CAN-SPAM and privacy basics for business newsletters

The short version

• Honest From name, honest subject line, and say when a message is an ad.
• Your valid physical postal address in every marketing email.
• A clear unsubscribe link that works, honored within 10 business days.
• You’re responsible even when a service sends for you.
• Canada and the UK generally require consent first, with narrow exceptions. Get advice if many subscribers are there.
• Name your email service in your privacy policy. This isn’t legal advice.

What does CAN-SPAM require?

These come from the FTC’s CAN-SPAM compliance guide, checked on October 31, 2026. The FTC lists them as the law’s main requirements.

1. Don’t use false or misleading header information. Your From name, From address and Reply-To must identify your business.
2. Don’t use deceptive subject lines. The subject must reflect what’s in the email.
3. Identify the message as an ad. The FTC gives you flexibility in how, but it must be clear when a message is an advertisement.
4. Tell recipients where you’re located. Include “your valid physical postal address.” The FTC says that can be your street address, a post office box registered with the US Postal Service, or a private mailbox registered with a commercial mail receiving agency.
5. Tell recipients how to opt out. Explain it clearly, and give them “the option to stop all marketing messages from you.”
6. Honor opt-outs promptly. Within 10 business days. Your opt-out method must work for at least 30 days after you send. You can’t charge a fee, ask for more than an email address, or make people do more than reply or visit one page.
7. Monitor what others do on your behalf. You “can’t contract away your legal responsibility,” the FTC says. If your newsletter service or an agency sends for you, you’re both responsible.

The FTC also says you can’t sell or transfer the addresses of people who opted out, and the law “makes no exception for business-to-business email.” Each separate email that breaks the law can bring penalties of up to $53,088, according to the FTC.

How do I meet these in practice?

Your newsletter service does most of it, as long as you don’t undo it:

• Set the From name to your business name, or your name plus the business.
• Put your postal address in the account’s contact settings. Most services insert it in the footer automatically.
• Leave the unsubscribe link in your template. If you build a custom design, check it’s still there.
• Keep unsubscribed people unsubscribed. Never re-import them, and carry them over when you change services. See switching platforms.

Gmail adds its own rule for large senders: marketing messages must support one-click unsubscribe. Our guide to bulk-sender rules explains when that applies.

What about consent?

CAN-SPAM’s rules are about how you send and how you handle opt-outs. Consent before sending comes from elsewhere:

• Your newsletter service. Mailchimp’s acceptable use policy requires that you can “point to an opt-in form or show other evidence of consent,” and the other services have similar rules.
• Gmail. Its sender guidelines say “Make sure recipients opt in to get messages from you.”
• Canada. Canada’s anti-spam law requires consent before you send commercial email. Express consent lasts until the person withdraws it; implied consent applies only in set situations, such as an existing business relationship, and is “generally time-limited.” Messages must identify you, include a mailing address plus a phone number, email or website, and offer an unsubscribe that’s processed within 10 business days.
• The UK. The Information Commissioner’s Office email marketing guidance says “You must not send marketing emails or texts to individuals without specific consent,” with a limited “soft opt-in” exception for your own previous customers. The ICO’s current electronic mail guidance adds two distinctions: the consent rule covers individual subscribers (including sole traders and some partnerships), while marketing to corporate subscribers doesn’t need consent, though anyone can still ask you to stop; and since February 2026 charities have a separate, narrow “charitable purpose” soft opt-in.

Those exceptions are narrow and easy to get wrong. The simple way to meet all of these rules at once is the same: only email people who opted in. Our guide to building a list with consent shows how.

What should my privacy policy say about email?

If your website collects email addresses, your privacy policy should say so. In plain terms, it should cover:

• That you collect email addresses (and names, if you ask) for your newsletter.
• Which service stores and sends it, by name.
• What you send and how people unsubscribe.
• That you don’t sell or share the list, if that’s true.
• Whether you track opens and clicks. Most newsletter services do by default.

Our guides on what a privacy policy should cover and the vendors that handle your customers’ data go further, and US state privacy laws explains which state rules might apply.

Why does this matter?

Penalties are one reason. The bigger day-to-day reason is trust. An email that hides who sent it, or makes unsubscribing hard, gets marked as spam. Spam complaints are what push your newsletters, and sometimes your everyday email, into junk folders.

What are the common mistakes and edge cases?

• No postal address because “we’re a home business.” Use a PO box or a registered private mailbox instead of your home address.
• “Reply STOP to unsubscribe” only, with nobody watching the inbox. Use the service’s link.
• A misleading “Re:” or “Your order” subject on a promotion. That’s a deceptive subject line.
• Assuming B2B is exempt. It isn’t.
• A reminder email that turns into an ad. The FTC says a message is commercial if its subject line suggests a promotion, or if the transactional part doesn’t come mainly at the start. Keep reminders about the appointment.
• An agency sending for you. You’re still responsible; check their setup.

What if someone complains?

• They say they never signed up. Unsubscribe them at once, check your record of how they joined, and fix that source if it’s the problem.
• They’re still getting email after unsubscribing. Check for a second list or a second tool that still has them, such as a booking system or CRM.
• You got a legal letter. Talk to a lawyer. This page isn’t legal advice.

How much does it cost, and how long does it take?

Meeting these rules costs nothing extra in a newsletter service. Checking your template, footer and settings takes about 15 minutes. Updating your privacy policy takes longer; our privacy guides help.

How does E-3 handle this?

Email follow-up is part of our leads and follow-up service. Whoever drafts a marketing email, check its From name, subject, postal address and unsubscribe link against the list above before it’s sent. We can’t give legal advice; for that, talk to your lawyer.

Related questions

• How do I build a list with consent?
• How do I write a newsletter people read?
• Do Gmail’s bulk-sender rules apply to me?
• What should my privacy policy cover?
• Back to the complete email newsletter guide

Sources

1. CAN-SPAM Act: A Compliance Guide for Business (Federal Trade Commission)
2. Getting consent to send email (Innovation, Science and Economic Development Canada)
3. Electronic mail marketing (UK Information Commissioner's Office)
4. How do we comply with the PECR electronic mail marketing rules? (UK Information Commissioner's Office)
5. Email sender guidelines (Gmail Help)
6. Acceptable Use Policy (Mailchimp)