Editorial · August 16, 2013
CAN-SPAM Requirements: A Checklist for Email Senders
CAN-SPAM requirements come down to seven main rules for any commercial email. Keep the header and subject line honest, and label the message as an ad. Show a valid postal address, explain how to opt out, honor opt-outs within 10 business days, and watch what others do for you. The Federal Trade Commission (FTC) lists the same seven, in this order, in its guide for business.
The rules come from the CAN-SPAM Act of 2003. It became law on December 16, 2003, and its email rules took effect on January 1, 2004.
Which emails the rules cover
Despite its name, the law reaches beyond bulk email. It covers every commercial message. The Act defines that as an email whose primary purpose is the commercial advertisement or promotion of a commercial product or service. Messages that point readers to content on a commercial website fall in the same group. According to the FTC, business-to-business email gets no special pass. A note to former customers announcing a new product line must comply.
A transactional or relationship message is different. It might confirm a transaction the reader already agreed to, or give warranty, recall, safety or security information. The FTC says it may not contain false or misleading routing information, but is otherwise exempt from most of the Act. When a message mixes both kinds of content, the primary purpose decides. By the FTC's test, it is commercial if a reasonable reader would likely conclude from the subject line that the message contains an ad or promotion. It is also commercial if the transactional part does not appear mainly at the start.
Rules 1 to 3: honest headers, subject lines and labels
Rule 1: no false or misleading header information. The FTC says the "From," "To" and "Reply-To" lines and the routing details, including the originating domain name and email address, must be accurate. Together they should show who really started the message, whether a person or a business.
Rule 2: no deceptive subject lines. The FTC puts it this way: a subject line cannot mislead readers about what the email says inside.
Rule 3: identify the message as an ad. The FTC says senders may choose their own method for flagging an ad. Whatever you pick, the notice must be clear and conspicuous. The Act does not require the ad label when the reader has given prior affirmative consent. For consent to count, the person must have expressly agreed to get the message when clearly and conspicuously asked, or on their own. If the consent went to another company, the person needed clear and conspicuous notice at that time that the address could be passed to you for commercial email.
Rules 4 and 5: a postal address and a clear opt-out
Rule 4: tell readers where you are by including a valid physical postal address. The FTC accepts three kinds:
- your current street address
- a post office box you have registered with the U.S. Postal Service
- a private mailbox you have registered with a commercial mail receiving agency set up under Postal Service rules
The 2008 FTC rule adds that a box counts only if you have accurately registered it.
Rule 5: explain how to opt out. Add a clear and conspicuous notice that is easy for an ordinary person to recognize, read and understand. Give a return email address or another easy Internet-based way for people to tell you their choice. A menu of message types is fine. But it must include the option to stop all commercial messages from you. Keep that method working for a minimum of 30 days from the day the message goes out.
Rule 6: honor opt-outs within 10 business days
Rule 6: stop sending when someone asks. The Act gives you 10 business days after you receive an opt-out request sent through the method you offered. Once those days pass, it is unlawful to send a commercial message the request covers. The FTC calls this period a grace period. In 2005 it proposed cutting the period to three business days. When it issued its rule, effective July 7, 2008, it declined and said the grace period "remains ten business days."
The 2008 rule also limits what you can demand from someone who opts out. You may not require a person to:
- pay a fee
- give more than an email address and opt-out preferences
- take any step beyond sending a reply email or visiting a single web page
After someone opts out, you cannot sell or transfer the address, even in a mailing list. The FTC names one exception: a company you hired to help you comply. The Act lifts both bans, on sending and on transferring the address, if the person later gives affirmative consent.
Rule 7: watch your vendors, and know the penalties
Rule 7: monitor what others do on your behalf. The FTC warns that hiring a vendor does not hand off your legal duty. That holds even if you hire another company to run your email marketing. Liability can fall on the advertiser whose product is promoted as well as on the company that sends the message. Offering money, coupons or discounts for forwarding a message may also make the seller responsible for compliance.
Non-compliance can be costly. Each separate email in violation is subject to penalties of up to $16,000, the FTC says. The Act also sets criminal penalties, including prison, for abuses such as accessing someone else's computer without permission to send multiple spam messages.
Your CAN-SPAM requirements checklist
- Are the From, To, Reply-To and routing details accurate, and do they show who started the message?
- Does the subject line match what is inside?
- Is the message labeled as an ad, unless the reader gave prior affirmative consent (see Rule 3)?
- Does it show a valid postal address, with any box accurately registered?
- Does it explain how to opt out, with a method that stays active for 30 days or more after sending?
- Do you honor an opt-out within 10 business days, with no fee, no extra details, no extra steps and no sale or transfer of the address?
- Do you check what anyone who sends email for you is doing?