CAN-SPAM compliance checklist for American newsletter publishers

What to take away

Unsubscribe rules and the 10 business day clock

The opt-out is the part most publishers already have. What breaks is the plumbing behind it.

The link must be clear, conspicuous and functional, and it has to keep working for at least 30 days after the send. Clear means findable without hunting. Conspicuous means not buried in gray six-point type under a legal block. Functional means the link or reply address actually accepts requests.

A reply-to inbox nobody monitors is not a mechanism. Neither is an exit survey that gates the unsubscribe behind three questions.

The clock starts on arrival

The FTC's CAN-SPAM Act: A Compliance Guide for Business sets the core duties: tell recipients how to opt out, honor the request within 10 business days, and stop sending to that address.

You cannot charge a fee, require personal information beyond an email address, or ask for any step other than a reply email or one visit to one page. A confirmation page is fine. A paywall is not.

The clock runs from receipt. If your unsubscribe link writes to a database that syncs to your sending platform weekly, you are late most weeks. Automate the path; do not route it through a human queue.

Test the path yourself

Subscribe with a fresh address every quarter, unsubscribe, then watch whether the next scheduled send still lands. That test catches sync gaps a dashboard will not show you.

Transactional and relationship messages

A welcome email triggered by a signup is usually transactional or relationship content, so parts of the commercial rules sit outside it. The opt-out duty still applies. The FTC treats a message as commercial if its main purpose is advertising or promotion.

If your welcome email is mostly a pitch for a paid tier, treat it as commercial and give it the full footer. Publishers get caught by assuming the label on the automation decides the category.

Selling or transferring the list

If you sell, rent or transfer subscriber addresses, the recipient inherits your opt-out obligations for them. The law expects you to pass along the addresses of people who opted out, or to run the suppression yourself.

When you move platforms, export the suppression list, not just the active subscribers. That export is the difference between a clean migration and a compliance incident, which is why newsletter platform setup deserves attention before issue one.

Physical address and sender identification

Every commercial message needs a valid physical postal address. A registered PO box or a commercial mail receiving agency address works. A city and state alone does not.

What a compliant disclosure contains

A compliant commercial message carries three visible elements. The header must identify the sender. The subject line must not mislead. The body must carry a valid physical postal address and a clear opt-out notice.

A footer with an address and no working opt-out fails. So does a perfect unsubscribe link under an incomplete address.

What counts as valid

The standard is accurate and current. Move offices and the footer changes before the next send. A bounced physical address is not a defense, it is evidence.

If you also print and mail a physical component, the email footer and the mail piece should agree. Readers notice the mismatch before a regulator does.

From line, reply-to and domain

Your from line, reply-to address and domain must identify the sender accurately. You cannot send from a domain you do not control, and you cannot route replies to an address that bounces.

SPF, DKIM and DMARC are not CAN-SPAM requirements on their own. They are the practical proof that the domain in your header is yours, and bulk senders at major mailbox providers now face authentication expectations beyond the statute.

Sponsors and the address question

When a sponsor pays for a placement, the message is still yours. The footer address belongs to the sender of record, which is normally you, not the sponsor.

FTC endorsement guidance also applies to sponsored content, so a paid placement needs clear disclosure. That disclosure is separate from the CAN-SPAM footer. Both belong in the same issue.

Address changes and multi-state publishers

Publishers registered in one state and sending from another still follow the sender's address requirement. CAN-SPAM follows the sender, not the recipient's state.

Privacy law follows the recipient. California subscribers bring CCPA and CPRA duties onto that audience data. The footer is a small part of a larger data practice, and questions about it belong with a licensed attorney.

Subject lines, headers and the commercial definition

The commercial definition is broader than most publishers assume. A message is commercial if its primary purpose is advertising or promotion of a product, service or website. Newsletters with ads, affiliate links or paid tiers usually qualify.

Once a message is commercial, the content rules apply in full: no false or misleading header information, no deceptive subject line, and clear identification as an advertisement where required.

Subject lines must not mislead

The subject line has to reflect what is inside. A line promising a product review that delivers an affiliate pitch is deceptive, even if the body discloses the relationship.

Overstating the contents is the most common failure for small publishers. The fix is boring: write the subject line after the issue is drafted, not before.

Headers and routing

Header information covers the from name, from address, reply-to address and the routing attached to the message. All of it must be accurate and identify the sender.

You also cannot send through someone else's domain without permission. That rule catches publishers who borrow a partner's sending infrastructure for a co-branded issue.

The advertisement label

A commercial message needs clear and conspicuous identification as an advertisement unless the recipient already consented. Consent is the usual reason a newsletter footer does not scream ADVERTISEMENT.

Keep records of how consent was obtained. A double opt-in confirmation with a timestamp is the strongest version. A purchased list is the weakest, and the fastest route to a complaint.

Consent records and audience growth

Every subscriber you add will eventually receive a commercial message. The consent trail matters as much as the send, which is why newsletter audience growth and compliance are the same project.

If your signup flow does not record the source of each address, you cannot prove consent later. Add a source field to your form and keep it.

What 16 CFR Part 316 actually says

The FTC's rule at 16 CFR Part 316 is the operative text most senders should read first. It defines key terms, sets the opt-out mechanics and lists the aggravated violations that carry higher penalties.

The statute sits in 15 U.S. Code Chapter 103. Read the rule before the statute: it is shorter, and its definitions are the ones the FTC enforces.

The statute behind the rule

The CAN-SPAM Act of 2003 is the governing statute, and the FTC enforces it under 15 U.S. Code Chapter 103.

The Act reaches any person who initiates or procures a commercial message. That covers advertisers and list owners as well as the sender of record. A sponsor that pays for a placement, or a list owner that rents addresses, can face liability.

The Act does not require prior consent. A newsletter built on a purchased list still has to meet every other requirement.

What the rule defines

The rule defines commercial electronic mail message and the criteria for a message's primary purpose. It also defines sexually oriented material, which triggers additional labeling duties.

Primary purpose analysis looks at the subject line, the body and the placement of any advertisement. A newsletter that is mostly editorial but leads with sponsor copy can still have a commercial primary purpose.

Aggravated violations

The rule lists aggravated violations that raise civil penalties, including address harvesting and dictionary attacks, the tactics spammers use to build lists.

Buy a list from a vendor and ask how it was built. If the answer involves scraping, harvesting or automated address generation, you bought an aggravated violation along with the addresses.

Penalties and enforcement

The FTC enforces CAN-SPAM, and state attorneys general can also bring actions. Civil penalties are assessed per email, so list size multiplies exposure.

The FTC can seek civil penalties, or a court order to stop future mailings. A court may also order the sender to pay the government's costs.

CAN-SPAM sets a maximum civil penalty per email, and the FTC adjusts that maximum for inflation each year. In recent years the published maximum has run above $50,000 per email. Treat that as a typical range rather than a fixed price, and check the FTC's current civil penalty adjustment table before you quote a number.

There is no private right of action under the statute, so recipients cannot sue you under it directly. They can complain to the FTC, and they can sue under state law or other theories. The practical risk is regulatory attention plus deliverability damage.

The subscriber database is a business asset

The FTC's Data Security guidance is written for businesses holding personal information, and an email list qualifies.

Reasonable security means access controls, encryption where appropriate, and a plan for leaked credentials. A shared spreadsheet holding the whole list is not reasonable security. Neither is a platform login three former contractors still have.

State privacy law on top of the federal rule

California, Colorado and Washington have privacy statutes that touch audience data. They govern how you collect, store and delete subscriber information, which overlaps with CAN-SPAM without replacing it.

A deletion request under a state privacy law is not an unsubscribe request. Handle both, and log both. The suppression list covers the first; your data map covers the second. For how the statutes apply to your business, ask a licensed attorney.

Where the rules differ by place

CAN-SPAM is US federal law. It governs commercial email sent to or from a US address, and it preempts state email statutes. It does not preempt state laws on falsity or deception, so a misleading subject line can still draw a state action.

Every other jurisdiction runs its own regime. Canada requires consent for many commercial messages, and a US publisher sending to Canadian addresses should check those rules before it expands. A publisher can be compliant at home and non-compliant in a second market. Treat cross-border consent as a separate project, and take advice from a licensed attorney.

Records to keep

The statute sets no fixed retention period. What matters is that you can show what you did.

Keep four records: consent with a timestamp and source, every opt-out request with its arrival date, proof of when each request was honored, and a copy of each commercial send.

The content copy can be the rendered email and its footer. The suppression list is what proves the honoring step. A dated log of requests paired with the suppression list used on each send answers most questions the FTC would ask within ten business days.

Platforms keep some of this and lose some of it on export. Check what survives a migration before you need it.

Pre-send checklist

Run this before every commercial issue. It is written for a small US publisher on a standard email platform, with no legal department.

The 30-minute quarterly audit

That sequence catches the failures that matter most, and it is cheap. A publisher sending 50,000 emails a week can run it in half an hour per quarter.

Worked example: a sponsor issue that fails review

An 18,000 subscriber food newsletter sells a top-of-issue placement to a meal kit brand. The subject line reads "The five dinners our readers actually cook." The first 300 words are the sponsor's copy. The unsubscribe link sits below the sponsor block. The footer lists a city and state, no street address.

Three problems. The subject line does not reflect a message whose primary purpose is promoting a meal kit. The unsubscribe link is buried under advertising, which weakens the conspicuous requirement. The physical address is incomplete.

The fix is small. Rewrite the subject line to name the sponsor placement, move the unsubscribe link above the sponsor block, and add the street address. Then log the disclosure.

Why footer quality affects deliverability

Sloppy footers cost deliverability, and deliverability is what your sponsor rates rest on. Reading newsletter audience analytics for open and complaint rates tells you when a footer change is hurting.

Sponsors ask about list hygiene and consent before they sign.

What the platform has to record

Your newsletter platform should store the consent timestamp, the signup source and the unsubscribe event without custom work.

Ask vendors where the suppression list lives and how it survives an export. If the answer is vague, that is your answer. Building a loyal list is a long game, and grow a newsletter audience only pays off if the people you add stay subscribed and stay willing to hear from you.

Common questions

Does every newsletter need an unsubscribe link?

Yes, if the message is commercial. Transactional and relationship messages still need an opt-out mechanism under the FTC's reading of the statute. The safest habit is to include one in every issue you send.

Can I use a PO box as my physical postal address?

Yes. A registered PO box or commercial mail receiving address is valid as long as it is accurate, current and one you are registered to use. A city and state alone does not satisfy the requirement.

How fast must I honor an unsubscribe request?

Within 10 business days. The clock runs from receipt, so automate the path rather than routing requests through a human queue. Test the path quarterly with a fresh address.

Do I need to label my newsletter as an advertisement?

Only if it is commercial and the recipient has not consented. Clear and conspicuous identification is required in that case. Consent records are what let you skip the label, so keep them with a timestamp.

What are the penalties for a CAN-SPAM violation?

Civil penalties are assessed per email, and state attorneys general can also bring actions. The FTC is the primary federal enforcer. There is no private right of action under the statute.

Does CAN-SPAM apply to a newsletter I send from Canada or the UK?

It applies to commercial email sent to US recipients, so a foreign sender with American subscribers is covered by the same rules. Check your own jurisdiction's rules as well, and take advice from a licensed attorney on cross-border consent.