CAN-SPAM Act: marketing emails, address and unsubscribe

The rule

The CAN-SPAM Act, codified at 15 U.S.C. §§ 7701 to 7713, regulates commercial email. It is enforced chiefly by the FTC, and the FTC’s rule is at 16 CFR Part 316. The Act does not require a sender to get permission before the first message. It sets what a message must contain and what a sender must do once someone asks to stop. That is the main contrast with the UK rule in UK-11.

What the Act covers turns on purpose. Section 7702 defines a commercial electronic mail message as one “the primary purpose of which is the commercial advertisement or promotion of a commercial product or service”. The definition does not limit itself to consumers. A “transactional or relationship message”, such as an account statement, is treated separately, and the FTC says such messages are exempt from most provisions except truthful routing information. Under 16 CFR 316.3, a mixed message is treated as commercial if the subject line would lead a reader to expect promotion, or if the transactional content does not appear at the start of the body.

Responsibility is shared. The FTC’s guide says both “the company whose product is promoted in the message and the company that actually sends the message may be held legally responsible”, and adds that hiring another company to handle email marketing does not contract away the duty.

Section 7706 sets out who can enforce. The FTC enforces the Act as if the conduct were an unfair or deceptive practice, other federal agencies enforce it for the sectors they supervise, and state attorneys general and internet access providers can bring civil actions. Section 7706 gives no right of action to individual recipients; the provider right of action in section 7706(g) belongs to internet access service providers. The FTC’s guide says each separate email covered can bring penalties of up to $53,088, a figure that is adjusted over time.

What PeekWell checks and how

US-14 asks what a visitor can see on a public page that bears on marketing email: is there a sign-up, and is there wording about a postal address and how to stop?

The scan finds newsletter and marketing sign-up forms on the pages it visits and records the wording beside each one. Plain text matching looks for a postal address and for unsubscribe or opt-out references in the marketing content the scan can reach without signing in, such as a public web copy of a newsletter, and in the wording beside each sign-up form. A language model reads the consent and sign-up wording. Because it reads wording, the check is marked ai-assisted: the page elements and the quoted sentences are evidence, and the reading of what they mean is a lead for a person.

The Act applies to the emails themselves, and a scan cannot read your emails. A postal address seen on a page is a signal, not proof that your messages carry one. It does not see message headers, subject lines, whether an unsubscribe link works or whether a stop request was honoured in time.

The scan has limits, and the report says so. It sees the public pages it visited and nothing behind a sign-in. It does not submit forms, test passwords or open addresses nobody linked to. It does not read your contracts or your mailbox. A Passed means the expected wording was observed on the pages scanned. It does not say the emails meet the Act. The method is the same as for UK-11, so only the American rule and cases are set out here.

Why it matters for a company

The FTC’s announced cases are about what was in the emails and what happened after someone asked to stop, which is the part a website scan cannot see. In 2023 the FTC alleged that Experian sent marketing emails to people with free membership accounts, including people who had opted out, and that the emails gave no way to opt out. Experian agreed to a $650,000 civil penalty. In 2024 the FTC announced a proposed settlement with Verkada, which it alleged sent more than 30 million commercial emails over three years without honouring unsubscribe requests, without opt-out options in the messages and without a postal address. The proposed penalty was $2.95 million. The FTC’s announcement calls it the largest it had obtained for this Act.

Both are settlements, so the accounts above are the FTC’s allegations.

The scale of the penalty comes from the counting rule. The guide’s figure applies per email, so a campaign to a long list multiplies it. The size of a sender does not change the rule. In 2006 the FTC announced settlements with two senders: Kodak Imaging Network, over more than 2 million emails with no opt-out method, no opt-out notice and no postal address, and ICE.com, over more than 6,000 emails sent to people who had asked not to receive them.

For a company the consequences are practical. One missing line in a template affects every message sent from it, and a sending vendor’s errors are the business’s own because responsibility is shared.

Smaller companies and larger companies

The Act has no size threshold, and its definitions turn on the purpose of the message. No smaller-sender case could be confirmed at a primary source for this check, so the examples here are of larger companies, and the description of how problems arise in small ones is general.

In a small company the email tool is often set up once. The default footer is edited out for a cleaner look, the postal address is left blank because the business works from home, or the unsubscribe link goes to a form that asks the person to log in. Opt-outs may sit in a shared inbox. A registered post office box or commercial mailbox can serve as the postal address, so a home address does not have to be printed.

In a larger company the problem is spread across tools. Marketing, sales outreach, product notices and partners all send from different systems, each with its own suppression list. A person who opts out of one stream continues to receive another, and a campaign that mixes promotion with an account notice can be treated as commercial. The Experian allegation was of this type: marketing delivered in what the FTC said was described as account information.

How to fix it

1. Collect every sender. List each tool and agency that sends marketing for you, and who owns each template.
2. Add the postal address to every marketing template. Use a current street address, a registered post office box or a registered private mailbox.
3. Label the message as an advertisement and add a clear opt-out line. Put the unsubscribe link where a reader will see it, in plain words.
4. Keep the opt-out simple. A reply or a single web page, with no fee, no login and nothing asked beyond the email address and preferences.
5. Honour requests within 10 business days, and sooner if you can. Feed opt-outs into one suppression list that every tool reads. Keep the opt-out working for at least 30 days after each send.
6. Check headers and subject lines. The From, To and Reply-To details must be accurate, and the subject must reflect what is in the message.
7. Match the sign-up page to the emails. Say who is sending and what the person will receive, and repeat the postal address and unsubscribe wording on the web version of any newsletter.
8. Re-scan. Run a scan again once the footer and sign-up wording are updated. The signals Peeky reads on the page should now be present.

<footer>
  <p>You are receiving this advertisement from Example Inc., 123 Main Street, Springfield.</p>
  <p><a href="https://example.com/unsubscribe">Unsubscribe</a> from marketing email.</p>
</footer>

The sample footer carries the three items the statute asks for in section 7704(a)(5)(A). Peeky reports only what it sees, and your legal adviser decides whether your messages meet the Act.