Do Emails Have to Have an Unsubscribe Link?

Yes. Under the federal CAN-SPAM Act, emails must have an unsubscribe link whenever the message’s primary purpose is advertising or promoting a product, service, or website. Order confirmations, shipping updates, political messages, and most nonprofit emails are exempt. Everything commercial needs a working opt-out, a valid physical postal address, and honest header information, or the sender risks civil penalties of up to $53,088 per message.¹

Which Emails Count as Commercial

Federal law defines a commercial email as any message whose primary purpose is advertising or promoting a commercial product, service, or the content of a business website.² Promotional blasts and product announcements are the obvious cases. Less obvious: an email that links to a blog post on a for-profit site can qualify as commercial if the post is essentially there to promote the business.

Business-to-business email is not exempt. A message to a corporate procurement team announcing a new product line is treated the same as a coupon email to a consumer. If the primary purpose is commercial, the unsubscribe rules apply regardless of who receives it.¹

Mentioning a company name or linking to a business site in passing does not automatically make a message commercial. The statute looks at primary purpose, not incidental references.²

Emails That Don’t Need One

Transactional and Relationship Messages

Emails that carry out a transaction the recipient already agreed to, or that update them on an existing business relationship, are exempt from the unsubscribe rule.¹ Order confirmations, shipping updates, account statements, password resets, product recall notices, and security alerts all fall into this category. One rule still applies: the “From” line, domain, and other routing information cannot be false or misleading.

Nonprofit and Political Emails

CAN-SPAM only reaches commercial email. Political campaign messages are protected speech and fall outside the Act entirely. Nonprofit messages about advocacy, fundraising, or membership are generally exempt too, so long as the primary purpose isn’t promoting a commercial product or service.³ A nonprofit that emails supporters about buying its merchandise, however, can trigger the commercial rules for those specific messages.

Mixed-Purpose Emails

Plenty of emails blend transactional content with marketing. A shipping notice that also pitches accessories is a common example. The FTC uses two tests to decide whether a mixed message counts as commercial:⁴

Subject line test: if a reasonable person reading only the subject line would think the email is an ad, it’s treated as commercial.
Body placement test: if the transactional content doesn’t appear at or near the top of the message and marketing content leads instead, the email is treated as commercial.

Fail either test and you need the full package: unsubscribe mechanism, valid physical postal address, and every other CAN-SPAM requirement. The safer approach is to keep promotional content clearly secondary and below the transactional information.

What a Compliant Unsubscribe Has to Do

The law is specific about what the mechanism looks like, and generic footer links often fall short.

Every commercial email must contain a clearly displayed way for recipients to say stop. That can be a reply-to email address or a link to a single web page. The mechanism has to keep working for at least 30 days after the message is sent, and once someone opts out, you have 10 business days to stop sending them commercial email.⁵

You cannot charge a fee, demand personal information beyond an email address, or force the recipient through multiple steps beyond a reply or a single web page.¹ An opt-out process that requires logging in, filling out a survey, and waiting on a confirmation email likely violates the law.

A preference menu is allowed. A retailer can let recipients unsubscribe from sale alerts while staying on the new-arrivals list. But the menu must always include the option to stop all commercial messages from that sender.⁵ A preference center offering only partial opt-outs does not comply.

The email also has to include the sender’s valid physical postal address. A street address, a registered P.O. box, or a private mailbox registered with a commercial mail receiving agency all qualify.¹

Stricter Rules If You Send in Bulk

Federal law sets the floor. Major email providers layer their own rules on top, and in practice these are harder to ignore than the statute. Starting in 2024, Google and Yahoo began enforcing tighter standards for anyone sending large volumes to their users. Comply with CAN-SPAM but fail these rules and your messages land in spam folders or get blocked entirely.

Bulk senders of marketing email must implement a one-click unsubscribe using specific headers defined in RFC 8058.⁶ This is separate from the footer link. It lives in the email’s technical metadata and lets the recipient’s mail client process the unsubscription in a single action. A footer link to a preference page on its own does not satisfy the requirement.⁷

Transactional messages are excluded from the one-click rule, mirroring the CAN-SPAM distinction. And once someone clicks, Google expects the sender to honor it within 48 hours, well ahead of the 10-business-day window the federal statute allows.⁷

If Your List Includes Recipients Abroad

Sending only from U.S. servers does not exempt you from foreign rules. Coverage follows the recipient.

Under the EU’s General Data Protection Regulation, anyone whose personal data is processed for direct marketing has the right to object at any time, and the sender must stop when they do. That right has to be clearly communicated at first contact and presented separately from other information. A U.S. business that markets to people in the EU is subject to the GDPR regardless of having no presence there.

Canada’s Anti-Spam Legislation goes further than CAN-SPAM in one important way: it generally requires the sender to have the recipient’s consent before sending a commercial message in the first place, not just an opt-out afterward. Every commercial electronic message still needs an unsubscribe mechanism, and the sender has 10 business days to honor a stop request.⁸

What Happens If You Skip It

Each noncompliant email carries a civil penalty of up to $53,088, a figure the FTC adjusts for inflation. A single campaign to thousands of recipients can compound quickly. Both the company whose product is promoted and the company that actually sent the message can be held liable.¹

Aggravated violations involving deception, fraud, or unauthorized access to computer systems can trigger criminal prosecution, including imprisonment, with sentences that vary based on the severity and scale of the offense.⁹

The practical damage often arrives before any legal action. Gmail, Yahoo, and Outlook track unsubscribe patterns and spam complaints at the domain level. When people can’t easily unsubscribe, they hit the spam button instead, sender reputation drops, and future messages start getting filtered or blocked, including messages to people who actually want them. Rebuilding takes months of clean sending.

The FTC is the primary enforcer and treats CAN-SPAM violations as unfair or deceptive trade practices.¹⁰ State attorneys general can bring actions on behalf of their residents, and internet service providers can sue senders directly. One thing recipients cannot do: sue individually. CAN-SPAM provides no private right of action, so someone who receives illegal spam has to report it to the FTC or a state attorney general rather than file their own lawsuit under the statute.

1
Federal Trade Commission. CAN-SPAM Act: A Compliance Guide for Business
2
Office of the Law Revision Counsel. 15 U.S. Code 7702 – Definitions
3
Federal Trade Commission. Candid Answers to CAN-SPAM Questions
4
eCFR. 16 CFR 316.3 – Primary Purpose
5
Office of the Law Revision Counsel. 15 U.S. Code 7704 – Other Protections for Users of Commercial Electronic Mail
6
Internet Engineering Task Force. RFC 8058 – Signaling One-Click Functionality for List Email Headers
7
Google Workspace Admin Help. Email Sender Guidelines FAQ
8
Canadian Radio-television and Telecommunications Commission. Canada’s Anti-Spam Legislation (CASL) Guidance on Implied Consent
9
Office of the Law Revision Counsel. 18 U.S. Code 1037 – Fraud and Related Activity in Connection With Electronic Mail
10
Office of the Law Revision Counsel. 15 U.S. Code 7706 – Enforcement Generally