How to File a CAN-SPAM Report With the FTC

To file a CAN-SPAM report with the FTC, go to ReportFraud.ftc.gov, choose the category for unwanted emails, and submit the sender’s information along with the full email header and a description of the violation. The FTC will not resolve your individual complaint or contact you afterward. Your report feeds a federal database investigators use to build cases against repeat offenders, and each violating email can carry a civil penalty of up to $53,088.

Confirm the Email Actually Violates CAN-SPAM

Before filing, make sure the message breaks one of the law’s specific rules. Any commercial email, even a single one-off promotion and even a business-to-business message, must follow them.¹

The core requirements:

Header information (the “From” name, reply-to address, and routing data) must be accurate.
The subject line cannot mislead a reasonable person about what the message contains.
The email must include a working opt-out mechanism that stays functional for at least 30 days.
Once you opt out, the sender has 10 business days to stop emailing you. Any commercial email after that window breaks federal law.
The message must include a valid physical postal address, which can be a street address, a registered P.O. box, or a private mailbox at a commercial mail receiving agency.²

More serious conduct triggers criminal penalties, including imprisonment: accessing someone else’s computer to send spam, registering accounts or domains with fake information, harvesting addresses from websites, and running dictionary attacks against randomly generated addresses.¹

Transactional messages are a boundary worth noting. Order confirmations, shipping notices, and account statements are largely exempt: they don’t need an opt-out link or a physical address, and only the ban on false routing information applies. When a message mixes a receipt with promotional content, the FTC looks at the “primary purpose.” If a reasonable person would read the subject line as an ad, or the promotional content sits above the transactional content in the body, the whole message is treated as commercial.¹

One more point on who to name in your report: if a marketing firm or affiliate actually sent the email but it promotes a recognizable company’s product, both parties can be held liable. You don’t need to figure out who pressed “send.” Reporting the company identified in the message is enough for investigators to trace the rest.¹

Gather the Email Header and Supporting Details

The most valuable piece of evidence is the full email header, which is different from the “From” line you normally see. Headers contain routing data, server names, and IP addresses that reveal where the message actually came from. Without them, investigators have a much harder time tracing the sender.

How you access headers depends on your provider:

Gmail: open the message, click the three-dot menu near the top right, and select “Show original.” Copy everything from the top of the header down to where the message body begins.
Outlook on the web: click the three dots in the upper right corner of the email and select “View message source.”
Outlook desktop app: double-click the email to open it in its own window, then go to File, Properties. The header appears in the “Internet Headers” section at the bottom.
Yahoo Mail: open the message, click the “More” icon (three dots), and select “View raw message.”

Also record the visible “From” address, the exact subject line, and the date and time the message arrived. Screenshot the full email body if it’s missing a required element like an unsubscribe link or a physical address. If you opted out and the sender kept emailing you, save the opt-out confirmation along with the messages that came afterward. That timeline is what turns a generic complaint into evidence of a specific statutory violation.

Submit the Report at ReportFraud.ftc.gov

Go to ReportFraud.ftc.gov and click “Report Now.” The portal walks you through categorization questions. For spam email, look for “Unwanted Calls, Emails, and Texts.” Enter the sender’s information, describe the violation, and attach or paste any supporting evidence, including the header. After you review the submission, the final screen gives you a confirmation record.⁴

Older guides sometimes tell people to forward spam to spam@uce.gov. That address has been retired and no longer accepts reports.⁵ ReportFraud.ftc.gov is now the primary channel.

What Happens After You File

Your report feeds into the Consumer Sentinel Network, a database the FTC shares with federal, state, local, and select international law enforcement agencies. Sentinel gives investigators access to millions of reports and helps them identify which senders are generating the most complaints.⁶

Set your expectations accordingly. The FTC will not update you, resolve your individual complaint, or pursue the sender on your behalf. The agency uses the volume and pattern of complaints to prioritize enforcement against the worst offenders. A single report may feel like shouting into the void, but when hundreds of people report the same sender, that creates the evidence trail investigators need. Each violating email can carry a civil penalty of up to $53,088, so cases against prolific spammers can involve enormous sums.¹

The FTC also cooperates internationally through the Unsolicited Communications Enforcement Network, a partnership with authorities in Canada, Australia, South Korea, New Zealand, and the United Kingdom. That helps with spam originating overseas.⁷

You Cannot Personally Sue Under CAN-SPAM

If you were hoping to file a lawsuit for damages, the statute does not give you that option. CAN-SPAM reserves enforcement authority for three groups: the FTC, state attorneys general, and internet access service providers. Individual consumers have no private right of action.⁸

State attorneys general can bring civil actions on behalf of their residents. Internet service providers “adversely affected” by violations can sue in federal court for injunctive relief or statutory damages, though courts have required them to show actual harm from specific messages rather than generalized annoyance.

CAN-SPAM preempts most state laws that specifically regulate commercial email, but state laws prohibiting fraud or deception in email content, along with state computer crime statutes, remain enforceable. A deceptive email might give rise to claims under your state’s fraud or deceptive trade practices laws. A consumer protection attorney can evaluate whether a state-level claim is worth pursuing.

Other Places to Report Depending on the Situation

Unwanted Commercial Texts

Commercial text messages are not covered by CAN-SPAM. They fall under the Telephone Consumer Protection Act, enforced by the FCC. File through the FCC’s Consumer Complaint Center rather than the FTC portal.⁹

Your Email Provider’s Spam Button

Clicking “Report Spam” in Gmail, Outlook, or Yahoo does not file a federal complaint, but it trains your provider’s filters to block similar messages for everyone on the platform. Enough reports against one sender can lead to their IP addresses or domains being blacklisted. This is usually the fastest way to stop that sender from reaching your inbox, even without any legal consequence for them.

Domain Registrar Complaints

If the spam links to a website, you can also complain to the domain’s registrar. Look up the domain with a WHOIS tool like lookup.icann.org to find the registrar, then submit a complaint through its abuse contact. Registrars generally only act when the spam ties to phishing or financial fraud. A complaint about ordinary promotional spam is unlikely to result in suspension. Include the full email header and a description of the harm.

State Attorneys General

Most state attorneys general run consumer protection divisions that investigate deceptive marketing. Because CAN-SPAM preempts state laws that specifically target commercial email, the angle to pursue is deceptive content, not the spam itself. If the message makes genuinely misleading claims about products or services, your state attorney general’s office may take interest, especially if the sender operates locally or targets residents of your state. These offices can pursue civil enforcement independently of the FTC.

1
Federal Trade Commission. CAN-SPAM Act: A Compliance Guide for Business
2
eCFR. 16 CFR Part 316 – CAN-SPAM Rule
3
Office of the Law Revision Counsel. 15 USC 7704 – Other Protections for Users of Commercial Electronic Mail
4
Federal Trade Commission. How to Report Fraud at ReportFraud.ftc.gov
5
Federal Trade Commission. FTC Unveils New E-mail Address for Deceptive Spam
6
Federal Trade Commission. Consumer Sentinel Network
7
Federal Trade Commission. FTC Joins FCC in Renewing Memorandum of Understanding to Promote Cross-Border Law Enforcement Efforts to Combat Spam, Scams, and Illegal Telemarketing
8
GovInfo. 15 USC 7706 – Enforcement Generally
9
Federal Communications Commission. Rules and Regulations Implementing the Telephone Consumer Protection Act of 1991