# CAN-SPAM Act: Definition and How It Works

Source: https://wraps.dev/glossary/can-spam

CAN-SPAM is the 2003 US federal law, enforced by the FTC, that requires accurate sender information, a working opt-out mechanism honored within 10 business days, and a valid physical postal address in commercial email.

## It's an opt-out law, not an opt-in one

Unlike GDPR, CAN-SPAM does not require consent before the first commercial message — a sender can legally send unsolicited commercial email to a US recipient with no prior relationship, as long as everything else the law requires is present. What CAN-SPAM actually mandates is honesty about the message and a genuine ability to stop future ones, not permission to start.

## The specific, checkable requirements

Header information (From, Reply-To, routing data) has to be accurate and not misleading; the subject line can't be deceptive about the message's content; the message has to clearly and conspicuously disclose that it's an advertisement or solicitation where that applies (15 U.S.C. §7704(a)(5)(A)) — silence isn't a safe default; every commercial message needs a clear and conspicuous way to opt out; opt-out requests have to be honored within 10 business days and can't require anything beyond a reply email or a single visit to a webpage; and every message needs a valid physical postal address for the sender.

## Non-compliance carries real, per-message penalties

The FTC can pursue civil penalties per violation, and each individual non-compliant email sent can count as a separate violation rather than the whole campaign counting as one — which is why a systemic gap (a missing physical address on a template used for thousands of sends) is a materially bigger exposure than an isolated mistake.

## Where it stops covering an audience

CAN-SPAM only governs commercial email to recipients in the US and only addresses the requirements listed above — it says nothing about consent for EU recipients, who fall under GDPR instead, and a global sending list needs to satisfy the stricter of the two regimes for whichever segment of the list each rule actually applies to, rather than picking one law and assuming it covers everyone.

## Why it matters

CAN-SPAM's requirements are minimums, not aspirational best practices, and every one of them is externally checkable — a missing opt-out mechanism or a fabricated physical address is not a judgment call, it's a specific, provable gap that a regulator, or a plaintiff's attorney in some private-right-of-action cases, can point to directly.

## Common questions

### Does CAN-SPAM require permission before I send someone a marketing email?

No. CAN-SPAM is opt-out based — it permits sending unsolicited commercial email as long as the message is honest, includes a working opt-out, and honors that opt-out within 10 business days. It does not require prior consent the way GDPR does.

### How quickly do I have to honor a CAN-SPAM opt-out request?

Within 10 business days, and the opt-out mechanism itself can't require more than a reply email or a single webpage visit to complete — a multi-step process or a required login is itself a compliance problem.

### Does CAN-SPAM apply to my emails to EU customers?

CAN-SPAM applies to commercial email sent to US recipients. EU recipients fall under GDPR's stricter, consent-based rules instead, so a sending list with both audiences has to satisfy each regime for the segment it actually governs.