CAN-SPAM sets conduct rules for email, not a ban on sending it

The revenue mechanism

On 16 December 2003, the United States enacted the Controlling the Assault of Non-Solicited Pornography and Marketing Act, the first federal law setting nationwide conduct rules for commercial email, according to the enrolled statute published by the Government Publishing Office. The law did not ban unsolicited commercial email outright. Instead it set operating requirements: a sender must not falsify header or routing information, must identify a message clearly as an advertisement, must give a valid physical postal address, and must provide a working opt-out mechanism that it then honors within a set number of days. Newsletter and marketing senders still build their sending infrastructure around these baseline mechanics two decades later, whatever email platform they use.

What the documents show

The enrolled statute itself confirms the law is a conduct code, not a prohibition, and sets out the header, labeling, address and opt-out requirements a sender must follow. The Federal Trade Commission's own compliance guide, current as retrieved 16 September 2026, restates those requirements in plain terms and adds an operational detail the statute leaves to regulatory rulemaking: an opt-out mechanism must keep working for at least thirty days, and a sender must honor a received opt-out within ten business days. That guide also states a current maximum civil penalty of just over fifty-three thousand dollars per violating email, a figure the FTC updates periodically for inflation rather than one fixed by the 2003 statute itself.

The assumptions exposed

A newsletter publisher who assumes the law requires prior opt-in consent before sending any commercial email is reading in a rule the statute does not contain; CAN-SPAM is an opt-out regime for most commercial mail, a distinction that still surprises senders used to opt-in rules elsewhere. The per-email penalty figure quoted today is a living, inflation-adjusted number maintained by the FTC, not the amount that applied when the law took effect, so a source citing a specific dollar penalty should be checked against the date it describes. The law also preempts most state-level anti-spam statutes for commercial email, which the compliance guide notes but does not detail state by state.

What to check before you rely on it

This is an editorial checklist for a newsletter operator relying on a secondary summary of the law rather than the statute or the FTC's own guide.

• Does the summary correctly describe CAN-SPAM as an opt-out regime rather than requiring prior consent?
• Is a cited penalty figure dated to the period being discussed, given periodic inflation adjustments?
• Does the guidance distinguish federal CAN-SPAM requirements from separate rules a platform or another country's law may add on top?

What a publisher can rely on directly from these two documents is narrow but durable: identify the sender honestly, label the message as an ad when it is one, and make opting out simple and fast, requirements the statute has carried unchanged since 2003 even as the surrounding penalty figures and platform rules have moved.