CAN-SPAM compliance checklist

Five rules in the email.
Three in your list.

The CAN-SPAM Act is the US law for commercial email, and the FTC’s guide boils it down to eight rules. Five you can see in the email itself: an honest From line, a subject that matches, an ad label if the person didn’t ask for it, your postal address and a clear way to opt out. Three are about how you run your list: opt-outs are honored within 10 business days, subscribers can opt out too, and you answer for whoever sends for you. Here is each rule in plain words, a free checker for a draft, and what Builderify Broadcast handles for you.

Check an email Start free
CAN-SPAM $53,088 at most, for each email

By the Builderify team

06 Subscribers can opt out too 07 Honor opt-outs in 10 business days 08 You answer for your senders
01 / Does it apply to you?

Does CAN-SPAM apply
to a small business?
If you email to sell, yes.

It applies to every email whose main purpose is to advertise or promote a product or service, and it doesn’t care whether you send ten or ten thousand. The FTC says it covers all commercial messages, not only bulk email, and that there is no exception for business-to-business email.FTC

It doesn’t ask for permission before the first email. CAN-SPAM is an opt-out law: you may email someone who hasn’t signed up, as long as you follow the rules, didn’t scrape or guess their address, and stop when they say stop.US Code Many other countries put consent first, and this guide covers only the US law. It is general information, not legal advice.

Which emails count as marketing, and whether they need the opt-out and the postal address
The email Counts as Opt-out and address?
A newsletter with offers or product news Marketing Yes
An email to past customers about a new product line Marketing Yes. Having bought from you before isn’t an exemption.
A cold email to another business, offering your services Marketing Yes. There is no business-to-business exception.
An order confirmation, a receipt, or a warranty or safety notice Transactional No, but the sender details must still be honest.
A notice that the terms of their account or subscription changed Relationship No, but the sender details must still be honest.
A receipt with a coupon in it It depends Marketing if the subject sounds like an ad, or if the receipt isn’t at the start of the message.

The test is the main purpose of the message. Receipts, warranty and safety notices, account changes and delivering what someone bought are transactional or relationship messages, and they are outside the marketing rules.US Code When one email mixes both, the FTC’s rule makes it marketing if the subject line reads like an advertisement, or if the transactional part doesn’t come at the start of the message.eCFR

02 / The checklist

What are the CAN-SPAM Act requirements?
Eight rules, in plain words.

The FTC’s compliance guide lists eight requirements. Five show up in the email, three show up in how you run your list. Each one below says what it asks and how to check it yourself in a minute.FTC

In the email5 rules
  1. 01

    An honest From line

    The From, To and Reply-To details, and the domain and address behind them, must be accurate and say who sent the message.

    Check Does the From name say who you are, and does a reply reach you?

  2. 02

    A subject that matches

    The subject line must accurately reflect the content of the message. A fake “Re:” or a “your order” on an offer is the usual way to get this wrong.

    Check Read the subject, then the first two lines. Do they say the same thing?

  3. 03

    Marked as an ad

    The email must say, clearly and conspicuously, that it is an advertisement, unless the person gave prior affirmative consent to get it: they expressly said yes, or asked you for it themselves.

    Check Can you show that each person asked? If not, add a plain line such as “This is an advertisement.”

  4. 04

    Your postal address

    Include a valid physical postal address: your street address, a post office box registered with the US Postal Service, or a private mailbox registered with a commercial mail receiving agency.

    Check Is it at the foot of every marketing email, the automated ones too?

  5. 05

    A clear way to opt out

    Explain how to stop getting your marketing email, in a way an ordinary person can see and understand, with a reply address or another easy online way. A menu of choices is fine if one choice stops everything.

    Check Can you find it in two seconds, and does it work?

In your list3 rules
  1. 06

    Subscribers can opt out too

    Being a subscriber or a member doesn’t remove the right to opt out of marketing. An email may go without an opt-out only if its main purpose is one of five transactional or relationship kinds, such as a receipt or a change to an account.

    Check For any email without an opt-out, can you say which of the five it is?

  2. 07

    Honor opt-outs promptly

    Whatever you offer must keep working for at least 30 days after you send. Stop emailing within 10 business days of the request, and don’t sell or hand on the address.

    Check Is there one list of opt-outs, checked before every send?

  3. 08

    Watch what others send for you

    Hiring an agency or a tool doesn’t move the responsibility. The company whose product is promoted and the company that sends the email can both be held liable.

    Check Do you see what goes out in your name, and who handles the opt-outs?

The penalty

$53,088

at most, for each separate email that breaks the rules.FTC A Federal Register notice effective 15 September 2026 keeps the 2025 penalty amounts in place through 2026.Federal Register More than one party can be held responsible, including the business whose product is promoted and the company that sends the email.

03 / Check an email

Is anything missing from your email?
Paste it and see.

Paste the From name, the subject and the text of an email you are about to send. The checker looks for the five things that can be seen in an email: a From name that says who you are, a subject that doesn’t imitate a reply or a receipt, an ad label when you need one, something shaped like a postal address, and unsubscribe wording with a link. It reads text, so it can’t tell whether an address is real or a link works. Nothing you paste leaves your browser.

Email checker · a made-up bike shop newsletter
Did everyone on the list ask for your emails?

Try it: add a line with a street address and ZIP to the email text and watch the missing item turn green.

4 of 5 look fine · 1 missing

  1. Rule 1An honest From line

    Looks fine

    From name: “Hollis Bikes”. This check can’t see your From address or Reply-To, so send yourself a test.

  2. Rule 2A subject that matches

    Looks fine

    Nothing in the subject imitates a reply or a receipt. Only you can check that it matches the email.

  3. Rule 3Marked as an ad

    Not needed

    Not needed when everyone asked for your emails. A plain “This is an advertisement.” line does no harm.

  4. Rule 4Your postal address

    Missing

    No street address or PO box found. Add your business name, street address or PO box, city, state and ZIP.

  5. Rule 5A clear way to opt out

    Found

    Found: “Unsubscribe”, with a link or a reply instruction.

Add what is missing first. The button copies a starter line for each missing item; fill in the brackets.

Looks fine and Found mean the check saw what it looks for. They don’t mean the email complies: only you can judge a subject, and only a test send shows a link works.

Check means something is there but needs your eyes: a hidden link, a generic From name, a subject that sounds like a receipt.

Missing means nothing like it was found. The button copies a starter line to fill in. It looks for US-style addresses and English wording, and it can’t see your From address or headers.

04 / After you send

How long do you have to honor an unsubscribe?
Ten business days, at most.

Stop emailing someone within 10 business days of their request, and keep the opt-out working for at least 30 days after you send. The second rule is easy to miss: a link that works on the day you send and breaks a week later doesn’t meet it.US Code

  1. Day 0

    You send it

    Every marketing email carries the opt-out, your postal address, an honest From line and a subject that matches.

  2. For at least 30 days

    The opt-out keeps working

    The link or reply address has to work for at least 30 days from the day you sent that email, not just on the day.

  3. Whenever someone asks

    You stop within 10 business days

    That is the limit, not a target. Check your list of opt-outs before every send, and take it with you when you change tools.

Making it easy

You can’t make leaving hard.

Four things the FTC says you can’t do to honor an opt-out. Make sure your spam filter doesn’t block the replies, too.FTC

  • Charge a fee

    Leaving has to be free.

  • Ask for more than their email address

    No name, no account number, no phone number.

  • Ask for more than a reply or one web page

    No login, no second page to click through, no phone call.

  • Sell or hand on the address

    The only exception is a company you hired to help you comply.

05 / Common slips

Where do small businesses slip?
Mostly in the unglamorous places.

Few people break CAN-SPAM on purpose. It is usually a footer nobody opened since the template was made, or an opt-out list that lives in the wrong tool.

  • 01

    A “Re:” or “your order” subject on an offer

    Subjects that pretend to be a reply or a receipt are the classic deceptive subject line. If the email is an offer, say so.

  • 02

    An unsubscribe behind a login

    The opt-out can’t need more than a reply or one web page: no password, no fee, nothing beyond the email address.

  • 03

    An unsubscribe that only leaves one list

    A menu of choices is allowed, but one of them has to stop all your marketing.

  • 04

    Emailing someone who already left

    It tends to happen when a person is on two lists, or an old spreadsheet gets imported again. Keep one opt-out list for the whole business and check it before every send.

  • 05

    No address in the automated emails

    Welcome emails and follow-up sequences that promote something are marketing email too, so they need the address and the opt-out. Check the last email of a sequence, not just the first.

  • 06

    Scraped or guessed addresses

    The law adds criminal penalties for harvesting addresses and for generating them by guessing random letters and numbers. A bought list is a different problem: the people on it have never heard of you, and their complaints hurt your delivery.

Setting up the sending side too? The SPF, DKIM and DMARC guide covers the DNS records, and the welcome email sequence guide has templates with a footer ready for your address.

06 / In Builderify

What does Builderify handle?
The parts that live in software.

Campaigns from Broadcast and follow-ups from Sequences carry your postal address and an unsubscribe link without you remembering to add them. Contacts and their status live in Leads, and bounces and abuse reports land in the Inbox. The wording is yours, and so is the responsibility.

What Builderify does for each CAN-SPAM rule
Rule What Builderify does
01From line Mail goes out from a domain you have verified, once a person on our team has approved the sender. A free-mailbox address such as Gmail isn’t accepted. Replies go to the Reply-to address you set, or to the sender address.
04Postal address The sender form asks for a business name and a postal address. Both go at the foot of every campaign and sequence email, unless your own text already carries that exact address.
05Opt-out Adds an unsubscribe link if your email doesn’t have one, plus the one-click unsubscribe header that mail apps look for. The link opens one page with one button, no login. Someone on several lists can choose to keep some.
06Marketing and the rest Campaigns and sequences go out as marketing mail, with the opt-out. Bookings, quiz results, form autoresponders, chat transcripts and support tickets go out as transactional mail, which an unsubscribe doesn’t stop. Keep those to their job: a promotion inside one is marketing.
07Honoring it An unsubscribe, by the link, the one-click header or an email, is checked before every send, so a campaign already going out skips that person. Bounced addresses are skipped too. Putting someone back takes a confirmation that they asked.
Your list Connecting a sender asks how people joined your list, and adding contacts by hand asks you to confirm they agreed to receive email.
Still yours

What stays with you.

No tool can promise you’re compliant. Here is what Builderify leaves to you, so you can see where the line is.

  • The subject and what the email says

    Builderify doesn’t read your copy. A subject that misleads is still yours.

  • The ad label

    If some of your list didn’t ask for your email, add the line yourself. Builderify doesn’t add one.

  • A real postal address

    It checks that you entered one, not that it exists or that mail reaches it.

  • Who you add

    The confirmation it asks for is your word. Don’t add people who haven’t agreed, or whose addresses were scraped or guessed.

  • Anyone who sends for you

    An agency or a teammate who emails in your name is still your responsibility, whatever the tool.

Every account gets 250 free credits a month, and each email sent costs 0.5 credits. There is no monthly fee: one-time packs start at $9 and never expire. See the pricing page.

Start free
Questions

CAN-SPAM, before you ask.

It is the US law that sets the rules for commercial email, enforced by the FTC. It covers every message whose main purpose is to advertise or promote a product or service, however small your list, and it makes no exception for business-to-business email. It doesn't ban marketing email. It says what each one must contain and that you must stop when someone asks.

Five things you can see in the email: accurate From, To and Reply-To details, a subject line that matches the content, a clear label that it is an ad (unless the person asked for it), your valid postal address, and a clear way to opt out. Three more concern your list: subscribers can still opt out, opt-outs are honored within 10 business days, and you answer for anyone who sends for you.

No. CAN-SPAM is an opt-out law, so you may email someone who hasn't signed up as long as you follow the rules and stop when they ask. Harvested or guessed addresses are a separate violation. Many other places, including the EU, the UK and Canada, generally want consent before the first marketing email, so check the rules where your recipients live.

Ten business days at most. The opt-out you offer must also keep working for at least 30 days after you send the email. You can't charge a fee, ask for more than an email address, or make the person do more than send a reply or visit one web page. You also can't sell or hand on their address, except to a company you hired to help you comply.

Mostly not. An email that only confirms a transaction the person agreed to, gives warranty, recall or safety information, announces a change to their account or membership, gives employment or benefits information, or delivers what they bought is exempt from most rules, though its sender details must still be accurate. If it also promotes something, it counts as marketing when the subject sounds like an ad or the receipt isn't at the start.

Each separate email in violation can bring a penalty of up to $53,088, and both the company whose product is promoted and the company that sends the message can be held responsible. A Federal Register notice effective 15 September 2026 keeps the 2025 amounts through 2026. Harvesting addresses and a few other serious violations can also carry criminal penalties.

For campaigns and sequences, yes. Each adds an unsubscribe link when your email has none, and puts the business name and postal address from your sender setup at the foot, unless your text already carries that exact address. It doesn't write your subject line, add an ad label or check that your address is real, so those stay with you.

Sources

The rules were read on 29 October 2026, and the Builderify details were checked the same day. Laws and penalties change, and this is general information, not legal advice. For your own case, ask a lawyer.

← All guides

Stop losing the visitors
you already paid for.

More leads from the traffic you already have, and follow-up that sends itself. Free to start. No card, no monthly fee.

Start free See what it does