CAN-SPAM

CAN-SPAM is the US federal law for commercial email. It does not require consent before sending, which surprises people used to European rules. Instead it requires honesty and an easy way out: truthful headers and subject lines, identification as an advertisement, a valid postal address, and an opt-out that works and is honored quickly.

It largely preempts state laws on commercial email, except those aimed at falsity or deception. Other laws still apply alongside it, including the TCPA for text messages, and foreign laws such as Canada's CASL and the EU's ePrivacy rules when you email people there.

• Anyone who sends or initiates commercial email, meaning email whose primary purpose is advertising or promoting a commercial product or service, including business-to-business email.
• The company whose product is promoted is responsible even when a vendor or affiliate sends the email.
• Transactional or relationship messages, such as receipts, account notices and warranty information, are exempt from most requirements but may not contain false or misleading routing information.

Recipients have the right to opt out of further commercial email from a sender, by a method that costs them nothing beyond sending a reply or visiting one web page, and to have that request honored.

Each email that violates the law can bring a civil penalty in the tens of thousands of dollars, adjusted for inflation each year, enforced by the FTC. State attorneys general and internet access providers can also sue. Some practices, such as falsifying headers or harvesting addresses, can be criminal.

1. Classify your messages: commercial, transactional or relationship, and apply the rules to anything commercial.
2. Check headers and subject lines for anything misleading.
3. Add a valid physical postal address to every commercial email.
4. Make opt-out work: one click or one reply, honored within 10 business days, and kept working for at least 30 days after sending.
5. Monitor vendors and affiliates sending on your behalf.
6. Check foreign rules for recipients outside the US, which may require consent.