How Are Fines Assessed for Violations of the CAN-SPAM Act?

A single commercial email that violates the CAN-SPAM Act can draw a civil penalty of up to $53,088, and that ceiling applies to each message rather than to the campaign as a whole.¹ Fines for CAN-SPAM Act violations scale with how many emails went out, how the messages broke the rules, and whether the sender’s conduct crossed into aggravated or criminal territory. The $53,088 figure is adjusted annually for inflation under the Federal Civil Penalties Inflation Adjustment Act, so it generally rises each year.²

A blast of 10,000 non-compliant messages produces, on paper, hundreds of millions of dollars in theoretical exposure. Real enforcement actions have never approached those numbers, but even a modest campaign can generate serious liability. On top of the civil penalty, the FTC can pursue consumer redress under Section 19 of the FTC Act, which can include the value of time consumers lost dealing with deceptive messages.¹

What Counts as a Violation

The penalty attaches to specific prohibited acts in how a commercial message is built and delivered. Each requirement below creates an independent basis for a fine, and a single email can violate more than one at a time.

Header information in the “from,” “to,” and routing fields cannot be materially false or misleading. Spoofing an IP address or using someone else’s domain to hide the source of the message violates this rule.³
Subject lines cannot mislead a reasonable reader about what the message actually contains.³
Every commercial email must include a clear opt-out mechanism, and that mechanism has to keep working for at least 30 days after the message is sent.³
Once someone unsubscribes, the sender has 10 business days to stop mailing them. Charging a fee, demanding information beyond an email address, or making the recipient take more than a single reply or webpage visit is also prohibited.¹
Each message must contain a valid physical postal address for the sender.
If the message is an advertisement, it must clearly identify itself as one.

Every affected email becomes a separate penalty-eligible offense when any of these rules is broken. Layering violations in the same message compounds the exposure rather than replacing one penalty with another.

Aggravated Violations That Increase the Penalty

Two categories of conduct are treated as especially harmful and can push the numbers higher. The first is email address harvesting: using automated tools to scrape addresses from websites or online services, particularly where the site posted notice that addresses would not be shared for marketing. The second is dictionary attacks, where software generates possible addresses by combining names, letters, and numbers, and messages go to whatever combinations happen to be real.

When an internet service provider sues a spammer whose conduct involved these aggravated violations, the court can triple the statutory damages that would otherwise apply.⁴ The FTC treats the same conduct as grounds for additional fines beyond the standard per-email figure.¹

What Drives the Actual Fine

The $53,088 number is a ceiling, not a rate card. Several factors shape where a real penalty lands.

Volume is the biggest lever. A campaign that reached 500 inboxes produces far less liability than one that reached five million. Duration matters too. A one-time misconfiguration is treated differently from a months-long pattern of noncompliance.

Willfulness is a primary driver. A broken unsubscribe link that resulted from a coding error draws a different response than an opt-out mechanism deliberately buried behind multiple pages, or opt-out requests ignored for months. Prior violations, past complaints, and previous consent agreements push the penalty higher.

The type of violation also matters. Deceptive headers and misleading subject lines are treated as more serious than a formatting problem in a physical address disclosure, because they go to the fraud-prevention core of the statute. Combining multiple violation types in one campaign almost always increases the total.

When Fines Turn Into Prison Time

Some conduct crosses from civil penalty into federal crime under 18 U.S.C. § 1037. The criminal provisions target fraud and unauthorized computer access, not ordinary marketing mistakes, and the sentences are tiered.

Up to five years in prison applies when the spam operation furthers another felony, or when the defendant has a prior conviction for unauthorized computer access or transmitting bulk commercial email.⁵
Up to three years applies to accessing a protected computer without authorization to send spam, registering 20 or more fake email accounts or 10 or more fake domain names to send spam, sending more than 2,500 spam emails in a single day (or 25,000 in 30 days, or 250,000 in a year), or causing aggregate losses above $5,000 in a year.⁵
Up to one year applies to other criminal violations that don’t fit the higher tiers.⁵

Criminal cases are relatively rare because prosecutors have to prove knowing, intentional conduct. The Department of Justice generally reserves them for large-scale operations that involve identity theft, malware, or financial fraud alongside the spam.

Who Can Bring an Action

The FTC is the primary enforcer. The statute treats CAN-SPAM violations as unfair or deceptive acts under the FTC Act, which gives the Commission its full enforcement toolkit: investigations, civil actions, consent orders, and monetary penalties.⁴ In 2024, the FTC secured a $2.95 million settlement against a technology company for sending commercial emails without proper unsubscribe options, the largest CAN-SPAM penalty the agency had imposed at that point.

Sector-specific regulators enforce the law within their own jurisdictions. Banking regulators handle the institutions they supervise, the SEC covers brokers, dealers, and investment advisers, and the FCC has authority over certain telecommunications-related spam.⁴

State attorneys general can sue on behalf of residents, seeking injunctions, actual damages, or statutory damages, plus attorney fees if the suit succeeds.

Internet service providers are the only private parties with a right to sue. An ISP whose network is burdened by illegal commercial email can seek statutory damages of up to $100 per violating message, capped at $1,000,000 in the aggregate. Aggravated violations can triple those damages.⁴

Individual recipients cannot sue senders under CAN-SPAM. If you receive spam, the available route is to report it to the FTC or a state attorney general. Congress deliberately funneled enforcement through government agencies and ISPs rather than allowing private suits.

You Can’t Push the Liability Onto Your Vendor

Hiring an outside email marketing firm does not shield a company from CAN-SPAM liability. The law holds both the business whose product is promoted and the company that actually sends the message responsible for violations.¹ A service agreement cannot contract away that obligation. If your vendor sends non-compliant messages advertising your product, you share the liability.

When multiple marketers appear in one email and designate one of them as the official sender, the arrangement adds risk instead of reducing it. If the designated sender fails to meet the law’s requirements, every marketer in that message can be held liable.¹

Messages That Fall Outside the Fine Structure

Transactional and relationship messages sit outside most of the CAN-SPAM rules. Order confirmations, shipping notifications, warranty or safety information, account balance updates, subscription term changes, and employment communications are exempt from the unsubscribe, address, and advertising-disclosure requirements, though they still cannot use false or misleading routing information. The FTC applies a reasonable-reader test: if the primary purpose reads as advertising, the full CAN-SPAM regime applies even if transactional content is mixed in.¹ Stuffing promotional content into an order confirmation can convert an exempt message into a fully regulated one and put every violation back on the meter.

Federal law also preempts most state anti-spam statutes, so compliance with CAN-SPAM generally covers email-specific state rules. State fraud statutes, general consumer protection laws, and computer crime laws still apply on top of the federal fines.

1
Federal Trade Commission. CAN-SPAM Act: A Compliance Guide for Business
2
Federal Trade Commission. FTC Publishes Inflation-Adjusted Civil Penalty Amounts for 2025
3
Office of the Law Revision Counsel. 15 USC 7704 – Other Protections for Users of Commercial Electronic Mail
4
GovInfo. 15 USC 7706 – Enforcement Generally
5
Office of the Law Revision Counsel. 18 USC 1037 – Fraud and Related Activity in Connection With Electronic Mail