Email rules in the US: CAN-SPAM in plain words
The rules are not hard to follow. See what the FTC asks of every commercial email, what Gmail and Yahoo expect and how to keep your list in order.
Email has rules in the United States, and they are not hard to follow. The main law is called CAN-SPAM, and the Federal Trade Commission publishes a plain guide to it. This lesson walks through what the FTC asks of every commercial email, what Gmail and Yahoo expect from senders, how to keep your list clean and when to ask a professional. It is general information, not legal advice.
Who the rules apply to
CAN-SPAM covers commercial email, which means a message whose main purpose is to advertise or promote a product or service. Your newsletter, a special offer and a note about a new service are all commercial email.
Three points are worth knowing:
- Size does not matter. The rules apply to a one-person business as much as to a large company.
- Business to business is covered. The FTC states that the law makes no exception for business-to-business email.
- Each email counts. The rules apply to every message, not to your list as a whole.
Some messages are treated differently. Service messages, such as a receipt, a booking confirmation or information about an account or a warranty, are exempt from most of the rules. They still cannot contain false or misleading routing information. When a message mixes service content with promotion, the commercial rules can apply, so keep your service messages plain and put the service part first.
The rules, in plain words
The FTC's compliance guide for businesses lists the requirements below. Here is each one, in simple language.
1. Do not use false or misleading header information
The "From," "To" and "Reply-To" fields, and the routing information behind them, must be accurate. They must identify the person or business that sent the message. Use your real business name, and a sending address that really belongs to you.
2. Do not use deceptive subject lines
The subject line must accurately reflect the content of the message. If the email is about a spring sale, the subject cannot say that an order has shipped. The previous lesson shows how to write subject lines that are clear and honest.
3. Identify the message as an ad
The law says you must do this clearly and conspicuously, and it leaves the method to you. A short line near the top or the bottom that says the message is a promotion can do the job. The point is that the reader is not misled about what it is.
4. Tell recipients where you are located
Every commercial email must include a valid physical postal address. The FTC accepts your current street address, a post office box you have registered with the U.S. Postal Service, or a private mailbox you have registered with a commercial mail receiving agency. If you work from home and would rather not print your home address, ask your post office or a mailbox service about those options.
5. Tell recipients how to opt out
Include a clear and conspicuous explanation of how to stop getting your marketing emails, and a simple way to do it: a reply address or a link to a web page. You may offer a menu that lets people choose which kinds of messages they get, but it must also let them stop all of your marketing emails. Make sure your spam filter does not block the requests.
6. Honor opt-out requests promptly
You must stop within 10 business days. The opt-out method must keep working for at least 30 days after you send the message. You cannot charge a fee, ask for more than an email address or make the person do anything beyond replying or visiting a single web page. And once someone opts out, you cannot sell or transfer their address. Most email services handle all of this automatically when someone clicks the unsubscribe link, and it is better to stop at once than to wait ten days.
7. Remember that subscribers and members can opt out too
People who joined your list, or who are members of your organization, can still leave. Joining does not take away that right.
8. Monitor what others do on your behalf
If an agency, a freelancer or a partner sends emails for you, you are still responsible. The FTC says you cannot contract away your legal responsibility. Both the business that is promoted and the company that sends the message can be held responsible.
What it costs to break the rules
The penalties are charged per email. The FTC's guide puts the maximum penalty at more than $50,000 for each separate email that violates the law, and the agency adjusts the amount for inflation, so check its page for the current figure. A mailing to hundreds of people can add up quickly. That is why the rules matter even for a small list, and why you should follow them from the first message.
Your email service helps, but you are still responsible
A good email service does a lot for you. It adds an unsubscribe link, handles opt-outs automatically and has a place for your postal address in the footer. Still, some parts are yours:
- Entering a valid postal address.
- Using an honest sender name and an honest subject line.
- Making clear when a message is a promotion.
- Sending only to people who agreed to hear from you.
- Checking the work of anyone who sends for you.
What a simple footer looks like
The footer is the small block at the bottom of an email. A simple, compliant one can look like this:
- You are receiving this email because you joined our list on our website.
- Maple Kitchen, [street address or P.O. box, city, state and ZIP code].
- Unsubscribe.
The first line reminds people why they got the message, which can reduce complaints. The address meets the location rule, and the link meets the opt-out rule. Your email service usually builds most of this footer for you. Open a test email and check that every part is there.
Permission matters beyond the law
CAN-SPAM gives people the right to make you stop emailing them. But the law is only one of the rules you will meet. Email services set their own, and Mailchimp, for example, says in its acceptable use policy that you may not send to purchased, rented or third-party lists. Mailbox providers watch how many people complain. And some other countries, such as Canada and members of the European Union, generally require permission before you send. If you have subscribers abroad, ask a professional.
The simple habit that keeps you safe everywhere is to send only to people who asked, and to keep a record of when and how each person joined.
What Gmail and Yahoo ask of senders
Gmail and Yahoo set their own requirements, because they decide what reaches the inbox. According to Google's published guidelines, which began on February 1, 2024:
- Every sender needs to authenticate its messages with SPF or DKIM, which prove that an email really comes from your domain.
- Every sender should keep the spam rate, the share of recipients who press "report spam," below 0.3 percent. Google suggests aiming for below 0.10 percent.
- Bulk senders, defined as those who send more than 5,000 messages a day to Gmail accounts, must use SPF, DKIM and DMARC. Their marketing messages must also support one-click unsubscribe and show a clear unsubscribe link.
Yahoo announced similar requirements at the same time. Most small businesses send far fewer than 5,000 emails a day, but the habits help everyone: set up your domain with the steps your email service gives you, make unsubscribing easy and send only to people who want your emails. These rules can change, so check the current pages from Google and Yahoo.
Keep your list clean and keep your records
- Remove anyone who unsubscribes, and never add them again. Your email service keeps a list of unsubscribed addresses so that you do not email them by mistake.
- Remove addresses that bounce for good.
- Keep a note of when and where each person joined. This is your proof of permission.
- Do not buy, rent or borrow lists.
- Watch for people who reply "please remove me" instead of clicking. Treat it as an opt-out, and act on it.
- Review people who have not opened or clicked in a long time. A short "do you still want to hear from us?" email, or removal, keeps your list healthy.
Text messages follow different rules
Do not assume that what you know about email applies to texts. Marketing text messages fall under different rules, such as the Telephone Consumer Protection Act, and mobile carriers add requirements of their own. In general, you need a customer's clear permission before you send marketing texts. If you plan to text customers, ask a professional first.
A checklist before you press send
- Everyone on the list agreed to receive my emails.
- The sender name and reply address are real and accurate.
- The subject line says what is inside.
- It is clear that the message is a promotion.
- My valid postal address is in the footer.
- There is a clear unsubscribe link, and it works.
- Unsubscribed people are removed and stay removed.
- If someone sends for me, I have checked their work.
When to ask a professional
The FTC's compliance guide is free to read on its website, and it is a good place to start. For anything beyond the basics, ask a lawyer who works with small businesses. Good reasons to ask include selling to customers in other countries, texting customers, using a list you did not build yourself, receiving a complaint and not knowing whether a message counts as commercial. State laws can add rules of their own. Nothing in this lesson is legal advice.
Email rules and Good Sites Only
The contact details your visitors see on your site are the same ones your emails will carry: your business name, your address and a way to reach you. We write the texts of your pages with your real details, and contact forms are included in every site. Email marketing can be added as a monthly service, but whoever sends your emails, the legal responsibility stays with your business, as the FTC points out. Ask questions before you hand it over. When you are ready for a site that shows who you are, you can start your site.
Questions people ask
What does CAN-SPAM stand for?
It is short for Controlling the Assault of Non-Solicited Pornography and Marketing, the name of the 2003 federal law. In everyday use, people just say CAN-SPAM. It sets rules for commercial email in the United States.
Does CAN-SPAM apply to small businesses?
Yes. The rules cover all commercial email, whatever the size of the sender. The FTC also states that the law has no exception for business-to-business email.
Do I need permission to email someone?
The law gives people the right to make you stop. But email services, mailbox providers and the laws of other countries generally expect permission before you send. The safe habit is to email only people who asked, and to keep a record of when they joined.
Do I need an unsubscribe link in every email?
Every commercial email must tell people how to opt out, and a link is the easiest way. Service messages, such as receipts and confirmations, are exempt from most of the rules, but a link in your newsletters is standard practice.
Do I have to include a physical address?
Yes, a valid physical postal address in every commercial email. The FTC accepts a current street address, a post office box registered with the U.S. Postal Service or a private mailbox registered with a commercial mail receiving agency.
What is the penalty for breaking CAN-SPAM?
Penalties are charged per email, and they can be large. The FTC's guide puts the maximum at more than $50,000 for each separate email, and the amount is adjusted for inflation. Check the FTC's page for the current figure.
How fast must I honor an unsubscribe request?
Within 10 business days, according to the FTC. In practice, most email services handle it at once when someone clicks the link, and that is the better standard to keep.
Can I email people who gave me their business card?
A card is not the same as agreeing to a newsletter. The safest path is to send one personal message and ask if they would like to hear from you. For a specific case, ask a professional.
Do these rules apply to text messages?
No, text messages follow different rules, such as the Telephone Consumer Protection Act, plus requirements from mobile carriers. In general, you need clear permission before sending marketing texts. Ask a professional before you start.
What if my email service handles it?
A good email service adds the unsubscribe link and handles opt-outs, but you are still responsible for your postal address, your sender name, your subject lines and who is on your list. The FTC says you cannot contract away your legal responsibility.
Want a website that does all of this? Start your site