CAN-SPAM Compliance Checklist: All 8 FTC Rules for 2026

This CAN-SPAM compliance checklist turns the Federal Trade Commission's guidance into checks you can run on every marketing email before it sends. The FTC's current guide for business, dated August 2023, lists eight main requirements. If you have seen a list of seven elsewhere, the difference is usually item 6 below, which confirms that subscribers and members can opt out too.

Who has to follow the CAN-SPAM Act?

Any business that sends commercial email, in bulk or not. The CAN-SPAM Act of 2003 took effect on January 1, 2004. According to the FTC, a message is commercial when its primary purpose is to advertise or promote a commercial product or service, and that includes content on a website the email points to.

B2B and cold email are covered. The FTC says the law makes no exception for business to business messages. Whapi's Black Friday Prep email, which we wrote for Shopify merchants, is as commercial as any retail sale.
It is an opt out law. CAN-SPAM does not require permission before the first email. It requires an easy way to stop your email and prompt respect for that request. Inbox providers like Gmail set a higher bar, covered below.
You stay responsible when someone else sends. Hiring an agency or affiliate does not move the legal duty off your business.

What are the 8 CAN-SPAM Act requirements?

Each requirement below comes from the FTC's guide, with what it means in practice and where to check it.

FTC requirement	What it means in practice	Where to check it
1. No false or misleading header information	The From, To and reply to fields and the routing data, including the sending domain and address, must be accurate and identify the business that started the message.	Sender profile and domain settings in your email platform
2. No deceptive subject lines	The subject line has to reflect what is actually in the email.	Subject line and preheader, read side by side with the final body
3. Identify the message as an ad	Disclose clearly and conspicuously that the email is an advertisement. The FTC gives wide leeway on wording and placement.	Body copy or footer of every promotional email
4. Tell recipients where you are located	Include your valid physical postal address: a current street address, a PO box registered with the US Postal Service, or a private mailbox registered with a commercial mail receiving agency.	Footer, and the address saved in account settings
5. Tell recipients how to opt out	Give a clear, easy to read way to stop future marketing email. If you offer a menu of topics, one choice must stop all marketing email.	Unsubscribe link and preference center
6. Subscribers and members can opt out too	Being a member or subscriber does not remove the right to opt out. Only a message whose primary purpose is transactional or relationship can skip the unsubscribe link.	Account, membership and loyalty emails
7. Honor opt out requests promptly	Stop marketing email within 10 business days. Keep the opt out working for at least 30 days after the send. No fees, no extra personal data, nothing beyond a reply email or one web page. Never sell or transfer the address, except to a company helping you comply.	Suppression list, reply inbox, customer service requests
8. Monitor what others do for you	The company whose product is promoted and the company that actually sends can both be held legally responsible.	Agency, affiliate and partner contracts and their sends

Where do businesses break CAN-SPAM by accident?

Subject lines that promise more than the email delivers

The usual subject line problem is a dropped qualifier, not an outright lie. HomeStop's The Console Edit sale offered up to 25% off consoles. Cut "up to" from the subject line and it promises more than the body delivers. Read the subject line, preheader and first screen together before approval, and match every number in the subject to the offer terms underneath. Our guide to writing email subject lines shows how to stay specific without overpromising.

The ad disclosure and the consent exception

The statute, 15 U.S.C. 7704, drops the advertisement label, and only that item, when the recipient gave prior affirmative consent to receive the message. The opt out notice and postal address are still required. Consent records are often messy, so the safer habit is a plain disclosure in every promotional email.

Whose address goes in the footer

The address belongs to the sender, which under the FTC's rule is the business whose products the email promotes. When an agency sends for you, your business address goes in the footer, not the agency's. Platform footers help, but they only print what was typed into account settings, so check it again after any move.

Opt outs that arrive outside the unsubscribe link

A click on an email platform's built in unsubscribe link usually suppresses the address automatically. The 10 business day deadline matters most for requests that come in other ways: a reply that says "take me off" or a note to customer service. The FTC also warns that your own spam filter must not block opt out requests, so have someone sweep the reply inbox every week.

One email, several companies

If one message promotes more than one business, the FTC lets them pick a single designated sender, which must be named in the From line, promote its own products and meet every sender duty. If it falls short, every marketer in the email can be liable.

Forward to a friend and referral rewards

According to the FTC, whether a seller counts as the sender of a forwarded email depends on the facts, and often on whether the seller gave the forwarder something in return. Offer money, coupons, discounts, awards or extra sweepstakes entries for forwarding, and you may be responsible for compliance. The same goes for paying people for referrals or website traffic. Build referral emails so the forwarded copy still carries your footer and a working opt out.

Sexually oriented content needs a warning label

The FTC requires a specific warning label at the start of the subject line of any email with sexually oriented material. When the email is opened, the first view may show only that label plus the ad disclosure, postal address and opt out, with no graphics. The exception is a recipient who already gave affirmative consent to receive the message.

Do CAN-SPAM rules for marketing emails apply to transactional emails?

Mostly no. A message whose primary purpose is transactional or relationship only has to avoid false or misleading routing information. The FTC reads that category narrowly. It covers five kinds of messages:

Messages that facilitate, complete or confirm a transaction the recipient already agreed to.
Warranty, recall, safety or security information about something the recipient bought.
Notice of a change in the terms or features of a membership, subscription, account, loan or similar ongoing relationship, a change in the recipient's standing, or regular account balance information.
Information about an employment relationship or employee benefits.
Delivery of goods or services under a transaction the recipient already agreed to.

Mixed emails are where people get caught. The FTC treats a message as commercial if a reader of the subject line would likely think it promotes something, or if the transactional part does not appear mainly at the beginning.

Email	Likely category	What it needs
Order confirmation or shipping notice	Transactional	Accurate header and routing information
Receipt with a short promo below the order details	Likely transactional	Keep the order details first and the subject line about the order
"20% off your next order" with a receipt link at the bottom	Commercial	All eight requirements
Sale, launch, event or seasonal offer	Commercial	All eight requirements
Newsletter mixing articles and offers	Commercial if the subject line or the body as a whole would lead a reader to see it as a promotion	Treat as commercial unless it is clearly editorial

For newsletters that mix articles and offers, the FTC weighs where the promotional content sits, how much of the email it fills and how color, graphics and type size draw attention to it.

An existing relationship does not make a promotion transactional. A snowbird offer like Lake Buchanan RV Resort's Winter Sites on the Water, from our campground email marketing work, is commercial even when it reaches people who have stayed at the park before. Activation emails sit close to the line too. ExpenseTracker's New Month, Clean Ledger campaign exists to get people using the app again, so we build emails like it as commercial. When the call is close, include every requirement.

How much is the CAN-SPAM penalty per email in 2026?

According to the FTC, each separate email that violates the law can bring a civil penalty of up to $53,088. The number is per message, not per campaign.

The figure is adjusted for inflation every year under the Federal Civil Penalties Inflation Adjustment Act Improvements Act of 2015, normally in January. The FTC raised it from $51,744 to $53,088 in a notice published in the Federal Register on January 17, 2025. There was no 2026 increase. The fall 2025 government shutdown stopped the Bureau of Labor Statistics from producing October 2025 consumer price index data, so the Office of Management and Budget cancelled the 2026 adjustments in an April 17, 2026 memorandum. The FTC then published a notice on September 15, 2026 saying it will keep applying its 2025 penalty levels through 2026. Check the FTC's figure again each January.

Who can act	What they can seek, per 15 U.S.C. 7706 and the FTC guide
Federal Trade Commission	Civil penalties of up to $53,088 per violating email, plus consumer redress, which the FTC says can include the value of people's lost time
State attorneys general	Up to $250 per violation, generally capped at $2,000,000, which a court can raise to three times that amount for willful or aggravated violations
Internet access providers	Up to $100 per violation for false header information and up to $25 for other violations, generally capped at $1,000,000, also subject to tripling
Federal prosecutors	Criminal penalties, including prison, for conduct the FTC lists such as harvesting addresses or generating them through dictionary attacks, sending spam from someone else's computer without permission, using open relays or proxies without permission, and registering email accounts or domain names with false information

What does Gmail require that CAN-SPAM does not?

Passing CAN-SPAM does not get you to the inbox. Google's sender guidelines set a higher bar for anyone sending more than 5,000 messages a day to personal Gmail accounts.

Topic	CAN-SPAM Act	Gmail bulk sender rules
Unsubscribe method	A working reply address or web based mechanism	One click unsubscribe through the list unsubscribe headers in RFC 8058, plus a visible link in the body
Time to honor it	Within 10 business days	Google recommends within 48 hours and flags slower handling as a requirement issue
Complaints	No threshold	Spam rate in Postmaster Tools kept below 0.3%, with 0.1% as the recommended target
Authentication	Not named; routing information must be accurate	SPF, DKIM and DMARC required

Build around the 48 hour standard. Yahoo publishes its own bulk sender rules, and our email deliverability checklist covers both, with authentication and complaint rates step by step. The email marketing glossary defines terms like DMARC and suppression list.

A send day CAN-SPAM compliance checklist you can copy

Run these on the final version of every marketing email, before you schedule it.

The From name and address identify your business, and the email sends from your own authenticated domain.
The reply to address works and a real person reads it.
The subject line and preheader match the offer in the body, qualifiers included.
The email says plainly that it is a promotion.
The footer shows your current postal address: street address, registered PO box or registered private mailbox.
The unsubscribe link is easy to see, works on a phone, and asks for nothing beyond an email address and opt out choices.
Any preference center includes an option to stop all marketing email, and someone clicked the unsubscribe link in the test send.
Unsubscribes from every other tool that sends your marketing email, and from any platform you left, are in this platform's suppression list.
Opt out requests that came by reply, phone or customer service are suppressed within 10 business days.
The list contains no purchased, rented, scraped or guessed addresses.
Anyone else sending for your brand, such as affiliates, partners or referral programs, follows this same list.

How we handle CAN-SPAM for clients

Compliance is part of the QA step in our monthly email process. Every campaign in our email campaign management service has its footer, sender details and unsubscribe link checked during QA, and the client approves every email before it sends. We work inside your own platform, so your list, your suppression history and your consent records stay yours. Our email deliverability service adds authentication and complaint monitoring.

Requirement 8 means you share the risk with anyone who sends for you, so put compliance on your list of questions to ask an email marketing agency. Our plan is $1,000 a month for 8 finished campaigns, month to month, as shown on our pricing page. Want a second set of eyes first? Our free email audit reviews your recent campaigns, deliverability records and list health at no cost.

General information, not legal advice

This checklist summarizes the FTC's published guidance and the CAN-SPAM statute as of October 2026. It is not legal advice. For questions about a specific email or program, talk to a lawyer licensed in your state.

Frequently asked questions

Does CAN-SPAM require permission before I send marketing email?

No. CAN-SPAM is an opt out law: it lets you send commercial email without prior consent as long as every message meets the requirements and you stop when asked. Mailbox providers are a different story. Mailing people who never signed up drives the spam complaints that Gmail measures, so permission based lists are the practical standard.

Can a consumer sue me under the CAN-SPAM Act?

The statute gives the right to bring a civil case to the FTC, other federal agencies, state attorneys general and internet access providers. It does not list individual recipients. State laws that target falsity or deception in commercial email can still apply, so a misleading email can create exposure beyond the federal law.

Do state email laws still apply if I follow CAN-SPAM?

Partly. Under 15 U.S.C. 7707, CAN-SPAM overrides state laws that expressly regulate commercial email, except where they prohibit falsity or deception in a message. State trespass, contract and tort laws that are not specific to email, and state laws on fraud or computer crime, are not displaced.

Is a PO box enough for the CAN-SPAM address requirement?

Yes, if it is registered with the US Postal Service. The FTC also accepts a private mailbox registered with a commercial mail receiving agency under Postal Service rules, or your current street address. A home based business can use one of these to keep a home address out of the footer.

Does CAN-SPAM apply to text messages?

Not directly. CAN-SPAM is written for commercial email, and its wireless section, 15 U.S.C. 7712, covers email sent straight to a mobile device, directing the FCC to protect phone subscribers from those messages unless they gave express prior authorization. Marketing texts fall under the Telephone Consumer Protection Act, 47 U.S.C. 227, which CAN-SPAM leaves in place. In a 2016 decision, the Supreme Court treated it as undisputed that a text to a cell phone counts as a call under that law.

Who is liable if my email agency sends a noncompliant email?

Possibly both of you. The FTC says the company whose product is promoted and the company that actually sends the message may each be held legally responsible. Ask any agency how it tests footers, sender details and unsubscribe links, and keep approval of every send on your side.

CAN-SPAM compliance checklist all 8 FTC rules, checked before you send