The FTC’s CAN-SPAM guide says the law covers all commercial email, including business-to-business messages, requires accurate headers, honest subject lines, ad disclosure, a postal address and a working opt-out honored within 10 business days, and holds both the advertiser and the sender responsible.
\nThe FTC’s CAN-SPAM compliance guide says the law doesn’t apply just to bulk email but covers all commercial messages, and makes no exception for business-to-business email. Each separate email in violation is subject to penalties of up to $53,088, and both the company whose product is promoted and the company that sends the message may be held legally responsible.
\nRequirements include accurate header and routing information, subject lines that accurately reflect the content, a clear and conspicuous disclosure that the message is an advertisement, a valid physical postal address, and a clear way to opt out of future marketing email. Opt-out mechanisms must work for at least 30 days after sending, requests must be honored within 10 business days, and opted-out addresses cannot be sold or transferred.
\nMessages whose primary purpose is transactional or relationship, such as confirming an agreed transaction or giving warranty, recall, safety or security information about a product the recipient bought, are exempt from most provisions but may not contain false or misleading routing information. The FTC says these categories are viewed narrowly.
\nUse this for any commercial email your organization or its vendors send. The guide summarizes federal law; state laws and the sender requirements of mailbox providers may add obligations.
\nDSE recommends reviewing every marketing email template and sending platform against CAN-SPAM’s requirements before the next campaign. Put the postal address and an unsubscribe link in each template, test that unsubscribes are processed well within 10 business days and suppressed across every list and platform, and keep service notices about products customers bought separate from promotions so their primary purpose stays clear.
\nEach quarter, send a test campaign to a monitored address, unsubscribe, and confirm the address is suppressed everywhere within the required time. Review agency and platform contracts to confirm they follow your suppression list.
\nFederal Trade Commission — CAN-SPAM Act: A Compliance Guide for Business. Reviewed October 18, 2026.
", "content_text": "The FTC’s CAN-SPAM guide says the law covers all commercial email, including business-to-business messages, requires accurate headers, honest subject lines, ad disclosure, a postal address and a working opt-out honored within 10 business days, and holds both the advertiser and the sender responsible.\nSource facts\nThe FTC’s CAN-SPAM compliance guide says the law doesn’t apply just to bulk email but covers all commercial messages, and makes no exception for business-to-business email. Each separate email in violation is subject to penalties of up to $53,088, and both the company whose product is promoted and the company that sends the message may be held legally responsible.\nRequirements include accurate header and routing information, subject lines that accurately reflect the content, a clear and conspicuous disclosure that the message is an advertisement, a valid physical postal address, and a clear way to opt out of future marketing email. Opt-out mechanisms must work for at least 30 days after sending, requests must be honored within 10 business days, and opted-out addresses cannot be sold or transferred.\nMessages whose primary purpose is transactional or relationship, such as confirming an agreed transaction or giving warranty, recall, safety or security information about a product the recipient bought, are exempt from most provisions but may not contain false or misleading routing information. The FTC says these categories are viewed narrowly.\nApplicability\nUse this for any commercial email your organization or its vendors send. The guide summarizes federal law; state laws and the sender requirements of mailbox providers may add obligations.\nDSE recommendation\nDSE recommends reviewing every marketing email template and sending platform against CAN-SPAM’s requirements before the next campaign. Put the postal address and an unsubscribe link in each template, test that unsubscribes are processed well within 10 business days and suppressed across every list and platform, and keep service notices about products customers bought separate from promotions so their primary purpose stays clear.\nVerification\nEach quarter, send a test campaign to a monitored address, unsubscribe, and confirm the address is suppressed everywhere within the required time. Review agency and platform contracts to confirm they follow your suppression list.\nOfficial reference\nFederal Trade Commission — CAN-SPAM Act: A Compliance Guide for Business. Reviewed October 18, 2026.", "content_markdown": "The FTC’s CAN-SPAM guide says the law covers all commercial email, including business-to-business messages, requires accurate headers, honest subject lines, ad disclosure, a postal address and a working opt-out honored within 10 business days, and holds both the advertiser and the sender responsible.\n\n## Source facts\n\nThe FTC’s [CAN-SPAM compliance guide](https://www.ftc.gov/business-guidance/resources/can-spam-act-compliance-guide-business) says the law doesn’t apply just to bulk email but covers all commercial messages, and makes no exception for business-to-business email. Each separate email in violation is subject to penalties of up to $53,088, and both the company whose product is promoted and the company that sends the message may be held legally responsible.\n\nRequirements include accurate header and routing information, subject lines that accurately reflect the content, a clear and conspicuous disclosure that the message is an advertisement, a valid physical postal address, and a clear way to opt out of future marketing email. Opt-out mechanisms must work for at least 30 days after sending, requests must be honored within 10 business days, and opted-out addresses cannot be sold or transferred.\n\nMessages whose primary purpose is transactional or relationship, such as confirming an agreed transaction or giving warranty, recall, safety or security information about a product the recipient bought, are exempt from most provisions but may not contain false or misleading routing information. The FTC says these categories are viewed narrowly.\n\n## Applicability\n\nUse this for any commercial email your organization or its vendors send. The guide summarizes federal law; state laws and the sender requirements of mailbox providers may add obligations.\n\n## DSE recommendation\n\nDSE recommends reviewing every marketing email template and sending platform against CAN-SPAM’s requirements before the next campaign. Put the postal address and an unsubscribe link in each template, test that unsubscribes are processed well within 10 business days and suppressed across every list and platform, and keep service notices about products customers bought separate from promotions so their primary purpose stays clear.\n\n## Verification\n\nEach quarter, send a test campaign to a monitored address, unsubscribe, and confirm the address is suppressed everywhere within the required time. Review agency and platform contracts to confirm they follow your suppression list.\n\n## Official reference\n\n[Federal Trade Commission — CAN-SPAM Act: A Compliance Guide for Business](https://www.ftc.gov/business-guidance/resources/can-spam-act-compliance-guide-business). Reviewed October 18, 2026." }, "json_ld": { "@context": "https://schema.org", "@graph": [ { "@type": "Organization", "@id": "https://dsesecurity.com/#organization", "name": "Detection Systems & Engineering", "alternateName": "DSE Security", "url": "https://dsesecurity.com/", "logo": { "@type": "ImageObject", "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20" } }, { "@type": "Organization", "@id": "https://update.dsesecurity.com/#editorial-team", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/", "parentOrganization": { "@id": "https://dsesecurity.com/#organization" } }, { "@type": "WebSite", "@id": "https://update.dsesecurity.com/#website", "name": "DSE Updates", "alternateName": "DSE Security Knowledge Hub", "url": "https://update.dsesecurity.com/", "inLanguage": "en-US", "publisher": { "@id": "https://dsesecurity.com/#organization" }, "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@type": "WebPage", "@id": "https://update.dsesecurity.com/updates/can-spam-act-business-email-opt-out-10-business-days-requirements/", "url": "https://update.dsesecurity.com/updates/can-spam-act-business-email-opt-out-10-business-days-requirements/", "isPartOf": { "@id": "https://update.dsesecurity.com/#website" }, "lastReviewed": "2026-10-18" }, { "@type": "BreadcrumbList", "@id": "https://update.dsesecurity.com/updates/can-spam-act-business-email-opt-out-10-business-days-requirements/#breadcrumbs", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "DSE Updates", "item": "https://update.dsesecurity.com/" }, { "@type": "ListItem", "position": 2, "name": "CAN-SPAM covers business-to-business marketing email too: identify ads, give an address and honor opt-outs in 10 days", "item": "https://update.dsesecurity.com/updates/can-spam-act-business-email-opt-out-10-business-days-requirements/" } ] }, { "@type": [ "Article", "TechArticle" ], "@id": "https://update.dsesecurity.com/updates/can-spam-act-business-email-opt-out-10-business-days-requirements/#article", "identifier": "https://update.dsesecurity.com/updates/can-spam-act-business-email-opt-out-10-business-days-requirements/", "url": "https://update.dsesecurity.com/updates/can-spam-act-business-email-opt-out-10-business-days-requirements/", "headline": "CAN-SPAM covers business-to-business marketing email too: identify ads, give an address and honor opt-outs in 10 days", "description": "The FTC’s CAN-SPAM guide says the law covers all commercial email, including business-to-business messages, requires accurate headers, honest subject…", "abstract": "The FTC’s CAN-SPAM guide says the law covers all commercial email, including business-to-business messages, requires accurate headers, honest subject lines, ad disclosure, a postal address and a working opt-out honored within 10 business days, and holds both the advertiser and the sender responsible.", "articleBody": "The FTC’s CAN-SPAM guide says the law covers all commercial email, including business-to-business messages, requires accurate headers, honest subject lines, ad disclosure, a postal address and a working opt-out honored within 10 business days, and holds both the advertiser and the sender responsible.\nSource facts\nThe FTC’s CAN-SPAM compliance guide says the law doesn’t apply just to bulk email but covers all commercial messages, and makes no exception for business-to-business email. Each separate email in violation is subject to penalties of up to $53,088, and both the company whose product is promoted and the company that sends the message may be held legally responsible.\nRequirements include accurate header and routing information, subject lines that accurately reflect the content, a clear and conspicuous disclosure that the message is an advertisement, a valid physical postal address, and a clear way to opt out of future marketing email. Opt-out mechanisms must work for at least 30 days after sending, requests must be honored within 10 business days, and opted-out addresses cannot be sold or transferred.\nMessages whose primary purpose is transactional or relationship, such as confirming an agreed transaction or giving warranty, recall, safety or security information about a product the recipient bought, are exempt from most provisions but may not contain false or misleading routing information. The FTC says these categories are viewed narrowly.\nApplicability\nUse this for any commercial email your organization or its vendors send. The guide summarizes federal law; state laws and the sender requirements of mailbox providers may add obligations.\nDSE recommendation\nDSE recommends reviewing every marketing email template and sending platform against CAN-SPAM’s requirements before the next campaign. Put the postal address and an unsubscribe link in each template, test that unsubscribes are processed well within 10 business days and suppressed across every list and platform, and keep service notices about products customers bought separate from promotions so their primary purpose stays clear.\nVerification\nEach quarter, send a test campaign to a monitored address, unsubscribe, and confirm the address is suppressed everywhere within the required time. Review agency and platform contracts to confirm they follow your suppression list.\nOfficial reference\nFederal Trade Commission — CAN-SPAM Act: A Compliance Guide for Business. Reviewed October 18, 2026.", "datePublished": "2026-10-18T21:00:57+00:00", "dateModified": "2026-10-18T22:22:07+00:00", "mainEntityOfPage": { "@id": "https://update.dsesecurity.com/updates/can-spam-act-business-email-opt-out-10-business-days-requirements/" }, "inLanguage": "en-US", "isAccessibleForFree": true, "author": { "@type": "Organization", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team" }, "publisher": { "@id": "https://dsesecurity.com/#organization" }, "image": { "@type": "ImageObject", "@id": "https://update.dsesecurity.com/updates/can-spam-act-business-email-opt-out-10-business-days-requirements/#primaryimage", "url": "https://update.dsesecurity.com/assets/editorial/cyber-defense-social-v2.jpg?v=1.8.20", "contentUrl": "https://update.dsesecurity.com/assets/editorial/cyber-defense-social-v2.jpg?v=1.8.20", "width": 1200, "height": 630, "caption": "CAN-SPAM covers business-to-business marketing email too: identify ads, give an address and honor opt-outs in 10 days" }, "articleSection": [ "Cybersecurity", "IT" ], "keywords": [ "Cybersecurity", "IT", "Checklist", "Advisory priority" ], "genre": "Checklist", "about": [ { "@type": "Thing", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "@type": "Thing", "name": "IT", "url": "https://update.dsesecurity.com/topic/it/" } ], "wordCount": 364, "timeRequired": "PT2M", "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usageInfo": "https://update.dsesecurity.com/usage/", "copyrightHolder": { "@id": "https://dsesecurity.com/#organization" }, "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "citation": { "@type": "CreativeWork", "name": "Federal Trade Commission — CAN-SPAM Act: A Compliance Guide for Business", "url": "https://www.ftc.gov/business-guidance/resources/can-spam-act-compliance-guide-business" } } ] } }