There is no single “email marketing code” in the United States. A US sender answers to a federal anti-spam law, a separate federal law for texts and calls, a fast-growing set of state privacy statutes and, depending on the industry, sector rules on health or financial data. This overview explains how the layers fit together so you know which questions to ask. It is general information, not legal advice.
Layer 1: CAN-SPAM for commercial email
The CAN-SPAM Act of 2003 sets the baseline for every commercial email sent to a US recipient. It is an opt-out law: you may send a first promotional message without prior consent, provided the email uses accurate headers and a truthful subject line, is identified as an ad where required, shows your physical postal address and includes an opt-out you honor within 10 business days. The FTC enforces it with civil penalties of up to $53,088 per violating email, the 2025 level that remains in force for 2026. For the requirement-by-requirement detail, read is email marketing legal in the US? or our glossary entry on CAN-SPAM.
Layer 2: the TCPA for text messages
SMS is regulated separately, by the Telephone Consumer Protection Act (TCPA) and the rules of the Federal Communications Commission. Marketing texts sent with automated systems need the recipient’s prior express written consent, a signed (electronic signatures count) agreement that clearly says they will receive marketing messages. The TCPA gives consumers a private right of action with statutory damages of $500 per message, and up to $1,500 when the violation is willful or knowing, which is why class actions over texting are common.
Since April 2025, FCC rules also require businesses to accept opt-outs made by any reasonable means, including replies such as “stop”, “quit” or “unsubscribe”, and to process them within 10 business days. A further rule treating one opt-out as covering all of a sender’s unrelated messages has been postponed to January 2027. On top of the law, US carriers require business senders to register through the A2P 10DLC system or use verified toll-free numbers or short codes. Some states, such as Florida and Oklahoma, have their own texting laws with stricter rules.
Layer 3: state privacy laws
California led with the CCPA, as amended by the CPRA, which gives residents rights to know, delete and correct their personal data and to opt out of its sale or sharing. About twenty states have since passed comprehensive privacy laws, including Virginia, Colorado, Connecticut, Utah and Texas, with more taking effect each year. These laws rarely ban email marketing, but they shape what you must disclose at the point of collection, how you respond to access or deletion requests and what contracts you sign with service providers such as your email platform.
What about state anti-spam laws?
Before 2003, many states passed their own anti-spam statutes. CAN-SPAM largely preempts them, but not entirely: state rules that prohibit falsity or deception in commercial email survive. In practice, if your emails are honest about who you are and what you offer, and you meet the federal requirements, state anti-spam laws rarely add obligations. State privacy and texting laws are a different matter and deserve closer attention.
Layer 4: sector and audience rules
- Healthcare: organizations covered by HIPAA face restrictions on using patient information for marketing.
- Financial services: the Gramm-Leach-Bliley Act governs how customer financial data is shared.
- Children: collecting personal information online from children under 13 triggers COPPA.
Layer 5: recipients outside the US
American law is permissive by international standards. If you mail Canadians, CASL requires consent first; our page on Canadian email law explains it. If you mail people in the EU or UK, the GDPR (or UK GDPR) applies even though your company is based in the US; see does the GDPR apply to a company outside Europe?
Where your data lives: the CLOUD Act question
The CLOUD Act of 2018 lets US authorities require American providers to hand over data they control, even when it is stored abroad. If your email platform is a US company, your subscriber data is within that reach. Mailpro is Swiss and hosts data in Switzerland on private infrastructure, outside US jurisdiction. Our FAQ is my email marketing data subject to US law? explains the difference, which matters most to US firms serving European clients or handling sensitive lists.
Records worth keeping
Whatever the law, documentation is your best defense. Keep, for each contact, the date and source of sign-up, the consent wording shown at the time, any SMS consent separately, and the date of any opt-out. Keep copies of the templates you sent, including the footer with your postal address. If an agency or affiliate mails on your behalf, keep the contract and check their practices, since CAN-SPAM can hold both parties responsible.
A compliance checklist for US senders
- Map which of your audiences are in the US, Canada, the EU or elsewhere.
- Build permission-based sign-up even where the law allows opt-out.
- Collect SMS consent separately, with explicit written wording.
- Add your postal address and a working unsubscribe link to every template.
- Keep records of when and how each contact subscribed.
- Review your privacy notice for the states where your customers live.
Mailpro takes care of the mechanics: an unsubscribe management system that suppresses opt-outs automatically, double opt-in forms, sender authentication and Swiss hosting. The legal judgment calls remain yours, so involve counsel for anything unusual.