CAN-SPAM Act

The CAN-SPAM Act is a 2003 United States law that sets the rules for commercial email, establishing requirements that senders of marketing email must follow and giving recipients the right to stop receiving it. The name is an acronym — Controlling the Assault of Non-Solicited Pornography And Marketing — and the law is enforced by the Federal Trade Commission (FTC). It applies to commercial email sent to US recipients regardless of where the sender is based.

CAN-SPAM's core requirements are practical: do not use false or misleading header information (the 'from,' 'to,' and routing must be accurate), do not use deceptive subject lines, identify the message as an advertisement where required, include a valid physical postal address for the sender, provide a clear and conspicuous way to opt out, and honor opt-out requests promptly (within 10 business days), without charging a fee or requiring anything beyond an email address or a single web page to unsubscribe. Notably, CAN-SPAM is an opt-OUT regime, not opt-in: it does not require prior consent before emailing (unlike the EU's GDPR or Canada's CASL, which generally require consent), but it does require an easy, honored exit. Violations carry significant civil penalties per email, and each separately non-compliant email can be treated as a separate violation, so the exposure scales fast. Compliance is a floor, not a strategy — meeting CAN-SPAM is the legal minimum, while good email practice (genuine permission, relevance, easy unsubscribe) goes well beyond it.

CAN-SPAM matters for any business sending commercial email to US recipients — which is nearly every marketer — and non-compliance is both a legal and a deliverability risk. The discipline is to get the mechanics right on every send (honest headers and subject lines, a real physical address, a working one-click-simple unsubscribe honored promptly) and to remember that CAN-SPAM is the minimum: stricter consent-based laws apply elsewhere (GDPR in the EU, CASL in Canada), and best practice favors permission-based email regardless. Treating the law as the ceiling — doing only the bare minimum while sending unwanted mail — meets the letter of CAN-SPAM while still damaging reputation and deliverability.

The CAN-SPAM Act — Controlling the Assault of Non-Solicited Pornography And Marketing Act — was signed into US law in December 2003 and took effect on January 1, 2004, establishing the first national standards for commercial email. It is enforced by the Federal Trade Commission and notably adopts an opt-out rather than opt-in approach, distinguishing it from later consent-based regimes abroad.

Etymology: source.

Search interest for this term over the last five years:

View interest-over-time on Google Trends →

Areas of marketing where can-spam act is a core concern: