Unsolicited Commercial Email: CAN-SPAM Rules, Penalties, and Enforcement

The CAN-SPAM Act of 2003 sets the federal rules and penalties for commercial email in the United States: senders must use truthful headers and subject lines, identify the message as an advertisement, include a valid physical postal address, and offer a working opt-out that they honor within ten business days. Break those rules and the Federal Trade Commission can seek up to $53,088 per email in civil penalties, with federal prison time available for the most aggressive tactics.¹ The law does not ban unsolicited commercial email; it regulates how it must be sent.

What Every Commercial Email Must Contain

The Controlling the Assault of Non-Solicited Pornography and Marketing Act reaches any email whose primary purpose is advertising or promoting a product, service, or commercial website. A one-off promotional message to a single recipient is covered on the same terms as a bulk campaign.²

Every commercial email has to meet three baseline requirements:

A clear and conspicuous notice that the message is an advertisement or solicitation.
A valid physical postal address for the sender. That can be a street address, a P.O. Box registered with the U.S. Postal Service, or a private mailbox registered with a commercial mail receiving agency under Postal Service regulations, so home-based senders do not have to publish a home address.
A visible, working way for the recipient to opt out of future messages.³

One point catches many businesses off guard: CAN-SPAM does not require prior consent. You can legally email someone who never signed up, provided the rest of the rules are met. That is a sharp break from most international regimes.

Header and Subject Line Rules

The “from,” “to,” and “reply-to” fields, along with the originating domain name and email address, must accurately identify the person or business sending the message. False or misleading header information is a violation on its own.²

Subject lines must accurately reflect what is in the email. If a reasonable recipient would read the subject line and conclude the message is a promotion, it is treated as commercial and the full CAN-SPAM ruleset applies. Sexually explicit marketing emails carry an added label requirement: the subject line must begin with “SEXUALLY-EXPLICIT:”.³

Opt-Out Mechanics

Most compliance failures happen at the unsubscribe stage, and the rules here are more specific than many senders realize.

The opt-out link or mechanism must remain operational for at least 30 days after the email goes out.
Once a recipient opts out, the sender has 10 business days to stop sending them commercial email.
The sender cannot sell, lease, or otherwise transfer the email address of someone who has opted out, except when the transfer is needed to comply with the law.
Opting out cannot cost a fee, require information beyond an email address, or take more than a single step past a reply email or one webpage.

These duties apply to the sender and to anyone else who knows the recipient has opted out.³

Transactional Messages and Mixed Content

Not every business email is subject to the full rules. Transactional or relationship messages are largely exempt, including:

Order confirmations and shipping notifications that facilitate a transaction the recipient already agreed to.
Warranty, recall, safety, or security information about a product the recipient purchased.
Notifications about changes to the terms, features, or the recipient’s standing in an ongoing account or subscription.
Periodic account balance information.
Information about an employment relationship or employee benefits.

These messages still cannot carry false or misleading routing information, but the advertising disclosure, opt-out, and labeling rules do not apply.³

Trouble starts when a single email mixes transactional and promotional content, like a shipping confirmation that also pushes a sale. The FTC applies a “primary purpose” test: if a reasonable recipient reading the subject line would conclude the message is a promotion, or if the transactional content is not mainly at the beginning, the email is treated as commercial and every CAN-SPAM rule applies.³

Nonprofits get no automatic pass. When a nonprofit’s email advertises or promotes a commercial product or service, it must comply just like a for-profit sender. Only messages purely tied to the mission and donor relationships, without commercial promotion, sit outside the Act.

Who Is Liable When Marketing Is Outsourced

Hiring an outside company to run email campaigns does not shield the business whose product is promoted. Under CAN-SPAM, the company being advertised and the company actually sending the message can both be held responsible. Compliance obligations cannot be contracted away.³

When one email promotes products from several marketers, those marketers can designate one of them as the “sender” for CAN-SPAM purposes. If the designated sender fails to comply, every marketer named in that email can be held liable. That is a real hazard in co-branded or joint promotional campaigns where partners’ compliance practices go unchecked.

Civil Penalties and Who Can Enforce

The Federal Trade Commission is the primary enforcement agency. As of early 2025, each individual email that violates CAN-SPAM is subject to civil penalties of up to $53,088, and the figure is adjusted annually for inflation. A campaign of thousands of non-compliant messages adds up quickly.¹

State attorneys general can bring civil actions in federal court on behalf of their residents, seeking injunctions and damages. Internet access providers harmed by violations have the same right to sue in federal court for damages or injunctive relief.⁴

Individual recipients cannot sue under CAN-SPAM. There is no private right of action. If you receive spam that violates the law, your recourse is to report it, not to file your own case.

Criminal Penalties for Aggressive Spamming

The most aggressive tactics carry enhanced exposure and can lead to federal prosecution under 18 U.S.C. § 1037. The techniques that trigger this heightened liability include:

Address harvesting using automated software to scrape email addresses from websites or services whose policies prohibit sharing user information.
Dictionary attacks that send messages to automatically generated addresses in hopes some will reach real people.
Registering multiple email accounts or domain names using false identity information to send spam.
Gaining unauthorized access to someone else’s computer and using it to send spam.⁵

Prison exposure scales with the offense:

Up to 1 year for basic violations.
Up to 3 years for offenses involving large volumes (more than 2,500 messages in 24 hours, 25,000 in 30 days, or 250,000 in a year), losses exceeding $5,000, or gains exceeding $5,000.
Up to 5 years when the spam operation furthers another felony or the defendant has prior convictions for similar offenses.⁶

These provisions target the worst actors, not a small business that misconfigures an unsubscribe link.

How State Laws Fit In

CAN-SPAM expressly preempts state laws that specifically regulate commercial email, creating a single national standard rather than fifty different email regimes.⁷

Two exceptions matter. State laws that prohibit falsity or deception in commercial email survive preemption. And general state laws not specific to email, including trespass, contract, tort, fraud, and computer crime statutes, are unaffected. A spammer who also commits fraud can face both federal CAN-SPAM enforcement and state fraud charges. CAN-SPAM compliance is not a defense against broader state consumer protection or fraud claims.

Sending to Recipients Abroad

CAN-SPAM governs what happens in the United States. It does not cover a U.S. business that emails recipients in the European Union or Canada. Those jurisdictions require opt-in consent before the first marketing message, and their penalties are substantial: the GDPR reaches up to €20 million or 4% of worldwide annual turnover, whichever is higher,⁸ and Canada’s Anti-Spam Legislation can reach up to $1 million per violation for individuals and $10 million per violation for businesses.⁹ If your marketing lists cross those borders, CAN-SPAM alone is not enough.

Reporting Spam You Receive

Because consumers cannot sue under CAN-SPAM, reporting is the way to pull enforcement toward a specific sender. The FTC accepts reports at ReportFraud.ftc.gov, and complaints are shared with more than 2,000 law enforcement partners.¹⁰ State attorneys general offices are another route, especially when the message looks deceptive under state consumer protection law. Most email providers also accept spam reports directly, which feeds their filters for everyone else on the service.

1
Federal Trade Commission. Adjustments to Civil Penalty Amounts
2
Legal Information Institute (LII). CAN-SPAM Act of 2003 – Core Requirements
3
Federal Trade Commission. CAN-SPAM Act – A Compliance Guide for Business
4
Office of the Law Revision Counsel. 15 U.S. Code 7706 – Enforcement Generally
5
LII / Legal Information Institute. CAN-SPAM Act of 2003 – Problematic Spamming Techniques
6
Office of the Law Revision Counsel. 18 U.S. Code 1037 – Fraud and Related Activity in Connection With Electronic Mail
7
Office of the Law Revision Counsel. 15 USC 7707 – Effect on Other Laws
8
GDPR-info.eu. Art. 83 GDPR – General Conditions for Imposing Administrative Fines
9
Canadian Radio-television and Telecommunications Commission. Frequently Asked Questions About Canada’s Anti-Spam Legislation
10
Federal Trade Commission. ReportFraud.ftc.gov