CAN-SPAM Act Compliance
Understanding U.S. commercial email requirements and responsible sending practices.
Learn how the CAN-SPAM Act helps protect email recipients, establishes requirements for commercial email, and supports responsible communication practices.
At SMTPPrime, we encourage transparent, permission-based email sending and provide SMTP and email campaign solutions for legitimate business communications.
What Is the CAN-SPAM Act?
The CAN-SPAM Act, formally known as the Controlling the Assault of Non-Solicited Pornography and Marketing Act of 2003, is a United States federal law regulating commercial email messages.
The law establishes standards for identifying commercial messages, providing accurate sender information, respecting unsubscribe requests, and protecting recipients from deceptive email practices.
It applies to commercial messages whose primary purpose is to advertise or promote a product or service, including many business-to-business emails.
The Federal Trade Commission (FTC) is one of the principal authorities responsible for enforcing CAN-SPAM requirements.
Compliance with the CAN-SPAM Act does not automatically mean an email complies with every privacy law, mailbox provider requirement, or SMTPPrime policy.
For additional guidance about U.S. commercial email requirements, read the official Federal Trade Commission resource: CAN-SPAM Act - A Compliance Guide for Business.
Who Must Follow CAN-SPAM Requirements?
CAN-SPAM requirements may apply to businesses, marketers, agencies, and other organizations sending commercial email within the scope of U.S. law.
Examples include:
- Businesses sending promotional offers.
- E-commerce stores sending product advertisements.
- Marketing agencies managing client campaigns.
- Companies sending newsletters that promote products or services.
- SaaS businesses announcing paid services or offers.
- Organizations conducting business-to-business email promotions.
The law applies to commercial email even when the recipient is another business.
A single commercial email can be subject to the law; there is no minimum sending volume.
Understanding Commercial and Transactional Emails
Not every business email is treated the same way under CAN-SPAM.
Commercial Email
A commercial email primarily advertises or promotes products, services, or commercial websites.
Examples:
- Promotional newsletters
- Product offers
- Discount announcements
- Sales campaigns
- Marketing announcements
Commercial messages must satisfy the applicable CAN-SPAM requirements.
Transactional or Relationship Email
A transactional or relationship message primarily concerns an existing transaction or ongoing customer relationship.
Examples may include:
- Order confirmations
- Payment receipts
- Account security notifications
- Certain subscription or account updates
- Warranty or product safety notices
Genuine transactional or relationship messages are exempt from many CAN-SPAM commercial-message requirements, but their routing information must still be truthful.
Mixed-Content Messages
Some emails contain both transactional information and promotional content.
The primary purpose, subject line, content placement, and presentation determine whether such a message is treated as commercial.
A transactional subject line does not automatically make a promotional message exempt.
8 Essential CAN-SPAM Compliance Requirements
1. Use Accurate Sender Information
Email headers and routing information must accurately identify the sender.
This includes:
- From address
- To address
- Reply-To address
- Sending domain
- Other relevant routing information
Do not impersonate another organization, forge sender information, or conceal the true origin of an email through deceptive routing practices.
2. Write Honest Subject Lines
Email subject lines must accurately represent the content of the message.
Avoid false offers, misleading urgency, fake account warnings, or subjects that intentionally misrepresent the message.
Recipients should be able to understand the general purpose of an email before opening it.
3. Identify Advertising Messages
Commercial email must include clear identification that it is an advertisement or solicitation when required by the law.
The disclosure must be reasonably noticeable and understandable.
The CAN-SPAM Act provides an exception to the advertising-identification requirement where the recipient has given prior affirmative consent, but other applicable requirements continue to apply.
4. Include a Valid Postal Address
Commercial email must include the sender's valid physical postal address.
Depending on the sender's circumstances, this may be a legitimate business street address or an eligible registered postal or private mailbox.
An email address or website URL alone is not a substitute for the required postal address.
5. Provide a Clear Unsubscribe Method
Recipients must have a straightforward way to request that a sender stop sending them commercial email.
The opt-out method must be clearly explained and accessible.
It may use a return email address or another compliant Internet-based mechanism.
If recipients can choose particular message categories, they must also have the option to stop all commercial messages from that sender.
6. Keep the Opt-Out Method Working
The unsubscribe mechanism must remain capable of receiving or processing opt-out requests for at least 30 days after the commercial email is sent.
Senders should test unsubscribe functionality and ensure that legitimate opt-out requests are not blocked or ignored.
7. Honor Opt-Out Requests Within 10 Business Days
Valid opt-out requests must be honored within 10 business days.
The sender cannot require recipients to:
- Pay a fee to unsubscribe.
- Provide unnecessary personal information beyond their email address.
- Complete complicated procedures.
- Take steps beyond sending a reply email or visiting a single webpage as a condition of opting out.
After a valid opt-out, the sender must stop the covered commercial messages within the legal deadline.
The sender must not sell or transfer the opted-out address, except for legally permitted compliance-related purposes.
8. Take Responsibility for Email Marketing Partners
Businesses cannot eliminate their CAN-SPAM responsibilities simply by outsourcing campaigns to another company.
Depending on the circumstances, both the business promoted in the email and the company initiating the email may be responsible for compliance.
Organizations should review the practices of agencies, contractors, software operators, and other marketing partners acting on their behalf.
SMTPPrime's Commitment to Responsible Email Sending
SMTPPrime supports legitimate business email communications and expects customers to follow applicable legal requirements and our Anti-Spam Policy.
Our service requirements may be stricter than the minimum requirements of the CAN-SPAM Act.
For marketing campaigns sent through SMTPPrime, customers are expected to:
- Obtain affirmative recipient permission before sending promotional messages.
- Avoid purchased, rented, scraped, or harvested mailing lists.
- Keep sender information accurate and transparent.
- Include functional unsubscribe options.
- Respect recipient requests to stop marketing communications.
- Maintain suppression lists and appropriate consent records.
- Use sending domains they are authorized to operate.
- Avoid deceptive, fraudulent, abusive, or unlawful content.
- Follow applicable sending limits and service conditions.
SMTPPrime may review reported misuse and take measures consistent with its published policies and service agreements.
Read our complete Anti-Spam Policy for additional requirements.
Best Practices for Email Unsubscribe Management
A reliable unsubscribe process is essential for responsible email marketing.
Make Unsubscribing Easy
Place the unsubscribe link somewhere recipients can easily find it, typically in the email footer.
Avoid misleading text, unnecessary forms, or complicated removal procedures.
Process Requests Promptly
Although CAN-SPAM provides a maximum of 10 business days for honoring covered opt-out requests, promptly processing them reduces the risk of additional unwanted messages.
Maintain Suppression Records
Keep track of recipients who unsubscribe so their addresses are excluded from future promotional campaigns.
Protect these records and use them appropriately.
Follow Mailbox Provider Requirements
Some receiving email services have separate requirements, including one-click unsubscribe support for certain high-volume marketing senders.
These rules are distinct from the CAN-SPAM Act and may require additional technical configuration.
CAN-SPAM Compliance Checklist
Before sending a commercial email campaign, review the following:
- The sender name and address are accurate.
- The subject line honestly describes the email.
- The message identifies advertising where required.
- The email contains a valid physical postal address.
- The unsubscribe method is easy to find and use.
- The opt-out mechanism remains functional for the required period.
- Existing opt-out requests have been respected.
- Recipient lists meet SMTPPrime's permission requirements.
- Third-party marketing partners understand their responsibilities.
- The email complies with other applicable laws and receiving-provider rules.
This checklist provides general guidance and is not a substitute for legal review of a specific campaign.
CAN-SPAM and International Email Sending
SMTPPrime serves businesses with different sending requirements, including customers communicating with recipients in multiple countries.
The CAN-SPAM Act is a U.S. law. Other countries and regions may impose additional or different requirements.
Depending on your sending activities, relevant rules may include:
- The European Union's GDPR and applicable electronic marketing rules.
- The United Kingdom's electronic marketing and privacy requirements.
- Canada's Anti-Spam Legislation (CASL).
- Applicable national or regional privacy and electronic communications laws.
Businesses are responsible for determining which laws apply to their recipients, marketing activities, and operations.
Following CAN-SPAM alone does not establish compliance with every jurisdiction.
Customer Responsibilities When Using SMTPPrime
SMTPPrime customers remain responsible for the email campaigns, sender identities, recipient lists, and content submitted through their accounts.
Customers should:
- Review the purpose and content of each campaign.
- Maintain appropriate records supporting recipient permissions.
- Configure available unsubscribe and suppression features.
- Protect account credentials and authorized integrations.
- Cooperate with legitimate abuse investigations.
- Promptly correct identified sending issues.
SMTPPrime's Email Sending Application may provide campaign management features, but access to software does not automatically make a particular email campaign legally compliant.
Similarly, an SMTP connection is a delivery mechanism, not a certification of the sender's legal compliance.
Reporting Suspected Spam or Non-Compliant Email
If you receive suspicious or unwanted email that appears to have been sent through SMTPPrime, you may contact us to report the issue.
Where available, include:
- The sender's email address.
- The date and approximate time of the message.
- The email subject.
- Relevant email headers.
- A brief explanation of the concern.
Please avoid sharing passwords, financial credentials, or unnecessary sensitive information.
Reports may be reviewed in accordance with our Anti-Spam Policy and relevant service procedures.
Frequently Asked Questions About the CAN-SPAM Act
Does the CAN-SPAM Act apply only to bulk email?
No. The CAN-SPAM Act can apply to a single commercial email. It also covers business-to-business promotional messages.
Does CAN-SPAM require prior consent for every marketing email?
Not generally under federal CAN-SPAM requirements. However, SMTPPrime's Anti-Spam Policy requires affirmative permission for promotional mailing lists, and other applicable laws may impose additional consent requirements.
How quickly must unsubscribe requests be honored?
Covered opt-out requests must be honored within 10 business days. Processing them sooner is recommended.
Does every commercial email require a postal address?
Covered commercial emails must include a valid physical postal address for the sender.
Are transactional emails subject to CAN-SPAM?
Genuine transactional or relationship emails are generally exempt from many commercial-message requirements, but they must not use false or misleading routing information. Mixed-content emails must be evaluated according to their primary purpose.
Can I use purchased email lists with SMTPPrime?
No. SMTPPrime's Anti-Spam Policy prohibits purchased, rented, scraped, and other unauthorized mailing lists.
Does using SMTPPrime automatically make my campaigns CAN-SPAM compliant?
No. Customers remain responsible for their messages, recipient lists, sending practices, and applicable legal obligations.
Where can I report suspected email abuse?
You can submit a report through the SMTPPrime Contact Us page.
Send Email Responsibly with SMTPPrime
Responsible email communication begins with accurate sender identification, appropriate recipient permissions, and respect for unsubscribe requests.