CAN-SPAM Act Email Marketing: The 2026 Compliance Guide

The CAN-SPAM Act is the U.S. law that governs every commercial email you send — and breaking it costs up to $53,088 per email. This guide breaks down exactly what compliance looks like in 2026, where B2B cold email fits, and how to build a sending process that stays legal without killing your reply rates.

TL;DR#

• CAN-SPAM applies to all commercial email, not just bulk newsletters — a single 1:1 sales email can violate it.
• There are seven core rules: honest headers, honest subject lines, ad disclosure, a physical address, a working opt-out, prompt opt-out processing, and monitoring anyone you hire.
• Penalties run up to $53,088 per individual email as of the FTC's 2026 inflation adjustment — each non-compliant message is its own violation.
• CAN-SPAM permits B2B cold email (no prior consent needed), unlike GDPR — but you still must honor opt-outs and identify yourself.
• Compliance and deliverability overlap: clean, verified lists and honest framing keep you both legal and in the inbox.

What is the CAN-SPAM Act?#

The CAN-SPAM Act (Controlling the Assault of Non-Solicited Pornography And Marketing Act of 2003) is a U.S. federal law enforced by the Federal Trade Commission that sets the rules for commercial email. "Commercial" means any message whose primary purpose is to advertise or promote a product or service — which covers marketing newsletters, product announcements, and yes, cold sales outreach.

A common myth is that CAN-SPAM only targets spammers blasting millions of messages. It doesn't. The law applies per message, so a hand-written email from one founder to one prospect is fully in scope if its purpose is commercial. The good news: the requirements are practical, and most teams can meet them with a few process changes rather than a legal overhaul.

CAN-SPAM also preempts most state anti-spam laws, giving you one federal standard to follow inside the U.S. It does not require recipients to opt in before you contact them — a critical distinction from Europe's GDPR and Canada's CASL, which we cover below.

What are the 7 rules of CAN-SPAM compliance?#

Here is the entire law boiled down to the obligations you actually have to meet. Treat this as your core checklist for CAN-SPAM Act email marketing.

1. Don't use false or misleading header information. Your "From," "To," "Reply-To," and routing details must accurately identify who sent the message. No spoofed domains, no borrowed sender names.
2. Don't use deceptive subject lines. The subject must reflect the content. "Re: our call yesterday" when there was no call is a violation.
3. Identify the message as an ad — where applicable. You have flexibility in how, but the commercial nature must be clear and conspicuous to a reasonable recipient.
4. Tell recipients where you're located. Every commercial email needs a valid physical postal address — a street address, a registered P.O. box, or a private mailbox registered with a commercial mail service.
5. Tell recipients how to opt out. Include a clear, easy-to-find unsubscribe mechanism that works for at least 30 days after sending.
6. Honor opt-outs promptly. Process unsubscribe requests within 10 business days, and you can't charge a fee, require more than an email address, or make people log in to opt out.
7. Monitor what others do on your behalf. If you hire an agency or use a sending tool, you're still legally responsible. Both the company whose product is promoted and the company sending can be held liable.

Miss any one of these and the message is non-compliant — regardless of how good your intentions were.

How much are CAN-SPAM penalties in 2026?#

Each separate email that violates the CAN-SPAM Act can incur a civil penalty of up to $53,088, following the FTC's annual inflation adjustments. Because the cap is per email, a single non-compliant campaign to a few thousand contacts represents theoretical exposure in the tens of millions of dollars.

Beyond fines, certain practices carry aggravated penalties — harvesting addresses from websites, using dictionary attacks to generate addresses, or relaying through other computers without permission. These can trigger additional liability and, in extreme cases, criminal referral. The practical takeaway: build lists from legitimate data sources, not scraped dumps. (For where compliant contact data comes from, see Tomba's data sources.)

Does CAN-SPAM apply to B2B cold email?#

Yes — and this is where CAN-SPAM is friendlier to sales teams than most privacy laws. The Act does not require prior consent before sending a commercial email, so legitimate B2B cold outreach to a work address is permitted in the U.S. as long as you follow the seven rules above.

That single fact is why U.S. outbound sales can operate at scale. But "permitted" is not "anything goes." Your cold emails still need a truthful sender, an honest subject, a physical address, and a working opt-out. Many teams nail the pitch and forget the footer — that's the gap that turns a legal email into a violation.

A few cold-email-specific notes:

• One-to-one prospecting emails count. A personalized first-touch from an SDR is commercial email and must comply.
• Transactional emails are exempt from most rules. An order receipt or password reset has a different "primary purpose" and isn't governed the same way.
• Reply handling matters. If a prospect says "remove me," treat it as an opt-out even if they didn't click your unsubscribe link.

For a deeper look at the framing and timing of outbound sequences, our guide to email deliverability pairs well with this compliance layer.

How does CAN-SPAM compare to GDPR and CASL?#

If you send across borders, U.S. law is only one piece. The biggest structural difference is consent: CAN-SPAM is opt-out, while GDPR and CASL are largely opt-in. Sending to an EU or Canadian contact under U.S. rules alone can put you offside.

The practical rule for global outbound: segment by region and apply the strictest law that touches each contact. A list that mixes U.S., EU, and Canadian prospects should not be sent under a single CAN-SPAM-only assumption.

How do compliance and deliverability connect?#

Compliance keeps you legal; deliverability keeps you seen. They reinforce each other more than most marketers realize. Mailbox providers like Gmail and Outlook reward the same behaviors CAN-SPAM mandates — honest sender identity, low complaint rates, and easy unsubscribes — and punish the behaviors it forbids.

Three habits protect both at once:

• Verify before you send. Sending to invalid or spam-trap addresses spikes bounces and complaints, which crater your sender reputation and signal sloppy list hygiene. Run new lists through an email verifier first.
• Source data legitimately. Harvested lists are both a CAN-SPAM aggravated violation and a deliverability disaster — they're packed with traps. Build targeted lists with a real email finder instead of scraping.
• Make opt-out effortless. A one-click unsubscribe lowers spam-complaint rates (people hit "report spam" when they can't find the link) and satisfies rule five at the same time.

In other words, the cheapest path to compliance is also the cheapest path to the inbox: a clean, verified, well-sourced list with honest framing. You can pressure-test your message before it goes out with a free spam checker.

What does a CAN-SPAM compliant email look like?#

Every compliant commercial email contains the same load-bearing elements. Here's the anatomy:

• Truthful From and Reply-To — your real name and a monitored domain.
• Honest subject line — describes what's inside, no bait-and-switch.
• Clear body — if it's promotional, that's evident to the reader.
• Working opt-out link — visible, functional, and live for 30+ days.
• Physical postal address — in the footer, on every send.
• Prompt suppression — unsubscribes added to your block list within 10 business days.

A simple compliant footer might read: "You received this email because we believe [Company] may benefit from [product]. [Company Name], 123 Market St, Suite 400, San Francisco, CA 94103. Unsubscribe here." That's it — no legalese required.

Your CAN-SPAM compliance checklist#

Run every campaign through this before it ships:

• Sender name and domain are accurate and authenticated (SPF/DKIM/DMARC set).
• Subject line honestly reflects the content.
• Commercial nature is clear where required.
• A valid physical postal address appears in the email.
• A working, easy unsubscribe link is present.
• Opt-out requests are processed within 10 business days.
• No fee, login, or extra info is required to unsubscribe.
• The list was sourced and verified legitimately — no harvesting.
• Regional laws (GDPR/CASL) are applied to non-U.S. contacts.
• Any vendor or agency sending on your behalf is monitored.

Bookmark the FTC's official CAN-SPAM compliance guide for business as your primary source — it's the definitive reference and is updated as penalties adjust. For practical send-side tactics, HubSpot's email marketing resources and the broader background on Wikipedia's CAN-SPAM entry are useful companions.

Frequently asked questions#

Does CAN-SPAM require opt-in consent? No. The U.S. operates on an opt-out model. You may send commercial email without prior permission, provided you follow the seven rules and honor opt-outs. This is the opposite of GDPR.

Are transactional emails covered? Mostly no. Emails whose primary purpose is transactional or relationship-based — receipts, shipping notices, account alerts — are exempt from most CAN-SPAM rules, though their header information still can't be false or misleading.

How fast must I process an unsubscribe? Within 10 business days. You also can't charge, require a login, or ask for anything beyond an email address to complete the opt-out.

Can I be liable for emails my vendor sends? Yes. Both the advertised company and the sender can be held responsible, so monitor any agency or platform acting on your behalf.

Is buying an email list illegal under CAN-SPAM? Buying a list isn't automatically illegal, but it's risky — purchased lists often contain harvested addresses (an aggravated violation) and spam traps that wreck deliverability. Building and verifying your own list is safer on both fronts.

Stay legal and land in the inbox#

CAN-SPAM compliance isn't a paperwork exercise — it's the same discipline that gets your email opened. Honest senders, clean lists, and easy opt-outs keep you out of court and out of the spam folder. The foundation of all of it is good data: targeted, accurate, legitimately sourced contacts.

That's exactly what the Tomba Email Finder is built for. Find verified professional email addresses by name, company, or domain — sourced from transparent, compliant data rather than scraped dumps — then verify them before you send so your campaigns stay legal and your reputation stays clean. Start free with 25 searches a month, and review the full Tomba pricing when you're ready to scale outbound the right way.