WebBuilding

Laws and standards

CAN-SPAM Act

Summary

The CAN-SPAM Act of 2003 is the United States federal law that sets rules for commercial email. Signed on December 16, 2003 and in force since January 1, 2004, it does not ban marketing email but requires honest headers and subject lines, a postal address and a working opt-out honored within 10 business days. The Federal Trade Commission enforces it, with civil penalties of up to $53,088 per email as of October 2026.

Web Building Encyclopedia · Laws and standards · Last reviewed October 22, 2026 · 12 min read

What the CAN-SPAM Act is

The CAN-SPAM Act of 2003 is the main United States federal law on commercial email sent over the internet. Its full name is the Controlling the Assault of Non-Solicited Pornography and Marketing Act of 2003, and the short name is built from those words.1 It was Senate bill S. 877 and became Public Law 108-187.1

The law does not ban marketing email. It sets rules for how commercial messages must be sent and gives each recipient the right to tell a sender to stop.2 A federal appeals court summed it up in 2009: the Act does not ban spam outright, but sets a code of conduct for commercial email, including a required opt-out and bans on false headers and deceptive subject lines.3

The civil rules sit in Title 15 of the United States Code, sections 7701 to 7713.4 The Act also created a federal crime, codified at 18 U.S.C. 1037, for the worst kinds of fraudulent bulk email.1 The Federal Trade Commission (FTC), the main federal consumer protection agency, adds detail through its CAN-SPAM Rule at 16 CFR Part 316.5

The law covers all commercial messages, not only bulk email, and the FTC says it “makes no exception for business-to-business email.”2 Because the FTC says the law is not limited to bulk email, a promotional message sent from a small business’s email account to a few former customers must follow the same rules.2

How the law came about, 2003 to 2005

By 2003 the volume of junk email had grown fast. In the findings written into the Act, Congress estimated that unsolicited commercial email made up over half of all email traffic, compared with an estimated 7 percent in 2001, and said most of it was fraudulent or deceptive.1 The findings also named practices the law would target: disguised senders, misleading subject lines, opt-out links that did not work and addresses harvested automatically from websites.1

Congress also found that a patchwork of different state laws had not solved the problem and was hard for businesses to follow.1 The Senate passed S. 877 on October 22, 2003. The House passed an amended version on November 21, the Senate agreed with a further change on November 25, and the House accepted it on December 8.1

President George W. Bush signed the bill on December 16, 2003. The White House fact sheet named Senators Conrad Burns and Ron Wyden among the members of Congress pictured at the signing, along with executives from EarthLink, America Online and eBay.6 The Act took effect on January 1, 2004, except for its section on a do-not-email registry, which took effect at once.1

The first cases followed within four months. On April 29, 2004, the FTC announced suits against two operations selling diet patches through spam, one based in the Detroit area and one based in Australia. In the Detroit case, federal prosecutors also arrested two men and charged four people with mail fraud and criminal CAN-SPAM violations, which the US Attorney called the nation’s first criminal prosecution under the Act.7

The Act told the FTC to study a national “Do Not Email” registry, similar to the telephone Do Not Call list.1 On June 15, 2004, the FTC told Congress that none of the registry models it studied could be enforced and that a list of real addresses could become a directory for spammers. It concluded that “without effective authentication of email, any registry is doomed to fail,” and called for systems that verify where a message comes from.8

An FTC rule that took effect on May 19, 2004 required spam with sexually oriented material to begin its subject line with the words “SEXUALLY-EXPLICIT: ” and to open on a plain first screen, which the FTC called a “brown paper wrapper,” holding only the warning and the required notices.95 In January 2005 the FTC published its rule for deciding a message’s primary purpose, which took effect on March 28, 2005.10

In December 2005, two years after the Act passed, the FTC reported to Congress that it had brought 21 cases under CAN-SPAM, and that filters and enforcement meant consumers were getting less spam in their inboxes than in 2003. It asked Congress to pass the US SAFE WEB Act to help it pursue senders based abroad.11

What the law requires

The FTC’s compliance guide groups the core rules for any commercial email as follows:2

  • Honest header information. The “From,” “To,” “Reply-To” and routing details must be accurate and identify the person or business that sent the message.2 The Act bans header information that is materially false or misleading.1
  • Honest subject lines. A subject line may not be likely to mislead a reasonable recipient about a material fact in the message.1
  • Say it is an ad. The message must clearly identify itself as an advertisement or solicitation, unless the recipient gave prior affirmative consent to receive it.1
  • A postal address. Each message must include the sender’s valid physical postal address.1 Since 2008 that can be a current street address, a post office box registered with the US Postal Service or a private mailbox registered with a commercial mail receiving agency.5
  • A working opt-out. The message must explain how to stop future marketing email and give a return address or other internet-based way to do so, which must keep working for at least 30 days after the message is sent.1 A sender may offer a menu of message types, but one choice must stop all marketing messages from that sender.2
  • Honor opt-outs fast. Requests must be honored within 10 business days, and the sender may not sell or transfer the address of someone who opted out, except to a company helping it comply.42 The sender may not charge a fee, ask for more than an email address and preferences, or require anything beyond a reply email or a visit to a single web page.5

The law does not require permission before the first message. Prior consent matters in a few places: it removes the duty to label a message as an ad or as sexually explicit, and it is required for commercial email sent to mobile phone addresses.1512 Congress also asked the FTC for a plan to mark commercial email in the subject line, for example with “ADV,” but such a label is not among the Act’s requirements.41

Commercial or transactional

The rules apply in full to a “commercial electronic mail message,” defined as one whose primary purpose is the commercial advertisement or promotion of a product or service.4 Mentioning a company name or linking to its website does not, by itself, make a message commercial.4

A “transactional or relationship message” is exempt from most of the rules, though it still may not carry false or misleading routing information.2 The Act lists five kinds: confirming a transaction the recipient already agreed to; warranty, recall, safety or security information; notices about an ongoing subscription or account, and periodic statements; information about the recipient’s employment or benefit plan; and delivery of goods or services the recipient is already entitled to.4

When one email mixes the two, the FTC’s 2005 rule decides. A message is commercial if a recipient reading the subject line would reasonably conclude it is an ad, or if the transactional part does not appear mainly at the beginning of the body.105 The FTC chose this recipient-based test over one based on what the sender intended.10

The FTC’s 2023 case against Experian shows how this works. The agency said Experian sent promotional emails with no way to opt out to people who had opened free credit accounts, with a footer saying they held important information about the recipient’s account; the FTC alleged the emails were not related to those accounts. A proposed order set a $650,000 civil penalty.13 Samuel Levine, then director of the FTC’s Bureau of Consumer Protection, said: “Signing up for a membership doesn’t mean you’re signing up for unwanted email.”13

Who is responsible

Both the company whose product is promoted and the company that sends the email can be held liable, and the FTC says a business cannot contract away that responsibility by hiring an email service.2 The Act calls the person who sends a message, or pays or induces someone else to send it, the one who “initiates” it.4

A 2008 FTC rule made it easier to tell which business must handle opt-outs when one email promotes several: one company can be the sole sender if it appears in the “From” line and meets the sender’s duties.145 For forward-to-a-friend messages, the FTC says responsibility usually depends on whether the seller offered the forwarder something of value, such as money, discounts or sweepstakes entries.2

The Act also lists aggravated violations, which can triple damages. They include harvesting addresses by automated means from websites that promise not to share them, “dictionary attacks” that guess addresses by combining names, letters and numbers, creating many email accounts automatically and relaying mail through other computers without permission.4

Enforcement and penalties

The FTC enforces the Act, treating violations as unfair or deceptive practices under the FTC Act. Other agencies, such as the banking regulators, the Securities and Exchange Commission, the Federal Communications Commission (FCC) and the Department of Transportation, enforce it for the businesses they oversee.1

Each separate email that breaks the law can bring a civil penalty of up to $53,088, according to the FTC’s compliance guide, last updated in July 2025.2 It matches the inflation-adjusted amount the FTC’s regulations list for civil penalties under Section 5(m)(1)(A) of the FTC Act.15 Because a government shutdown kept the Bureau of Labor Statistics from producing October 2025 consumer price data, the Office of Management and Budget canceled the 2026 adjustment, and the FTC said in September 2026 that its penalty levels would stay the same for 2026.16 As of October 2026, the maximum is still $53,088 per violation.15

Others can sue as well:

Who can sueStatutory damagesCap
State attorneys generalUp to $250 per violation$2,000,000, except for false header violations; can be tripled for willful or aggravated violations
Internet access providersUp to $100 per violation for false headers, $25 for others$1,000,000, except for false header violations; can be tripled

The figures in the table come from the Act itself.1 Individual recipients cannot sue under the Act.43 In Gordon v. Virtumundo, decided on August 6, 2009, the Ninth Circuit held that “Congress conferred standing only on a narrow group of possible plaintiffs”: real internet access providers harmed by the violations. A man who ran email accounts for himself, friends and family on his own domain, using leased server space, did not qualify.3

The criminal law, 18 U.S.C. 1037, carries up to five years in prison for offenses that further another felony or follow certain earlier convictions, up to three years for large-scale or organized schemes and up to one year in other cases, plus forfeiture of proceeds and equipment.1 Sanford Wallace, who sent more than 27 million spam messages through about 500,000 compromised Facebook accounts from November 2008 to March 2009, pleaded guilty to one count under that section and one count of criminal contempt, and was sentenced on June 13, 2016 to 30 months in custody.17

Recent federal cases have also involved ordinary marketing email. On September 4, 2024, the Justice Department announced a $2.95 million civil penalty resolving a lawsuit against Verkada Inc. that also covered alleged data security failures. On the email side, the government alleged that the company’s promotional emails did not clearly offer an opt-out, lacked a valid postal address and kept coming more than ten business days after people opted out.18

Preemption, phones and other countries

CAN-SPAM overrides state laws that expressly regulate commercial email, except to the extent a state law prohibits “falsity or deception.”4 The Ninth Circuit read that exception narrowly in Gordon: it reaches traditionally wrongful conduct such as fraud, not immaterial mistakes or technical errors in a header.3 The Act also leaves internet providers free to block or filter email under their own policies.4

For phones, the Act told the FCC to write rules for “mobile service commercial messages.”4 The FCC adopted them in August 2004 and, on February 7, 2005, posted a list of the domain names that wireless carriers use for messages to their subscribers.19 Thirty days after a domain appears on the list, a commercial email to an address at that domain needs the subscriber’s express prior authorization, given orally or in writing, and the opt-out must be honored within 10 days.1219

Other countries take a stricter approach. In the European Union, Article 13 of the 2002 ePrivacy Directive requires prior consent for marketing email, with an exception for a business marketing its own similar products to existing customers who are given an easy way to object.20 Canada’s Anti-Spam Legislation requires express or implied consent before a commercial message is sent, and its administrative monetary penalties can reach 1 million Canadian dollars per violation for an individual and 10 million for a business, according to the Canadian Radio-television and Telecommunications Commission (CRTC) as of October 2026.21

Mailbox providers add their own rules on top of the law. In October 2023, Google announced that from February 2024 anyone sending more than 5,000 messages a day to Gmail addresses must authenticate their mail, offer one-click unsubscribe for commercial email, process unsubscribes within two days and stay under a spam rate threshold. Yahoo backed the changes.22 The one-click method is defined in RFC 8058, an IETF standards-track specification from January 2017, which uses a List-Unsubscribe-Post header and an HTTPS POST request to the URL in the message’s List-Unsubscribe header.23

Rules and reviews since 2008

The FTC approved its second set of rule changes on May 12, 2008.24 Published on May 21 and effective July 7, 2008, the rule defined “person” to include businesses and groups, set the designated-sender test, allowed post office boxes as addresses and banned fees or extra steps for opting out.14

In 2005 the FTC had proposed cutting the opt-out deadline from ten business days to three.14 It decided not to change the deadline.24 It also declined, for the time being, to exempt online discussion groups, saying their members should get the Act’s opt-out protections when a message is mainly commercial.14

On June 28, 2017, the FTC asked for public comment on the rule as part of its regular review of its regulations.25 It finished the review on February 12, 2019, after 92 comments, and voted 5 to 0 to keep the rule with no changes. It had asked about changing the list of transactional messages, shortening the opt-out period and adding aggravated violations, and adopted none of these.26

The eCFR, current as of October 2026, shows no changes to Part 316 after January 3, 2017.5

Timeline

  1. FTC keeps its 2025 civil penalty levels, including $53,088, for 202616
  2. Verkada agrees to a $2.95 million penalty over commercial email practices18
  3. FTC charges Experian over marketing emails with no opt-out; $650,000 penalty proposed13
  4. FTC completes its review and keeps the CAN-SPAM Rule unchanged26
  5. Sanford Wallace is sentenced to 30 months for Facebook spam under 18 U.S.C. 103717
  6. Ninth Circuit decides Gordon v. Virtumundo, limiting who can sue3
  7. FTC rule on senders, post office boxes and free opt-outs takes effect14
  8. FTC reports to Congress on the Act's effectiveness after 21 cases11
  9. FTC primary purpose criteria take effect10
  10. FCC posts its list of wireless email domain names19
  11. FTC tells Congress a Do Not Email registry would not work8
  12. FTC rule requiring the "SEXUALLY-EXPLICIT: " label takes effect9
  13. FTC announces the first CAN-SPAM cases, including the first criminal case7
  14. The CAN-SPAM Act takes effect1
  15. President George W. Bush signs the CAN-SPAM Act6

What it means for your website

This is general information, not legal advice. Whether a message is commercial, and what a particular business must do, depends on the facts, so check the FTC’s own guidance or ask a lawyer. Here is what the law and the FTC’s cases mean for a small business that collects email addresses on its website.

  • Every marketing email needs the basics. A clear opt-out, your postal address and an honest “From” name and subject line.2 If an email service or your website builder‘s mailing tool adds the unsubscribe link and address footer for you, check that they appear: you remain responsible either way.2
  • Use a post office box if you work from home. A box registered with the US Postal Service or a registered private mailbox counts as a valid address.5
  • Do not hide ads in account emails. Order confirmations and account notices are transactional, but promotions in those messages can make them commercial if the subject line reads like an ad or the promotion comes first.5 The Experian case turned on emails described as account messages.13
  • Connect your opt-outs. If your contact form, store and newsletter tool keep separate lists, make sure an unsubscribe in one stops marketing email from all of them within 10 business days.2 Verkada’s penalty included opt-outs not honored in that time.18 On a WordPress site, which we build on every week, forms, shops and newsletters can each come from a different plugin, so check each one.
  • Do not buy or scrape lists. Harvesting addresses from websites is an aggravated violation.4 Gmail also requires bulk senders to stay under a spam rate threshold.22
  • Authenticate your domain. CAN-SPAM does not require it, but Gmail does for bulk senders.22 Our page on websites and email explains SPF, DKIM and DMARC records in your DNS.
  • Know where your list lives. Subscribers in the EU or Canada bring consent rules that are stricter than CAN-SPAM.2021 For the data you collect on sign-up forms, see the entries on the GDPR, the CCPA and CPRA and, for sites aimed at children, COPPA.

Our guide to website laws in the US covers the privacy, accessibility and other rules that apply to the same site.

See also

References

  1. Public Law 108-187: Controlling the Assault of Non-Solicited Pornography and Marketing Act of 2003. US Government Publishing Office, govinfo. 2003-12-16. accessed October 22, 2026.
  2. CAN-SPAM Act: A Compliance Guide for Business. Federal Trade Commission. 2025-07-22. accessed October 22, 2026.
  3. Gordon v. Virtumundo, Inc., 575 F.3d 1040 (9th Cir. 2009). US Court of Appeals for the Ninth Circuit, via CourtListener. 2009-08-06. accessed October 22, 2026.
  4. 15 U.S.C. Chapter 103: Controlling the Assault of Non-Solicited Pornography and Marketing (2023 edition). United States Code, US Government Publishing Office, govinfo. accessed October 22, 2026.
  5. 16 CFR Part 316: CAN-SPAM Rule. Electronic Code of Federal Regulations (eCFR). accessed October 22, 2026.
  6. Fact Sheet: President Bush Signs Anti-Spam Law. The White House (archived), Office of the Press Secretary. 2003-12-16. accessed October 22, 2026.
  7. FTC Announces First Can-Spam Act Cases. Federal Trade Commission. 2004-04-29. accessed October 22, 2026.
  8. New System to Verify Origins of E-Mail Must Emerge Before Do Not Spam List Can Be Implemented, FTC Tells Congress. Federal Trade Commission. 2004-06-15. accessed October 22, 2026.
  9. FTC Rule Requires Warning on Sexually Explicit Spam. Federal Trade Commission. 2004-05-19. accessed October 22, 2026.
  10. Definitions and Implementation Under the CAN-SPAM Act (final rule, 70 FR 3110). Federal Trade Commission, Federal Register, via govinfo. 2005-01-19. accessed October 22, 2026.
  11. Cross-border Law Enforcement Team Targets Spammers (on the report Effectiveness and Enforcement of the CAN-SPAM Act). Federal Trade Commission. 2005-12-20. accessed October 22, 2026.
  12. 47 CFR 64.3100: Restrictions on mobile service commercial messages. Electronic Code of Federal Regulations (eCFR). accessed October 22, 2026.
  13. FTC Charges Experian with Spamming Consumers Who Signed Up for Company Accounts with Marketing Emails They Couldn't Opt Out Of. Federal Trade Commission. 2023-08-14. accessed October 22, 2026.
  14. Definitions and Implementation Under the CAN-SPAM Act (final rule, 73 FR 29654). Federal Trade Commission, Federal Register, via govinfo. 2008-05-21. accessed October 22, 2026.
  15. 16 CFR 1.98: Adjustment of civil monetary penalty amounts. Electronic Code of Federal Regulations (eCFR). accessed October 22, 2026.
  16. Civil Penalty Inflation Adjustments (Federal Register document 2026-18853). Federal Trade Commission, Federal Register public inspection. 2026-09-15. accessed October 22, 2026.
  17. Sanford "Spam King" Wallace Sentenced To Two And A Half Years In Custody For Spamming Facebook Users. US Attorney's Office, Northern District of California, US Department of Justice. 2016-06-14. accessed October 22, 2026.
  18. $2.95M Penalty and Permanent Injunction Resolves Lawsuit Against Verkada Inc. for Alleged Unlawful Commercial Emails, Data Security Failures and Deceptive Practices. Office of Public Affairs, US Department of Justice. 2024-09-04. accessed October 22, 2026.
  19. Wireless Carriers Help Commission to Protect Wireless Subscribers from Spam. Federal Communications Commission. 2005-02-08. accessed October 22, 2026.
  20. Directive 2002/58/EC of the European Parliament and of the Council of 12 July 2002 (Directive on privacy and electronic communications). EUR-Lex, Publications Office of the European Union. 2002-07-12. accessed October 22, 2026.
  21. Frequently Asked Questions about Canada's Anti-Spam Legislation. Canadian Radio-television and Telecommunications Commission. accessed October 22, 2026.
  22. New Gmail protections for a safer, less spammy inbox. Neil Kumaran, The Keyword (Google blog). 2023-10-03. accessed October 22, 2026.
  23. RFC 8058: Signaling One-Click Functionality for List Email Headers. J. Levine and T. Herkula, Internet Engineering Task Force, RFC Editor. 2017-01. accessed October 22, 2026.
  24. FTC Approves New Rule Provision Under The CAN-SPAM Act. Federal Trade Commission. 2008-05-12. accessed October 22, 2026.
  25. CAN-SPAM Rule: request for public comment (82 FR 29254). Federal Trade Commission, Federal Register. 2017-06-28. accessed October 22, 2026.
  26. FTC Completes Review of CAN-SPAM Rule. Federal Trade Commission. 2019-02-12. accessed October 22, 2026.

Web Building Encyclopedia. First published October 22, 2026. Last reviewed October 22, 2026. Every fact on this page is linked to a source we opened. Spotted an error? Write to [email protected].