CAN-SPAM is a United States law, passed in 2003, that sets the rules for commercial email: what must be in the message, what must not be faked, and how people can stop receiving it. It does not ban unsolicited email, but it requires every commercial message to be honest about who sent it and to give the recipient a working way to opt out.
This page is a plain-language overview, not legal advice. Check the rules that apply to you and your recipients, especially if you email people outside the US, where other laws can be stricter.
Why it matters when you do outreach
Cold email to businesses is generally allowed in the US, which is why CAN-SPAM gets mentioned so often by agencies and freelancers. The catch is that the permission comes with conditions. Break them and each non-compliant email can be treated as a separate violation, with penalties that the FTC can pursue.
There is also a practical side. The things CAN-SPAM asks for, such as honest subject lines and an easy opt-out, are the same things that keep people from hitting the spam button. A clear unsubscribe link is far better for you than a complaint. Complaints hurt your spam complaint rate, and that drags down your email deliverability for every future campaign.
The core requirements
These are the well-established points of the law:
- Accurate header information. The From name, From address, Reply-To and routing must identify you or your business. No pretending to be someone else.
- No deceptive subject lines. The subject must reflect what the email is about. "Re: your invoice" on a first-touch sales email is a problem.
- Identify it as an ad, where relevant. The message must be recognizable as commercial. A plain, honest sales email usually does this naturally.
- A valid physical postal address. Your street address, a registered PO box or a private mailbox registered with a commercial mail receiving agency.
- A clear way to opt out. It must be easy to spot and use, and it must work for at least 30 days after you send.
- Honor opt-outs within 10 business days. You cannot charge a fee, ask for more than an email address, or make people jump through several pages.
- You stay responsible. Hiring someone to send for you does not move the obligation off your business.
A concrete example
Say you run a small marketing agency and want to pitch local roofers. Here is an email that fits the rules:
Subject: Quick idea for {{params.name}}'s Google reviews
Hi {{params.firstname}},
I looked at {{params.website}} and noticed your reviews stop in March. We help roofing companies in {{params.city}} ask happy customers for reviews right after a job. Worth a 10-minute call?
Sam Patel, Northline Marketing 412 Main St, Suite 3, Denver, CO 80202 Don't want emails like this? Unsubscribe here.
Why it works: the subject matches the content, the sender is a real person at a named business, there is a real postal address, and the unsubscribe link is visible. It is also short, which helps replies (short cold emails win for this reason).
Now the bad version: subject "Re: our call yesterday" when there was no call, sent from "Google Support", no address, and the only opt-out is "reply STOP and we'll consider it." That hits several violations at once.
Common mistakes
Fake "Re:" or "Fwd:" subjects. They feel clever and they are deceptive. Skip them.
Leaving out the address. Freelancers often skip it because they work from home. A registered PO box or virtual mailbox solves the privacy concern.
An opt-out that only works sometimes. "Reply to unsubscribe" can be acceptable, but only if someone actually processes every reply. A link is more reliable.
Re-adding people who opted out. Importing a fresh list from a new source can quietly bring back someone who unsubscribed months ago. Keep a suppression list and check against it.
Following up after an opt-out. An automated sequence that keeps running after someone says no is both a legal and a reputational problem. Decide your stopping rules in advance; see when to stop following up.
Assuming CAN-SPAM covers everyone. If your list includes Canada, the UK or the EU, those places have their own rules, often stricter about consent.
What to do next
- Add a signature block template with your name, business name and postal address, and use it in every campaign.
- Put an unsubscribe link in every step, including follow-ups, not just the first email.
- Audit your subject lines for anything that implies a prior relationship that does not exist.
- Keep one suppression list that every campaign checks before sending.
- Clean your list before sending. Verifying addresses keeps your email bounce rate down, which is separate from CAN-SPAM but protects the same sending reputation.
If you want this handled in one place, GetClient campaigns include a one-click unsubscribe link with a signed URL per recipient, and unsubscribed addresses are skipped automatically in later sends. You can also verify a list before sending. New accounts start with free credits; details are on plans and credits.