The CAN-SPAM Act compliance checklist for commercial email, point by point

CAN-SPAM is an opt-out law, not an opt-in law

The most commonly misunderstood thing about CAN-SPAM is that it does not require prior consent before sending a first commercial email to a US recipient - it's an opt-out framework, not an opt-in one like GDPR. This makes it more permissive for initiating contact than many senders assume, but it attaches specific, mandatory requirements to every commercial message you send, with real penalties for violations enforced by the FTC.

The checklist, point by point

Accurate header information. The "From," "To," and routing information must accurately identify the sender - no misleading domain names or spoofed sending addresses designed to obscure who actually sent the message.

Non-deceptive subject lines. A subject line can't misrepresent the content of the message - this is a specific, enforceable requirement distinct from general marketing-copy judgment calls.

Clear identification as an advertisement, where applicable - commercial messages generally need to be identifiable as such, though the specific requirement varies by context.

A valid physical postal address. Every commercial email must include a legitimate physical address - a PO box or registered commercial mail-receiving agency address is acceptable, but it has to be real and current.

A clear, working opt-out mechanism, present in every commercial message, that doesn't require the recipient to do anything more complex than reply or click a single link.

Opt-outs honoured within 10 business days, and you cannot charge a fee, require more information than the email address, or require the recipient to take any step beyond a single opt-out action.

No selling or transferring opt-out email addresses to another party once someone has unsubscribed, except to a provider you've hired specifically to help you comply with the opt-out itself.

A quick reference table

This applies even to B2B email

CAN-SPAM's requirements apply to any commercial email sent to US recipients, with no B2B exemption - unlike some aspects of GDPR, where the B2B/consumer distinction matters for the legal basis discussion, CAN-SPAM treats commercial email the same regardless of whether the recipient is a business or an individual consumer.

State laws can add requirements beyond the federal floor

CAN-SPAM sets a federal floor, but some US states have their own additional requirements layered on top for commercial email sent to their residents - varying in scope and enforcement, and changing over time as state legislatures act. Because this layer is less uniform and more prone to change than the federal law, this is an area worth checking with whoever handles legal compliance for your specific sending footprint rather than relying on general guidance, especially if your list includes meaningful volume to any state with its own additional commercial-email rules.

The practical habit that protects you regardless of which specific state rules apply: the core CAN-SPAM requirements above - accurate identification, a working opt-out, prompt processing - tend to satisfy or substantially overlap with most state-level additions, so getting the federal checklist right is most of the work even where an additional state requirement exists on top of it. Revisit your opt-out processing time periodically to confirm it still genuinely falls within the required window as your list size and sending volume grow - a process that comfortably met the 10-business-day requirement at a smaller scale can start slipping as volume increases, without anyone noticing until a complaint highlights it.

What not to do

Do not treat CAN-SPAM compliance as "we have an unsubscribe link, so we're fine" - the physical address requirement and the 10-business-day opt-out processing requirement are both independently enforceable and commonly missed. Do not continue emailing someone from a different list or a different sending tool after they've opted out of one, if it's the same underlying commercial relationship - regulators and courts have treated this as a continued violation, not a loophole. Do not assume state-level anti-spam laws don't add additional requirements on top of the federal CAN-SPAM floor - some states have their own rules that go further.

MailPilot does not manage legal compliance for your sending, but every connected mailbox's complaint and bounce signals are tracked daily, which tends to surface compliance gaps - unhonoured opt-outs showing up as repeat complaints, for instance - as a reputation problem you can see and act on.