad, if it is one.
• Your physical mailing address, in every marketing email. A street address, a PO box registered with the Postal Service, or a registered private mailbox all count.
• A working unsubscribe link, easy to find, that keeps working for at least 30 days after you send.
• Unsubscribes honored within 10 business days, and after that, no more marketing email to that address.

Common misconceptions

• "They gave me their business card, so it's fine." How you got the address doesn't matter. If the email is marketing, the rules apply.
• "My list is too small to matter." There's no size threshold.
• "I need permission before I email anyone." Not under CAN-SPAM. US law is opt-out: you can email until someone asks you to stop. Some other countries are stricter, and texting has much stricter rules.

What it costs to get wrong

The FTC can fine up to $53,088 per email that breaks the rules, and that number goes up with inflation every year. That's the ceiling, not a typical fine, but "per email" adds up quickly on a list of a few hundred people.

What to do this week

Most small businesses only get two of these wrong: the mailing address and the unsubscribe link. If you send through Mailchimp or Constant Contact, both are already in the footer, so the whole job is checking that the address in there is current. If you send newsletters from your regular inbox, you have neither, and that's the thing to fix this week. The FTC's own guide is short and worth ten minutes.