This page follows the overview with the CAN-SPAM Act requirements, penalties and checklist. Misleading claims raise FTC Act issues; client data falls under GLBA and HIPAA.
What are the CAN-SPAM Act requirements?
| Duty | In plain words | Source |
|---|---|---|
| Accurate headers | Show who really sent it | 15 U.S.C. 7704(a)(1) |
| Truthful subject line | No misleading a reasonable reader on a material fact | 7704(a)(2) |
| Ad label | Say it is an ad, unless the recipient has given prior affirmative consent | 7704(a)(5) |
| Postal address | A current street address, a USPS-registered post office box, or a private mailbox the sender registered with a commercial mail receiving agency | 16 CFR 316.2(p) |
| Opt-out method | Clear notice; working reply address or web page, valid 30 days after sending | 7704(a)(3) |
| Fast handling | Stop within 10 business days; no fee, extra information or extra steps; no selling the address | 16 CFR 316.5; 7704(a)(4) |
| Oversight | Responsibility stays with whoever initiates or procures the email | 7702; FTC guide |
Key amounts and dates
| Item | Figure | Year in force |
|---|---|---|
| FTC civil penalty | At most $53,088 per separate email, for knowing violations | Assessed after January 17, 2025, unchanged for 2026 |
Source: FTC, 15 U.S.C. 7706
What has changed, and what is pending?
As of October 29, 2026 we found no statute change and no rule amendment since the FTC kept the rule unchanged on April 4, 2019. The FTC amount rose from $50,120 (2023) to $51,744 (2024) to $53,088 (2025), with no 2026 adjustment.
The Maple-and-Marigold Send Pass: a named checklist
The Maple-and-Marigold Send Pass, named for the Canada-India-U.S. corridor, runs before each campaign.
- Sort the message as commercial, transactional or mixed. If the promotion drives the subject line or opens the body, treat it as commercial.
- Check the header for a real sender name and a working reply address.
- Read the subject line against the body.
- Add the ad label, a postal address of an accepted type and a clear opt-out.
- Apply opt-outs within 10 business days across every tool and vendor, asking only for an email address.
- Name who monitors vendors and agencies that send for you; keep contracts and send logs.
What mistakes recur?
- Reply-To or From lines that do not name the true sender.
- Missing the postal address, or using a type the rule does not list.
- Opt-outs that need a fee, extra information or extra steps.
- Assuming a vendor or list broker carries all the risk.
When should you bring in an attorney?
- An internet provider, a state attorney general or the FTC sends an inquiry, demand or lawsuit.
- The list was bought, scraped or generated.
- Recipients in other countries may be covered by different consent rules.
How can we help?
We handle the U.S. tax, bookkeeping and registration side of foreign-owned businesses and work with your attorney, Canadian CPA or Indian CA. See bookkeeping and accounting and business formation and registrations.
Frequently asked questions
What is the deadline for honoring an unsubscribe request?
Within 10 business days of receiving it. The 30 days is the period the opt-out method must stay working.
Can a consumer sue under the CAN-SPAM Act?
The statute does not name individual consumers among those who can sue. It names agencies, state officials and internet providers.
Which postal addresses are accepted?
Those in the rule's definition: a current street address, a USPS-registered post office box, or a registered private mailbox.
Is transactional email exempt?
It is not "commercial", but its headers may not be materially false or misleading.
Official sources
- Federal Trade Commission: CAN-SPAM Act, a compliance guide for business
- eCFR: 16 CFR Part 316, CAN-SPAM Rule
- Cornell Legal Information Institute: 15 U.S.C. 7704
- Cornell Legal Information Institute: 15 U.S.C. 7706, enforcement
- eCFR: 16 CFR 1.98, civil penalty adjustments
This page summarizes public guidance in plain language. If anything here differs from the official source, the official source controls.