CAN-SPAM Act

The CAN-SPAM Act is the 2003 US federal law that sets rules for commercial email, including honest headers and subject lines, a working opt-out, and a valid physical postal address. It applies to business-to-business email and is enforced by the FTC.

Compliance & PrivacyUpdated September 30, 2026

In short

CAN-SPAM lets you send commercial email in the US without prior consent, as long as you are honest about who you are, include an address, and honor opt-outs quickly.

Key points

  1. CAN-SPAM is an opt-out law: unlike GDPR or CASL, it does not require prior Consent before sending a Cold Email to a US recipient [1].
  2. The FTC states plainly that the law makes no exception for business-to-business email, so Outbound Sales messages are covered [1].
  3. Every commercial message needs accurate header information, a non-deceptive Subject Line, identification as an ad, a valid physical postal address and a clear Opt-Out method [1][2].
  4. Opt-out requests must be honored within 10 business days, and the opt-out mechanism must keep working for at least 30 days after the message is sent [1][3].
  5. Each separate email in violation can cost up to $53,088 in civil penalties, and both the sender and the company whose product is promoted can be liable [1].
  6. Messages that are mainly transactional or relationship content, such as a receipt or an account notice, are largely exempt, but must still have accurate routing information [2][4].

What the law requires

The Controlling the Assault of Non-Solicited Pornography And Marketing Act, signed in December 2003, covers any electronic mail message whose primary purpose is the commercial advertisement or promotion of a product or service [4]. The FTC's compliance guide groups the duties into a short list: do not use false or misleading header information, do not use deceptive subject lines, identify the message as an ad, tell recipients where you are located, tell them how to opt out, honor opt-outs promptly, and monitor anyone sending on your behalf [1]. The location rule is the Physical Address Requirement: a current street address, a post office box, or a registered private mailbox [3]. None of this requires prior permission, which is why US Cold Outreach is legal when done honestly, unlike in stricter regimes such as PECR for individual subscribers.

Opt-out rules in detail

The opt-out duty is where most senders slip. The message must include a clear and conspicuous explanation of how to stop future email, whether by a reply address or an internet-based mechanism, and that mechanism must work for at least 30 days after sending [1][3]. Once a request arrives, you have 10 business days to stop. You may not charge a fee, ask for any information beyond an email address and opt-out preferences, or require more than a reply or a single web page visit [1]. After someone opts out you may not sell or transfer their address, except to a company helping you comply. In practice this means keeping a Suppression List and checking it before every send. Mailbox providers go further: the Gmail and Yahoo Bulk Sender Requirements add a One-Click Unsubscribe for high-volume senders.

CAN-SPAM and PineLead

CAN-SPAM sets a floor, not a strategy. A message can be fully compliant and still hurt Email Deliverability if it is irrelevant or sent in bulk. PineLead sends one personalized first email at a time from the user's own connected mailbox, and the user either approves each draft or turns on Auto-Approve for prospects that fit their criteria. Because the email comes from a real mailbox, the From line and reply address are the user's own, which covers the honest-header rule by default. The user is still responsible for the other duties: a postal address in the Email Signature, a clear way to opt out, and honoring requests that arrive as replies. This summary is general information, not legal advice; check the FTC guide or a lawyer for your specific program [1].

Sources
  1. CAN-SPAM Act: A Compliance Guide for Business — Federal Trade Commission
  2. 16 CFR Part 316 — CAN-SPAM Rule — eCFR
  3. 15 U.S. Code 7704 — Other protection for users of commercial electronic mail — Cornell LII
  4. 15 U.S. Code 7702 — Definitions — Cornell LII
External sources open in a new tab.

Related terms

Opt-Out

Every commercial email needs an easy way to say stop, and once someone does, you must stop emailing them within the legal deadline and keep them suppressed.

Physical Address Requirement

Put a real, current postal address in every commercial email; a registered PO box or private mailbox is acceptable in the US.

CASL

CASL is a consent-first law: to email someone in Canada commercially you need express or implied consent, plus clear identification and an unsubscribe that works.

GDPR

GDPR requires a lawful basis, transparency, and respect for individual rights whenever you process personal data about people in the EU, including business contacts.

Suppression List

A suppression list blocks sends to people who opted out, complained or bounced.

Cold Email

A cold email is a first-touch message to a stranger that works when it is relevant, specific and easy to decline.

Mentioned in
Agency Client AcquisitionAI SDRAuto-ApproveBreakup EmailCCPA / CPRACold OutreachConsentEmail FinderEmail SignatureEmail ThreadFollow-Up EmailLead GenerationLead ListList-Unsubscribe HeaderMultichannel OutreachObjection HandlingOne-Click UnsubscribeOutbound SalesPartnership OutreachPlain-Text EmailPositive Reply RatePreview TextReferral AskReply DetectionRole-Based Email AddressSales AutomationSecondary Sending DomainSender PersonaSentiment AnalysisSocial ProofSpam Trigger WordsSubject LineTransactional Email

Outreach without the busywork.

PineLead finds new B2B prospects every day, qualifies them against your criteria and writes the first email in your voice. You approve — PineLead sends.

Start free with 100 credits →