CAN-SPAM Act Guide: Email Rules for Cross-Border Firms
CAN-SPAM Act guide for foreign-owned and cross-border businesses: who it covers, the opt-out rules, the 10-business-day limit and the $53,088 per-email maximum.
Last reviewed October 27, 2026 · 3 min read · General information, not legal advice
General information only, not legal advice. CPA Tax Payroll and Accounting Corp is a CPA firm, not a law firm. Laws change: confirm with the official source or a licensed attorney before you act. Read the full notice.
The CAN-SPAM Act, a federal law from 2003, sets ground rules for commercial email, and the Federal Trade Commission (FTC) enforces it. You need no permission before sending. The Act requires honest headers and subject lines, an ad label, a postal address and an opt-out that works. This page is for owners in India, Canada or the United States who email U.S. contacts from the U.S. or abroad.
Slide show: Seven slides on CAN-SPAM
The basics
A 2003 federal law, in force since January 1, 2004, with a criminal provision at 18 U.S.C. 1037.
Who it covers
Anyone who initiates commercial email that promotes its own product, service or website. Hiring a vendor does not shift the responsibility.
The rule
Seven duties: true headers, honest subjects, a postal address, an ad label, a clear opt-out, fast handling, and oversight of others who send for you.
The number
Up to $53,088 per email for a knowing violation, the FTC figure for 2025 that stays in force for 2026.
The deadline
Opt-outs must be honored within 10 business days. The opt-out method must work for at least 30 days after sending.
The penalty
State attorneys general can seek the greater of actual loss or up to $250 per message, with a $2,000,000 cap on most statutory damages. Internet providers can sue too.
The tip
Keep one suppression list across every tool and agency. Page 2 turns this into the Maple-and-Marigold Send Pass.
Who does the CAN-SPAM Act cover?
Message type
Rules that apply
Commercial: its main purpose is advertising or promoting a product, service or website
All the requirements, including business-to-business email
Transactional or relationship: confirms an agreed deal, gives warranty or recall notices, or reports account changes
Not "commercial", but the header cannot be materially false or misleading
Mixed content
Counted as commercial if the subject line suggests an ad, or the transactional part is not, at least in substantial part, at the start
What does it mean for a foreign-owned or cross-border business?
Situation
What the law says
What to check
U.S. company owned from India or Canada emails U.S. customers
The company that initiates the message and promotes its product is the sender
Whose name and address appear in each email
Sender based abroad
The law applies to mail sent to a "protected computer", which includes some computers outside the United States; the definitions of "sender" and "initiate" name no location test
Ask an attorney how this applies. Other countries' laws may also apply and are not covered here
Do I need permission before emailing a business contact?
The CAN-SPAM Act does not require prior consent and makes no exception for business-to-business email. It requires an opt-out. Rules in the recipient's country may differ.