Email marketing in the US: what the CAN-SPAM Act requires

The statute is short and unusually specific, which makes it a checklist rather than a judgement call. First, a commercial message and a transactional message alike may carry header information that is materially false or misleading, including a from line that identifies somebody other than the sender. The statute adds that a from line accurately identifying any person who initiated the message is acceptable, which is a narrow allowance rather than a licence to obscure the sender.

Second, a subject line that a reasonable recipient would find misleading about the contents is unlawful where the sender knew, or should have known from the circumstances, that it would mislead. Third, the message has to carry a functioning reply address or other internet based mechanism, clearly and conspicuously displayed, that a recipient can use to ask for no further messages from that sender. Fourth, the message has to identify itself clearly as an advertisement or solicitation, explain that way out, and give a valid physical postal address of the sender.

Two clocks matter. The mechanism itself has to keep working for at least thirty days after the message was sent, so a link that expires with the campaign or a reply address that stops being monitored falls outside the requirement.

The second clock starts when somebody uses it. Ten business days after the request, sending another commercial message within the scope of that request becomes unlawful, and the same limit reaches a person acting on the sender's behalf who knows about the request. That period is a ceiling rather than a target, and the practical answer is to suppress the address the moment the request arrives.

The statute also closes a route people forget. A sender, or anybody who knows the recipient asked to stop, may sell, lease, exchange or otherwise transfer that address for any purpose other than compliance with the law. Selling a list that contains a suppressed address is its own violation.

The statute separates a commercial message from a transactional or relationship message, which covers a confirmation, a warranty notice, a delivery update or a factual account of an existing transaction. Both carry the same header and subject line duties.

The advertisement label is where they part. A commercial message that a recipient has given prior affirmative consent to receive need not carry the statement that it is an advertisement. Where a recipient asks to stop and later gives affirmative consent, the prohibition falls away as well. That is the reason consent records matter: they change which labels a message has to carry.

The Federal Trade Commission enforces the statute as though a violation were an unfair or deceptive act or practice, with cease and desist orders and injunctions available. Several other regulators enforce it for the industries they supervise, including the banking agencies, the Securities and Exchange Commission and state insurance authorities.

State attorneys general have their own route. Where a state official believes residents were harmed, they may sue for an injunction or for damages of the greater of actual loss or a statutory figure calculated per message, and a single separately addressed unlawful message counts as a separate violation. The cap for the statutory figure is $2,000,000 unless the violation was willful, in which case a court may award three times as much. An internet access provider harmed by a violation has a parallel route with lower per message figures and a $1,000,000 cap.

A practice sending a monthly note to people who asked for it is a long way from the conduct this statute targets, and the compliance work is still worth doing because it is small. Write the subject line as a description rather than a tease. Put the unsubscribe and the postal address in every send. Point the unsubscribe at the list rather than at an inbox somebody checks on Fridays.

The part most practices get wrong is the record. Keep the consent, keep the date it was given, and keep the suppression list in one place rather than in whichever tool happens to send the mail that month.