What you need to know
The FTC’s CAN-SPAM guide says the law covers all commercial email, including business-to-business messages, requires accurate headers, honest subject lines, ad disclosure, a postal address and a working opt-out honored within 10 business days, and holds both the advertiser and the sender responsible.
Potentially affected
Businesses that send promotional email, newsletters or product announcements to customers or prospects, including security and IT service companies, and the marketing platforms or agencies that send on their behalf.
DSE recommendation
DSE recommends reviewing every marketing email template and sending platform against CAN-SPAM’s requirements before the next campaign.
The FTC’s CAN-SPAM guide says the law covers all commercial email, including business-to-business messages, requires accurate headers, honest subject lines, ad disclosure, a postal address and a working opt-out honored within 10 business days, and holds both the advertiser and the sender responsible.
Source facts
The FTC’s CAN-SPAM compliance guide says the law doesn’t apply just to bulk email but covers all commercial messages, and makes no exception for business-to-business email. Each separate email in violation is subject to penalties of up to $53,088, and both the company whose product is promoted and the company that sends the message may be held legally responsible.
Requirements include accurate header and routing information, subject lines that accurately reflect the content, a clear and conspicuous disclosure that the message is an advertisement, a valid physical postal address, and a clear way to opt out of future marketing email. Opt-out mechanisms must work for at least 30 days after sending, requests must be honored within 10 business days, and opted-out addresses cannot be sold or transferred.
Messages whose primary purpose is transactional or relationship, such as confirming an agreed transaction or giving warranty, recall, safety or security information about a product the recipient bought, are exempt from most provisions but may not contain false or misleading routing information. The FTC says these categories are viewed narrowly.
Applicability
Use this for any commercial email your organization or its vendors send. The guide summarizes federal law; state laws and the sender requirements of mailbox providers may add obligations.
DSE recommendation
DSE recommends reviewing every marketing email template and sending platform against CAN-SPAM’s requirements before the next campaign. Put the postal address and an unsubscribe link in each template, test that unsubscribes are processed well within 10 business days and suppressed across every list and platform, and keep service notices about products customers bought separate from promotions so their primary purpose stays clear.
Verification
Each quarter, send a test campaign to a monitored address, unsubscribe, and confirm the address is suppressed everywhere within the required time. Review agency and platform contracts to confirm they follow your suppression list.
Official reference
Federal Trade Commission — CAN-SPAM Act: A Compliance Guide for Business. Reviewed October 18, 2026.
Review the official source
Federal Trade Commission — CAN-SPAM Act: A Compliance Guide for Business · Verified October 18, 2026
Need help applying this guidance safely?
DSE can help confirm applicability, protect service continuity, and validate the result across physical security and IT systems.
Talk with DSE