Short answer: yes. Unlike the European Union or Canada, the United States does not require a recipient’s prior permission before you send a commercial email. Instead, federal law sets rules for how that email is built and gives every recipient the right to say “stop”. That law is the Controlling the Assault of Non-Solicited Pornography And Marketing Act of 2003, better known as the CAN-SPAM Act, and it is enforced by the Federal Trade Commission (FTC).
This page is general information, not legal advice. For decisions about your own program, speak to a US attorney.
Which emails CAN-SPAM covers
The law applies to any “commercial electronic mail message”: an email whose primary purpose is to advertise or promote a product or service. It makes no exception for business-to-business email, so a sales email to a purchasing manager is covered just like a promotion to a consumer.
Transactional or relationship messages, such as order confirmations, shipping notices, account statements or warranty information, are largely exempt, but they still may not contain false or misleading routing information. When a message mixes both, the subject line and the content at the top decide which it is. If a reasonable reader would see it as an ad, treat it as one.
The seven requirements, one by one
- Accurate header information. “From”, “To”, “Reply-To” and routing data must be accurate and identify the person or business that initiated the message.
- A subject line that is not deceptive. It must reflect the content of the email.
- Identify the message as an ad. You have flexibility in how you do it, but the disclosure must be clear and conspicuous. The rule does not apply when the recipient has given affirmative consent.
- Tell recipients where you are located. Include a valid physical postal address: a street address, a post office box registered with the US Postal Service, or a private mailbox registered with a commercial mail receiving agency.
- Explain how to opt out. The opt-out must be clear, easy to use and able to process requests for at least 30 days after you send.
- Honor opt-outs promptly. Within 10 business days. You cannot charge a fee, ask for more than an email address, or make people visit more than one page to unsubscribe, and you cannot sell or transfer the address afterwards.
- Monitor what others do on your behalf. If you hire an agency or affiliate, both the company whose product is promoted and the company that sends the message can be held legally responsible.
Penalties and who enforces them
Each separate email that violates the law can bring a civil penalty of up to $53,088. That figure is adjusted for inflation each year, but the FTC confirmed it would keep its 2025 amounts unchanged for 2026 after the October 2025 government shutdown interrupted the inflation data it relies on. Because the penalty is counted per email, a single non-compliant campaign to a large list can create very serious exposure.
The FTC is not the only enforcer. State attorneys general can bring cases, and internet access providers can sue spammers who abuse their networks. Some practices, such as falsifying headers, hijacking other people’s computers to send mail, or harvesting addresses, can also lead to criminal charges.
Federal law, state law and the mobile rule
CAN-SPAM preempts most state anti-spam statutes, except where they target falsity or deception. Separately, the Federal Communications Commission bans commercial email sent to wireless-carrier email domains (addresses that deliver as text messages to a phone) without express prior authorization. Marketing texts themselves fall under a different law, the TCPA, covered on our page about SMS marketing in the US.
Legal is not the same as welcome
Staying within CAN-SPAM keeps you out of court, but it does not get you into the inbox. Since 2024, Gmail and Yahoo have required bulk senders to authenticate their domains, offer one-click unsubscribe and keep spam complaint rates low; see our summary of the Gmail and Yahoo sender requirements. In practice, the safest program is one built on consent, even though US law does not demand it. Our page on getting permission to send campaigns shows how.
Emailing people outside the US
If your list includes Canadians, Canada’s anti-spam law (CASL) requires consent before you send. For people in the EU or UK, the GDPR (or UK GDPR) and local ePrivacy rules apply. See our overview of Canadian email law and our GDPR compliance page before you mail across borders.
How Mailpro helps you comply
Every Mailpro campaign includes an unsubscribe link, and opt-outs are applied to your contacts automatically, well within the 10-business-day window. You can place your postal address in the template footer, keep an accurate sender name and reply-to address, and set up SPF, DKIM and DMARC for your domain. Your lists are hosted in Switzerland, outside US jurisdiction, and are never sold or rented.