CAN-SPAM Act: Requirements, Penalties and Checklist

The CAN-SPAM Act is the reason every marketing email you’ve ever received has an unsubscribe link and a postal address at the bottom. It’s also the most lenient email law in the developed world, which is exactly why US brands that sell internationally get caught out.

This guide covers what the law actually requires, based on the FTC’s CAN-SPAM compliance guide for business (checked September 2026), what counts as a commercial versus transactional email, the penalties, and a practical checklist for a Klaviyo account. If you also email customers in Australia, Canada, the UK or EU, read our comparison of email marketing laws by country as well. Those laws are stricter.

---

What is the CAN-SPAM Act?

The CAN-SPAM Act of 2003 is the US federal law governing commercial email. It doesn’t require consent before you send, but every marketing email must have accurate headers, a non-deceptive subject line, identification as an ad, a valid postal address and a working opt-out, and opt-outs must be honoured within 10 business days. The FTC enforces it.

The name stands for Controlling the Assault of Non-Solicited Pornography And Marketing. Its implementing rule is at 16 CFR Part 316. Despite “spam” in the title, it applies to all commercial email, not just bulk email and not just unsolicited email. A single promotional email to a customer is covered, and there’s no exception for business-to-business email.

---

The 7 CAN-SPAM requirements

The FTC summarises the law as seven main requirements. Here they are, with what each means in practice for an ecommerce brand.

1. Don’t use false or misleading header information

Your From, To, Reply-To and routing information must be accurate and identify the business sending the message. In practice: send from your own brand name and a domain you own. A properly authenticated sending domain (see our DMARC, SPF and DKIM guide) also proves to inboxes that you are who you say you are.

2. Don’t use deceptive subject lines

The subject line must accurately reflect the content. “Re: your order” on a sale email is deceptive. So is “Your refund is ready” when there’s no refund. Urgency is fine if it’s true. A 48-hour sale that really ends in 48 hours is fine; a “last chance” that runs every week isn’t.

3. Identify the message as an ad

The FTC says the law gives you a lot of leeway in how you do this, but the disclosure must be clear and conspicuous. For a branded ecommerce promotion, the content usually makes its commercial nature obvious. Be careful with emails styled as editorial content, personal notes or “advertorials” that are really selling.

4. Tell recipients where you’re located

Every commercial email must include a valid physical postal address: your current street address, a PO box registered with the US Postal Service, or a private mailbox registered with a commercial mail receiving agency under Postal Service regulations. Put it in your Klaviyo footer template once and it’ll appear in every campaign and flow that uses it.

5. Tell recipients how to opt out

You need a clear and conspicuous explanation of how to opt out. It can be a return email address or an internet-based mechanism such as an unsubscribe link, and you can offer a menu of choices as long as “stop all commercial messages” is one of them. Klaviyo’s unsubscribe link and preference page satisfy this out of the box, as long as you don’t hide the link in tiny grey text.

6. Honour opt-out requests promptly

You must honour opt-outs within 10 business days, and your opt-out mechanism must be able to process requests for at least 30 days after you send the message. You can’t charge a fee, ask for personal information beyond an email address, or make people do anything more than reply to an email or visit a single web page. You also can’t sell or transfer the addresses of people who opted out.

Gmail and Yahoo are stricter than the law here. Their bulk sender requirements expect unsubscribes to be honoured within two days, and one-click unsubscribe headers are mandatory. Klaviyo handles both automatically.

7. Monitor what others are doing on your behalf

You can’t outsource responsibility. If an agency, affiliate or influencer sends email promoting your products, both the company whose product is promoted and the company that actually sends the message can be held legally responsible. Hiring an agency to run your email doesn’t move the liability off your brand.

---

Commercial vs transactional email: which rules apply?

CAN-SPAM treats email content in three categories:

Type	Examples	CAN-SPAM rules
Commercial	Campaigns, abandoned cart, browse abandonment, win-back, product launches	All requirements apply
Transactional or relationship	Order confirmation, shipping update, receipt, warranty or recall information, account changes	Exempt from most rules; routing information must not be false or misleading
Other	Genuinely non-commercial content	Not covered

The FTC lists five categories of transactional or relationship content: facilitating or confirming an agreed transaction; warranty, recall, safety or security information; notices about changes to a subscription, membership or account; employment or benefit information; and delivering goods or services the recipient is entitled to under an agreed transaction.

Mixed messages: the primary purpose test

Most ecommerce emails aren’t pure. A shipping confirmation with “You might also like” products is both. The FTC’s test is the primary purpose:

• If the subject line would lead a recipient to think it’s an ad, it’s commercial.
• If the transactional content doesn’t appear mainly at the beginning of the message, it’s commercial.

So a shipping email with the tracking link up top and a small product block below is usually still transactional under US law. A “Your order shipped, plus 20% off your next order!” subject line isn’t.

Watch out if you sell into Australia. Australian law takes a much harder line. The ACMA treats any message that contains promotional content as commercial, whatever else it does. In March 2026, Lululemon paid a $702,900 penalty in Australia after sending over 370,000 service emails, including shipping and order confirmations, that contained promotional material but no unsubscribe option. We cover this in our email marketing laws guide.

---

CAN-SPAM penalties

According to the FTC, each separate email in violation of the law is subject to penalties of up to $53,088. The FTC adjusts civil penalty amounts annually for inflation, and it published a no-adjustment notice in 2026, so the 2025 figure still applies.

Things that make it worse:

• Per email, not per campaign. A non-compliant campaign to 50,000 people is 50,000 potential violations.
• Shared liability. The brand and whoever sent the email can both be liable.
• Aggravated violations. Harvesting addresses, generating addresses through dictionary attacks, and using scripts to register multiple accounts can add to the penalty.
• Criminal penalties, including imprisonment, for things like falsifying header information, sending through computers accessed without authorisation, or registering email accounts and domains with false information.

State attorneys general and internet service providers can also bring actions under the Act.

What about state email laws?

CAN-SPAM pre-empts state laws that expressly regulate commercial email, except to the extent they prohibit falsity or deception (15 U.S.C. § 7707(b)). The notable survivor is California’s Business and Professions Code § 17529.5, which targets falsified or misrepresented header information and misleading subject lines, and lets recipients, email service providers and the Attorney General sue for liquidated damages of up to $1,000 per email. Honest headers and truthful subject lines keep you clear of both.

---

What CAN-SPAM doesn’t require (and why that’s a trap)

CAN-SPAM doesn’t require:

• Consent before you send (it’s an opt-out law).
• Double opt-in.
• A specific unsubscribe wording.
• An unsubscribe in transactional email.

Legally, a US brand can email someone who never signed up. Practically, it’s a terrible idea:

• Gmail and Yahoo will punish you first. Unsolicited email drives complaint rates above the 0.3% ceiling, and deliverability collapses long before the FTC notices.
• Your list isn’t only American. The moment you email a Canadian, Australian, UK or EU customer, their laws apply, and they require consent.
• Purchased lists contain spam traps that damage your sender reputation. See our list cleaning guide.

Build a permission-based list with clear sign-up forms, and consider double opt-in where the quality benefit is worth the friction.

---

CAN-SPAM compliance checklist for Klaviyo

• Sending from your own brand name and a domain you own, with a branded sending domain configured
• Subject lines accurately reflect content; no fake “Re:” or “Fwd:”
• Physical postal address in every email footer template
• Visible unsubscribe link in every campaign and marketing flow email
• Unsubscribe or preference page asks for nothing beyond the email address
• Suppressed and unsubscribed profiles never re-imported or re-subscribed without fresh consent
• Transactional flows (order confirmation, shipping) keep transactional content at the top, and promotional content secondary
• Agencies, affiliates and influencers who email on your behalf follow the same rules
• SMS handled under TCPA and carrier rules, not CAN-SPAM. Our SMS marketing service covers consent capture

Run your sending domain through our deliverability checker while you’re at it. Compliance and deliverability are two sides of the same trust signal.

---

Want a second pair of eyes?

Most CAN-SPAM problems we see aren’t deliberate. They’re a missing address in an old flow template, or a promotional block that crept into order confirmations. If you’d like your Klaviyo account reviewed for compliance and deliverability together, start with a free Klaviyo audit, or see our email deliverability service.

This article is general information, not legal advice. For advice on your specific situation, speak to a qualified lawyer.