CAN-SPAM Act Requirements: 8 FTC Rules and the 10-Day Deadline
The FTC's current CAN-SPAM guide lists eight requirements for commercial email: truthful header information, honest subject lines, identification as an ad, a valid physical postal address, a clear way to opt out, preservation of marketing opt-out rights for subscribers and members, honoring opt-outs within 10 business days, and responsibility for anyone emailing on the sender's behalf. Of the eight, the deadline is the requirement you can personally verify from your inbox.
This page is the requirement-by-requirement reference: what the FTC demands, what each rule means for you as a recipient, and how to spot a violation without a law degree.
One sentence worth keeping: the CAN-SPAM Act is the U.S. federal law that sets the rules for commercial email and gives every recipient the legal right to make a sender stop.
What does the CAN-SPAM Act actually cover?
The Controlling the Assault of Non-Solicited Pornography and Marketing Act was signed into law on December 16, 2003 and took effect on January 1, 2004. It lives in the U.S. Code at 15 U.S.C. § 7701 and following, and the FTC enforces it.
It covers every message whose primary purpose is "the commercial advertisement or promotion of a commercial product or service" — and the FTC's compliance guide notes there is no exception for business-to-business email. The cold sales pitch to your work address is covered the same as the discount blast to your personal one.
Two things the law does not do, because both surprise people:
- It does not require your consent before someone emails you. CAN-SPAM is an opt-out law, not an opt-in law. A company may legally email you first; the law governs what happens after you say stop.
- It does not generally let an individual recipient sue. 15 U.S.C. § 7706 assigns government enforcement and gives a limited civil action to qualifying internet access services, not a general private claim.
The stakes for senders are real: the FTC's current guide lists a penalty of up to $53,088 for each separate violating email. That amount was checked July 30, 2026 and can change; use the live FTC page for a compliance decision.
What are the eight CAN-SPAM requirements?
The FTC's current compliance guide organizes the law into eight requirements. Here is the checklist, then each rule in detail.
| # | Requirement | The rule in one line |
|---|---|---|
| 1 | No false or misleading header information | "From," "To," reply-to, and routing must identify the real sender |
| 2 | No deceptive subject lines | The subject must reflect what the message contains |
| 3 | Identify the message as an ad | Disclosure must be clear and conspicuous |
| 4 | Include a valid physical postal address | A real street address, P.O. box, or commercial mail agency |
| 5 | Tell recipients how to opt out | A notice an ordinary person can find, with a mechanism that works |
| 6 | Preserve members' opt-out rights | A paid subscription or membership does not waive the right to stop marketing |
| 7 | Honor opt-outs promptly | Within 10 business days, free, no hoops |
| 8 | Monitor what others do on your behalf | Legal responsibility cannot be outsourced |
Requirement 1: No false or misleading header information
| What the FTC demands | What it means for you | How to spot a violation |
|---|---|---|
| The "From," "To," reply-to, and routing information — including the originating domain and email address — must accurately identify the sender (FTC) | The name sitting in your inbox is legally required to be the entity that actually sent the message | The display name says a brand you know, but the sending address is a string of random characters at a domain you have never heard of |
This is the anti-impersonation rule. It also applies to transactional email — the one part of the law that follows a message everywhere.
Requirement 2: No deceptive subject lines
| What the FTC demands | What it means for you | How to spot a violation |
|---|---|---|
| The subject line must reflect the content of the message (FTC) | A subject line is a legal representation, not a creative writing exercise | "Re:" on a conversation that never existed; "Your invoice" or "Account update" on what turns out to be a promotion |
Requirement 3: Identify the message as an ad
| What the FTC demands | What it means for you | How to spot a violation |
|---|---|---|
| The sender must disclose "clearly and conspicuously" that the message is an advertisement; the law allows flexibility in how (FTC) | Somewhere in the message, honestly readable, it must admit it is trying to sell you something | A promotional message styled to look like a personal note or an account notification, with no indication anywhere that it is marketing |
Requirement 4: Include a valid physical postal address
| What the FTC demands | What it means for you | How to spot a violation |
|---|---|---|
| Every commercial message must include the sender's valid physical postal address — a street address, a registered P.O. box, or a commercial mail receiving agency (FTC) | A legitimate sender is legally locatable; an address you can serve papers to | Scroll to the footer. No postal address anywhere is a violation — and a reliable tell for the rest of the sender's practices |
Requirement 5: Tell recipients how to opt out
| What the FTC demands | What it means for you | How to spot a violation |
|---|---|---|
| A clear, conspicuous explanation of how to stop future email, with a mechanism that can process opt-outs for at least 30 days after the message is sent | Every commercial email must carry its own exit. The unsubscribe link is not a courtesy; it is a legal obligation | No unsubscribe link at all; a link rendered in near-invisible text; a link that returns an error when clicked |
The 30-day mechanism rule matters more than it looks: a sender cannot send a blast, disable the unsubscribe endpoint a week later, and claim you missed your window.
The absence of any opt-out is not hypothetical. In 2023 the FTC charged Experian Consumer Services with sending marketing email that had no unsubscribe mechanism at all — messages labeled as containing "important information about your account" that were, per the complaint, promotions. The settlement cost $650,000, and the FTC's own consumer alert summarized the lesson plainly: CAN-SPAM means can't spam.
Requirement 6: Subscribers and members can opt out of marketing
| What the FTC demands | What it means for you | How to spot a violation |
|---|---|---|
| Subscribers and members retain the right to opt out of marketing; only messages whose primary purpose fits a transactional-or-relationship category may omit the marketing opt-out (FTC) | Paying for an account does not give a company permanent permission to send promotions | A service claims you cannot stop promotional email without cancelling the underlying paid account |
Requirement 7: Honor opt-outs within 10 business days
| What the FTC demands | What it means for you | How to spot a violation |
|---|---|---|
| Opt-outs must be honored within 10 business days. The sender cannot charge a fee, ask for any information beyond your email address, or require any step beyond a reply email or visiting a single web page. After you opt out, the sender cannot sell or transfer your address | You unsubscribe once, for free, without logging in — and roughly two calendar weeks later, the email stops. Permanently | Unsubscribe, note the date, count 10 business days. Any commercial email from that sender after the deadline is a violation you witnessed firsthand |
More on this one below. It is the load-bearing rule.
Requirement 8: Monitor what others do on your behalf
| What the FTC demands | What it means for you | How to spot a violation |
|---|---|---|
| A company cannot contract away legal responsibility. Both the business whose product is promoted and the company that actually sends the email may be held liable (FTC) | "Our marketing partner sent that" is not a defense the law accepts | You unsubscribed from a brand, and email promoting that same brand keeps arriving from "affiliates" and "partners" with different sender names |
Why is the 10-business-day deadline the load-bearing rule?
Because it is the only requirement with a clock you can watch. You cannot inspect a sender's routing infrastructure or audit their affiliate contracts. You can absolutely unsubscribe on a Monday and see whether email arrives three weeks later.
Ten business days is roughly two calendar weeks — and by 2026 standards, that is generous. Since February 2024, Google and Yahoo have required bulk senders — those sending more than 5,000 messages a day — to support one-click unsubscribe and honor those requests within two days. The mailbox providers' private rules, built on the RFC 8058 one-click standard, are far stricter than federal law. We wrote up how that mechanism works in our one-click unsubscribe explainer.
| CAN-SPAM (federal law) | Gmail / Yahoo sender rules | |
|---|---|---|
| Deadline to honor an unsubscribe | 10 business days | Two days |
| Who it applies to | All commercial email senders | Bulk senders over 5,000 messages/day |
| Required mechanism | Reply email or a single web page | RFC 8058 one-click List-Unsubscribe headers |
| Consequence of failure | Up to $53,088 per email | Mail routed to spam, throttled, or rejected |
| Who enforces it | FTC and state attorneys general | The mailbox providers themselves, automatically |
A sender who needs more than two weeks to stop emailing you is telling you something about their database — or their intentions. How often unsubscribes actually get honored in practice is its own subject; the numbers live in our unsubscribe statistics roundup.
Does CAN-SPAM apply to every email you receive?
No. The law sorts email using a primary-purpose test explained by the FTC, and only messages whose primary purpose is commercial carry all eight requirements.
| Message type | Example | What CAN-SPAM requires |
|---|---|---|
| Commercial | Promotions, newsletters that sell, cold outreach | All eight requirements |
| Transactional or relationship | Receipts, shipping updates, warranty notices, account statements | Only truthful routing information — exempt from the rest |
| Mixed | A receipt with a promo section bolted on | Judged by primary purpose: a commercial-sounding subject line, or promotional content placed ahead of the transactional part, tips it to commercial (FTC primary-purpose guidance) |
This is why the "important information about your account" framing in the Experian case mattered: labeling a promotion as account information does not make it transactional. The content decides, not the label.
How do you report a CAN-SPAM violation?
Report it to the FTC at ReportFraud.ftc.gov, which is the agency's current intake for deceptive and unwanted email; the FTC's consumer advice on unwanted email also covers forwarding options and recommends including the full message header, since that is where the routing evidence lives.
Before you report, build the record. The 10-day rule makes this simple:
- Unsubscribe through the message's own mechanism. Note the date.
- Count 10 business days forward.
- Keep any commercial email from that sender that arrives after the deadline. That message, plus your unsubscribe date, is the whole case.
Who actually checks whether senders honor unsubscribes?
We do, partly. We build Flick (flicked.email), a swipe-to-triage email client, which means we parse List-Unsubscribe and List-Unsubscribe-Post headers for a living — the same RFC 8058 machinery behind Gmail's native unsubscribe button. That work produced the Exit Gap Index: a crawler-seeded index that grades real senders A–F on whether they honor unsubscribes. The opt-out requirement is the one part of CAN-SPAM that can be tested from the outside, so we test it. You can look up how the senders in your inbox grade at the Exit Gap Index.
Stop reading your inbox. Start flicking it.
Flick turns every inbox into a finite swipe deck — archive, "no reply needed," or AI-draft → approve, one card at a time. Inbox flicked.
Try the live demo — no signup →FAQ
How long does a company legally have to stop emailing me after I unsubscribe?
Under the CAN-SPAM Act, a company must honor your opt-out within 10 business days. That is roughly two calendar weeks. Gmail and Yahoo hold bulk senders to a stricter private standard — two days — but the legal deadline is the 10-business-day one.
Can a company make me log in, fill out a form, or pay to unsubscribe?
No. The FTC's rules prohibit charging a fee, requiring any personal information beyond an email address, or demanding any step beyond sending a reply email or visiting a single web page. An unsubscribe flow that requires a password is not just annoying; it is noncompliant.
Can I sue a company that keeps emailing me after I unsubscribe?
Generally, no. 15 U.S.C. § 7706 creates government enforcement and a limited civil action for qualifying internet access services, not a general individual claim. Your move is to report the violation at ReportFraud.ftc.gov with the full message header attached.
Does CAN-SPAM require companies to get my permission before emailing me?
No — it is an opt-out law, not an opt-in law. A company may legally send you a first commercial email without consent, provided the message meets all eight requirements. The law's power starts the moment you say stop.
Is it illegal to receive marketing email after unsubscribing?
Yes, once the deadline passes — commercial email sent more than 10 business days after your opt-out violates the Act, with penalties up to the amount shown on the FTC's current guide. Transactional messages — receipts, shipping notices, account statements — are largely exempt from the marketing opt-out rules.
This guide is educational information, not legal advice. Rules and penalty amounts can change; use the linked primary sources or qualified counsel for a compliance decision.