compliance

CAN-SPAM, in the Words of Somebody Sending the Email

The federal email rules are shorter than their reputation. Five requirements, one of which has a deadline, and none of which requires prior consent.

CAN-SPAM has a reputation for being complicated, which it is not, and for requiring opt-in consent, which it does not. The rules are short and specific, and a business sending commercial email can check its compliance in ten minutes.

The statute is at 15 U.S.C. 7704, the implementing rule at 16 CFR part 316, and the FTC publishes a readable compliance guide for business.

The requirements

Do not lie in the header. The from, to, reply-to and routing information must identify who actually sent the message. Using a domain you do not control, or disguising the origin, is the conduct the statute is primarily aimed at.

Do not lie in the subject. The subject must not be deceptive about the contents. "Re: our conversation" to somebody you have never spoken to fails this, and it is a widely used cold-email convention.

Say it is an advertisement. Commercial messages must be identified as such. The disclosure can be brief and the rule gives latitude in how it is done, but it must be clear.

Give a physical postal address. A valid one: street address, registered post office box, or private mailbox registered with a commercial mail receiving agency.

Offer an opt-out, honour it within ten business days, and keep honouring it. The mechanism must work for at least thirty days after sending, must not require payment, must not require a login or any information beyond an email address and opt-out preferences, and once someone opts out you may not sell or transfer their address.

That last requirement is where most real violations live, and the ten business day figure is the one people get wrong, usually by assuming it is immediate or by assuming it is longer.

What it does not require

Consent. CAN-SPAM is an opt-out regime for commercial email in the United States. A cold commercial email to a business address is not unlawful under it, provided the five requirements above are met.

This surprises people, and it is the reason "is cold email legal" has a different answer in the United States than in jurisdictions with opt-in regimes. If you send to recipients elsewhere, their rules apply to those recipients, and several are considerably stricter.

Transactional messages are a different category

The statute distinguishes commercial messages from transactional or relationship messages, and the test is the primary purpose of the message.

An appointment confirmation, a receipt, a delivery update, information about an existing transaction: these are not subject to the same requirements, though they must still not have deceptive headers.

The trap is mixing them. Adding a promotion to a receipt can change the primary purpose, which changes which rules apply. The practical rule is to keep transactional messages transactional, which is also better for deliverability, because mailbox providers treat the two categories very differently.

Liability does not transfer

If you hire somebody to send email for you, you can both be liable. Outsourcing the sending does not outsource the responsibility, and the statute provides for penalties per message, which on a campaign is not a small number.

This matters when buying a service that sends on your behalf, or an agency that runs outbound. Two questions worth asking in writing: whose postal address appears in the footer, and who processes opt-outs and on what timetable. If the answer to either is unclear, the risk has not been transferred anywhere.

The operational version

Four things to check in whatever you send from.

The footer contains a current physical address, and somebody checked it this year.

The unsubscribe link works from a logged-out browser, in one click, with no account required.

An opt-out is reflected across every sequence and every list, not only the one it came from. A recipient who opts out of a campaign and then receives a different campaign has experienced your system as not having listened, and from their side it is one business.

Opt-outs are suppressed permanently, including against a list imported later. This is the failure that catches growing businesses: somebody re-uploads a CSV from last year and resurrects two hundred people who already left.

One sentence of judgment

Everything above is the floor, and the floor is lower than the standard worth holding.

Compliance is not the same as being wanted. A business that sends technically compliant email to people who do not want it will have its deliverability destroyed by the mailbox providers long before the FTC is involved, which is the subject of the next piece. The legal rules are the easy part.