CAN-SPAM compliance: what the act actually requires of you

Years back, a client of mine had a real scare. An overzealous litigator tried suing them over their account-confirmation emails, the routine "you signed up, here is your confirmation" messages every login system sends. The lawsuit was not successful. What is worth sitting with is why it failed: the outcome rested entirely on the written law, which puts transactional and relationship messages outside CAN-SPAM's definition of commercial email. Knowing that carve-out cold is not a fine-dodging trick. It is the thing that gets you through a bad-faith suit with your business intact. That is the lens to read the rest of this with.

CAN-SPAM is the US email-marketing law that most senders are accidentally violating right now. The fines are real, up to $51,744 per violation as of 2024, and the most-violated requirement is one of the easiest to fix: every commercial email needs a valid physical mailing address in the footer. This post is what the law actually requires, which parts your email platform handles for you, and the 10-minute audit that closes the gaps.

Quick answer

CAN-SPAM is the US Controlling the Assault of Non-Solicited Pornography And Marketing Act of 2003. It governs commercial email sent to or from US recipients, and compliance breaks down into seven core requirements enforceable by the Federal Trade Commission (FTC). The two most important in practice are these: every commercial email must include a valid physical postal address, and every commercial email must include a clear, working unsubscribe mechanism that processes the request within 10 business days.

If you send commercial email to anyone in the US, you are inside the law's scope. That includes Canadian senders, EU senders, and any sender based outside the US that hits a US inbox.

The seven requirements, in one place

The law exists because the cost of sending a million emails dropped to roughly zero in the early 2000s, and the legal cost was the only remaining brake on the inbox flood. The seven requirements below are an attempt to keep commercial email honest about three things: who sent it, where the sender is located, and how to make it stop. A reputable email platform handles several of these for you. The ones the platform cannot handle are the ones worth knowing about in detail.

1. Don't use false or misleading header information. The "From," "To," "Reply-To," and routing information must accurately identify the sender.
2. Don't use deceptive subject lines. The subject must reflect the content of the message.
3. Identify the message as an advertisement. Either explicitly (an "advertisement" disclosure) or contextually (the recipient gave clear consent for marketing).
4. Tell recipients where you're located. Every commercial email must include a valid physical postal address, which can be a street address, a registered post-office box, or a registered private mailbox.
5. Tell recipients how to opt out. A clear and conspicuous unsubscribe mechanism that works for at least 30 days after the email was sent.
6. Honour opt-out requests promptly. Process the request within 10 business days. The opt-out cannot require a fee, additional information beyond email address and opt-out preference, or any step beyond replying or visiting a single web page.
7. Monitor what others do on your behalf. If you hire someone to handle email marketing for you, the legal responsibility for compliance still sits with your business.

What your email platform handles for you

Mailchimp®, HubSpot, ConvertKit, Klaviyo, and ActiveCampaign all handle a subset of CAN-SPAM automatically. The pattern is roughly the same across all of them:

Handled automatically: the unsubscribe link in the footer, the suppression-list enforcement that stops sends to anyone who has unsubscribed, and accurate header information. Left to you: the physical postal address, which is filled in once during account setup and worth re-checking annually, the subject line and content of each email, and the consent record for each contact on the list.

The easiest way to break the automatic part is a platform migration. Export the list to a different platform without preserving the suppression list, and the previously-unsubscribed contacts re-enter your sends. Every one of those messages is a violation, and the count climbs with each campaign until someone notices.

The single most common compliance break: someone updates the address fields in platform settings, forgets to click save, and a month of campaigns ship with the old physical address still appearing in the footer.

Canada's CASL is stricter

If your business is in Canada, or you send to any Canadian recipients, you also need to comply with CASL (Canada's Anti-Spam Legislation). CASL is the stricter law in three specific places:

The first difference is consent direction. CAN-SPAM operates on an opt-out model: you can email without explicit consent until the recipient unsubscribes. CASL operates on an opt-in model, which means you cannot email commercially without prior express or implied consent. The second is that implied consent has a clock, and the clock length depends on why it started. Consent implied from a completed purchase or an existing business relationship lasts 24 months after the last transaction. Consent implied from a mere inquiry (someone asked a question but never bought anything) lasts only 6 months. Past whichever date applies, the contact has to be re-engaged with explicit consent or removed from the list. The third is the record-keeping standard: you must be able to prove how, when, and where each contact gave consent, and the standard is documentary rather than memory.

If you are a Canadian business sending to a mix of Canadian and US contacts, CASL is the harder bar. Complying with CASL generally means CAN-SPAM compliance comes along with it.

The implied-consent expiry is the rule that catches most teams off guard, and the two clocks are the trap: a purchase buys you 24 months, but a bare inquiry buys you only 6. The pattern looks like this: someone inquired about your service in February 2024 and never bought anything, you've been emailing them quarterly since, and by August 2024 the implied-consent window had already closed silently. Every email after that was non-compliant, and no platform tracks this for you automatically. Fixing it takes a "consent date" AND "consent type" field on every contact record (inquiry vs. purchase) and a quarterly suppression sweep that retires anything past its window without re-engagement.

The documentation rule that saves you in an audit

If a regulator (the FTC for CAN-SPAM, or the Canadian Radio-television and Telecommunications Commission, CRTC, for CASL) asks how a contact got onto your list, "we don't know" is not a defence the law accepts. Build the consent record into the moment of capture:

For form submissions, log the timestamp, the IP address, the URL of the page the form was on, and the exact label of the checkbox or button the user clicked to consent. Most form plugins record the first three automatically; the checkbox label is the one to add deliberately. For imports from spreadsheets, keep the source file, the date it was provided, and the name of the person who provided it. "We received this list from X on this date" is a defensible record, while "it has been in the database since 2019" is not. Verbal consent at events is the weakest form of all: a spoken "sure, add me to your list" at a trade show is useless on its own. Capture the business card, send a welcome email with a confirm link, and only add the contact to the marketing list once the link has been clicked.

A 10-minute compliance audit

1. Send yourself a copy of your most recent campaign. Check the footer: physical address present, unsubscribe link visible, sender name accurate.
2. Click the unsubscribe link in your test email. Confirm it works in fewer than two clicks and does not ask for information beyond a confirmation.
3. Open your platform's suppression list. Compare the count to last month. If it grew, that is healthy. If it shrank without an obvious explanation, someone removed contacts that should still be suppressed.
4. Check the account settings for the physical address. Confirm it still matches your current business location. Most accidental violations begin with an office move that nobody updated in the email platform.
5. If you use a third-party agency for email work, ask for the date of their last compliance review.

If three or more of those five raise a question, the fix is worth doing before the next send, and it is the kind of finding a broader site and marketing audit tends to surface alongside a dozen quieter ones. The violations are counted per email, so a single missing address on a 10,000-recipient list works out to 10,000 separate exposures.

Common mistakes

The most consequential mistake is treating "automated transactional" as exempt without checking the content. The carve-out that protected my client is real: order confirmations, password resets, and account confirmations sit outside CAN-SPAM as transactional or relationship messages. That exemption holds only as long as the message stays transactional. "Your invoice is ready, and here are three new services we offer" crosses into commercial territory and the exemption falls away. The lesson runs both ways: do not let a marketing line ride along inside a transactional email, and do not assume a clean transactional email is at risk just because someone files a complaint about it.

Re-engagement campaigns to old contacts stack both laws against you at once. A list pulled from a 2019 conference badge is past CASL's implied-consent expiry, and CAN-SPAM still requires the unsubscribe link and physical address on every send. A post-office box is fine as the physical address, but only if it is registered with the United States Postal Service or a Commercial Mail Receiving Agency, a detail that surprises most senders who reach for a P.O. box specifically to avoid publishing a street address.

Two quieter mistakes round out the list. Some platforms hide the address field on certain template types, so verify the actual rendered email rather than the template designer. And Canadian senders sometimes assume CAN-SPAM is someone else's law; if a single recipient on your list is in the US, CAN-SPAM applies to that send.

When to bring in someone outside

Most CAN-SPAM compliance is a checklist rather than a project, and the 10-minute audit above is genuinely something a marketing operator can run on their own quarterly. Where outside help is worth the spend:

• You have inherited a list from an acquisition or merger and the consent records are incomplete. That situation needs a structured re-permission campaign before any new send to the unverified portion of the list.
• You're being audited or have received an FTC complaint. Talk to a lawyer first and a compliance specialist second.
• You operate in EU jurisdictions as well as North America, where the General Data Protection Regulation (GDPR) adds a separate (and often stricter) bar. That situation needs a unified policy rather than three parallel checklists.

The compliance bill is small until the day it isn't. I have watched a clean, plainly-compliant transactional email still draw a lawsuit, and the only thing standing between my client and a bad outcome was the written law saying, in plain terms, that the message was not commercial. The cheap insurance for the commercial mail you do send, every year, is the 10-minute audit above and a quarterly suppression-list sweep that gets done on the calendar rather than only when somebody remembers. Knowing the law precisely is not about the fines. It is about being the one in the room who can point to the exact line that ends the argument.

If you send commercial email and you are not certain it clears all seven of these, that gap is exactly the kind of quiet liability worth finding before someone else does. A compliance sweep like this is part of how I audit a site and the systems around it. If you would rather have someone confirm you are clean before a bad-faith letter arrives, book a call.