CAN-SPAM and cold email in the United States

Who and what it covers

The CAN-SPAM Act covers commercial email: messages whose primary purpose is to advertise or promote a product, service or commercial website. The FTC states that “the law makes no exception for business-to-business email”, so cold outreach to companies is covered (FTC).

Messages whose content is only transactional or relationship content (confirming a purchase, account or warranty information and similar) are largely exempt, though their routing information must still be truthful. A cold email is almost always commercial.

The rules in plain language

• Honest headers. From, To, Reply-To and routing information must be accurate and identify who sent the message.
• Honest subject lines. The subject must reflect what the message is about.
• Say it’s an ad. The message must clearly and conspicuously disclose that it is an advertisement; the FTC says you have flexibility in how.
• Say where you are. Include a valid physical postal address: your street address, a Post Office box registered with the US Postal Service, or a private mailbox registered with a commercial mail receiving agency.
• Explain how to opt out. Clearly explain how to stop getting your email. The opt-out must work for at least 30 days after you send.
• Honour opt-outs within 10 business days. You can’t charge a fee, ask for more than an email address, or require more than a reply or a visit to one web page. You can’t sell or transfer the addresses of people who opted out.
• You’re responsible for others. Hiring another company to send your email doesn’t move your legal responsibility; both of you can be liable.

State laws and other rules

CAN-SPAM is federal. Separately, the major mailbox providers have their own technical requirements (authentication and one-click unsubscribe for bulk senders), which are covered in the deliverability guide.

What every email needs

• Accurate From name, From address and Reply-To
• A subject line that matches the content
• A clear disclosure that the message is an advertisement or solicitation
• Your valid physical postal address
• A clear explanation of how to opt out, and a working mechanism

What Inboxed does automatically

• Adds your company name and postal address to the footer of every campaign email, and blocks a campaign from launching until they’re set (Settings → Compliance, or per campaign).
• Adds a visible unsubscribe line and one-click unsubscribe headers (RFC 8058) to every campaign email. A click takes effect straight away, for everything your workspace sends, with no login or extra details asked.
• Treats replies such as “unsubscribe”, “remove me” or “stop emailing” as an unsubscribe.
• Keeps a suppression list that every campaign checks before each send. Unsubscribes and spam complaints can’t be removed by your team; you can also block whole companies by domain.
• Verifies every lead before sending and never charges for addresses that fail.

What you must do

Inboxed can’t decide who you may lawfully email. These parts are your responsibility:

• Use a real sender name and mailbox, and subjects that describe the email honestly.
• Enter a postal address that is valid under the rules above (street, registered PO box or registered private mailbox).
• Make clear, in your wording, that the email is a commercial message.
• Not upload harvested or bought lists. The Act provides criminal penalties for harvesting addresses and for dictionary attacks.
• Keep opt-outs you collect outside Inboxed (for example by phone) and add them to the suppression list.
• Check what agencies or contractors send on your behalf.

Penalties

The FTC’s guide says each separate email in violation can be subject to penalties of up to $53,088, that more than one party can be held responsible, and that redress to consumers may be required. The amount is adjusted for inflation.

Criminal penalties, including imprisonment, apply to aggravated conduct such as harvesting addresses, generating them by dictionary attacks, using others’ computers or open relays without permission, and registering accounts or domains with false information.

Common questions