CAN-SPAM Compliance

What is CAN-SPAM compliance?

The CAN-SPAM Act, or the Controlling the Assault of Non-Solicited Pornography And Marketing Act, is a U.S. law that establishes standards for the sending of commercial email by businesses. The law is designed to curb the proliferation of spam emails and provides rules to protect consumers from misleading or deceptive content. To achieve compliance, businesses must adhere to specific practices in both the content and management of email communications. Compliance is not just about policy - it requires tangible adjustments in how businesses disseminate email marketing messages.

The purpose of CAN-SPAM is to give recipients the right to stop unwanted emails and creates penalties for businesses that don't follow the rules. Compliance requires that emails are accurately labelled, provide clear opt-out instructions, and are sent only with the prior consent of the recipient where applicable. Understanding and applying these requirements ensures not only legal compliance but also fosters trust with a business’s audience.

Who must comply with CAN-SPAM?

All commercial email sent to U.S. recipients must comply with the CAN-SPAM Act, regardless of the sender's location or business size. The law applies broadly to any 'commercial electronic mail message' that the primary purpose promotes a product or service, which means almost any email sent by a business.

No revenue or size thresholds exempt a business from compliance with the CAN-SPAM Act - even small businesses and non-profit organizations must adhere to the guidelines. The determining factor for regulation applicability is the email’s content, not the business type or revenue size. Therefore, any entity that sends promotional emails should ensure they're following the required standards to avoid penalties.

Key requirements and obligations

• Honest Subject Lines: Email subject lines must accurately reflect the content of the message, preventing misleading or deceptive titles.
• Valid Physical Address: All emails must include a valid physical postal address of the business to indicate that the sender is real and accountable.
• Clear Opt-Out Instructions: Every email must include a clear and conspicuous opt-out mechanism that allows recipients to easily unsubscribe from future emails.
• Prompt Unsubscribe Compliance: Businesses must honor opt-out requests within 10 days, and they cannot charge a fee for processing these requests.
• Identify the Message as an Advertisement: All marketing emails must be labeled as an advertisement.

These requirements ensure that recipients have control over their inboxes and protect them from misleading content, benefiting both the consumer and legitimately operating businesses.

Penalties and fines for non-compliance

Non-compliance with the CAN-SPAM Act can result in significant penalties. Civil penalties can reach up to $46,517 per each individual email that violates the law. Moreover, there is no ceiling on the total fine amount that can be imposed based on violations, meaning businesses can face substantial financial repercussions for mass violations.

In addition, there is a private right of action, allowing internet service providers to sue spammers for damages. This further increases the potential liability for those not adhering to CAN-SPAM guidelines. It is vital for businesses to audit their email practices regularly to ensure they are not at risk of such financial losses and legal challenges.

Any major amendment or closely related law

While the CAN-SPAM Act primarily governs commercial emails, businesses should also be aware of state-level privacy laws that may impose additional requirements. The state of California, for example, has the California Consumer Privacy Act (CCPA), which regulates data collection and transparency practices and can apply to email lists gathered from California residents. Though primarily focused on data privacy, complementary awareness of the CCPA will support CAN-SPAM compliance by managing how data is collected for marketing purposes.

How to check if your website is compliant

Businesses should perform regular checks on their email practices to verify compliance with CAN-SPAM. Key steps include reviewing the content of emails for accurate subject lines, ensuring opt-out instructions are clear, and monitoring the timely processing of unsubscribe requests. Periodically audit the presence of a valid physical address in each email and confirm all your staff members are trained in compliance requirements. Implementing periodic checks can help maintain compliance and demonstrate a commitment to ethical email marketing practices.

Complyy tests these continuously from the outside and captures timestamped evidence.