by Albright Labs
Two beliefs about commercial email in the US are common and both wrong: that the law requires consent before the first message, and that a newsletter to people who signed up is outside the law entirely.
In the US, commercial email to a business address is permitted without prior consent. CAN-SPAM is an opt-out regime rather than an opt-in one, which is the opposite of how several other jurisdictions work. It also makes no exception for business-to-business email, so every rule below applies to a newsletter, a customer announcement and a B2B message alike, whether or not the recipient signed up.
What it does require is short. This is a plain reading of the FTC’s compliance guide rather than legal advice, and anyone operating at scale or across borders should get proper counsel.
The Requirements
Header information must be accurate. The From, To, Reply-To and routing information have to identify the person or business that sent the message. Spoofed senders and fabricated domains are what the law was written for.
The subject line must not be deceptive. It has to reflect what the message is about. A subject implying a conversation or relationship that does not exist is the common failure, which makes a fake “Re:” a genuine problem rather than a gray area.
The message must be identified as an ad. The FTC says you must disclose this clearly and conspicuously, and that the law gives you a lot of leeway in how you do it. There is no required label.
A valid physical postal address must be included. Your current street address, a post office box registered with the US Postal Service, or a private mailbox registered with a commercial mail receiving agency. This is the requirement most often omitted, and it is not optional.
A clear opt-out mechanism must be present. A return email address or another easy internet-based way for the recipient to tell you to stop. It must keep working for at least 30 days after you send.
Opt-outs must be honored within 10 business days. You cannot charge a fee, ask for any personal information beyond an email address, or make the recipient do anything more than reply to an email or visit a single web page. In practice, honor them immediately. There is no reason to delay and every reason not to.
You are responsible for what is sent on your behalf. Hiring someone else to send does not hand them the obligation.
The stakes are not small. Each separate email that violates the law can draw a penalty of up to $53,088.
What It Does Not Require
Prior consent. No opt-in is needed to send a first commercial email to a business address in the US.
A double opt-in or confirmed subscription. Those are good marketing practice rather than legal requirements here.
Avoiding purchased lists. Buying a list is not itself unlawful under CAN-SPAM. It is a bad idea for deliverability reasons, and many sending providers forbid it in their terms. Postmark, for example, prohibits purchased or rented lists outright, and Google Workspace’s acceptable use policy prohibits using it for unsolicited mass email.
One nuance on how addresses are collected. If a message already breaks the law, it becomes an aggravated violation when the addresses were harvested by automated means from a website that posted a notice saying it will not give out addresses, or were generated by combining names, letters or numbers into numerous permutations. If your list comes from scraping or guessing, that is worth knowing.
The Part Almost Everyone Gets Wrong
The postal address.
Plain-text templates and email sent from an ordinary mail client routinely end with a signature, a name, and nothing else. That is a compliance gap, and it is the easiest one to close: a line in the footer with a real address.
It also helps the recipient decide you are a real business, which matters in the second they spend deciding between reply, delete and report.
Opt-Out Has to Actually Work
The requirement is a working mechanism, and “working” is doing more in that sentence than most people assume.
A visible unsubscribe link that renders correctly and leads nowhere does not satisfy it. Neither does a link that loads a page and fails to remove the person. Both are common, and both are invisible unless somebody tests the path end to end rather than looking at the email.
“Reply STOP and I will not contact you again” is allowed by CAN-SPAM, since a return email address is one of the mechanisms the law describes. It is still the weaker choice. It depends on someone reading and acting on the reply, and a recipient who wants out and cannot find a link will often use the spam button, which is worse for you than an unsubscribe.
The mailbox providers also ask for more than the law. If you send around 5,000 or more messages a day to Gmail, Google requires a one-click unsubscribe header on marketing mail and recommends honoring requests within 48 hours. Yahoo asks bulk senders for the same one-click header, a visible unsubscribe link in the body, and removal within 2 days. Ten business days is the legal ceiling, not the working standard.
Other Jurisdictions Are Stricter
CAN-SPAM is among the more permissive regimes, and a US-shaped assumption travels badly.
Canada’s anti-spam legislation, CASL, requires express or implied consent before you send, with penalties of up to $10 million per violation for an organization. The GDPR treats email addresses as personal data and requires a lawful basis for processing, which affects the list as much as the sending. Several other countries operate opt-in regimes.
If your list crosses borders, the sending jurisdiction and the recipient’s jurisdiction both matter. Segmenting the list by country and applying the stricter rule is the practical approach, and it is a conversation to have with a lawyer rather than a blog post.
Compliance and Deliverability Point the Same Way
The useful thing about these requirements is that following them helps in ways unrelated to enforcement.
Accurate headers, an honest subject, an identifiable sender, a real address, and a working opt-out are all things mailbox providers reward. The behavior the law prohibits is largely the same behavior filters are trained to catch.
Which means the compliance checklist and the deliverability checklist overlap almost entirely, and the marginal cost of being compliant is close to zero if you were already trying to reach inboxes.
A Practical Checklist
Before a campaign goes out:
- From and Reply-To identify the real sender.
- Subject describes the message honestly, with no implied prior relationship.
- Footer carries a valid physical postal address.
- A visible unsubscribe link, tested by clicking it and confirming the removal happened.
- Unsubscribes suppressed across every campaign, not just the one they came from.
- List segmented by jurisdiction if it crosses borders.
The fourth item is the one to test rather than assume, on every send path including follow-ups.
A Simple Rule of Thumb
Be honest about who you are, say how to stop, and make sure stopping works.
Those three cover the substance of the requirement and most of what deliverability asks for.
Final Thoughts
Commercial email in the US needs no prior consent, and the obligations it does carry are few and specific enough to satisfy in an afternoon.
The gaps that persist are the postal address and the opt-out that renders but does not function. Both are cheap to fix and both are checkable, which is a better position than most compliance questions leave you in.
The opt-out mechanics are in Unsubscribe Handling That Protects Your Domain.
In Sendly, an unsubscribe link is added to every campaign automatically, and the campaign layout has an address footer you can turn on, which covers two of the items above. Campaigns also go only to subscribers who have confirmed their address, which is more than CAN-SPAM asks. The rest is still yours to check.
This is a plain description of the requirements and not legal advice. If you are sending at scale or across borders, talk to a lawyer.