Start with the CAN-SPAM overview for the basics. This page covers each requirement, the numbers and the penalty limits.
What the law requires
| Requirement | What it means in plain words | Section |
|---|---|---|
| Accurate headers | From, To, Reply-To and routing details are materially truthful and name the real sender. | 15 U.S.C. 7704(a)(1) |
| Honest subject line | The subject does not mislead a reasonable reader about a material fact in the message. | 7704(a)(2) |
| Ad label | The message is clearly identified as an ad, unless the recipient gave prior affirmative consent. | 7704(a)(5)(A)(i) |
| Postal address | A valid physical address: under the FTC's rule, a current street address, a USPS-registered PO box or a registered private mailbox. | 7704(a)(5)(A)(iii); 16 CFR 316.2(p) |
| Opt-out notice and method | A clear notice and a working reply address or web page that stays active at least 30 days after sending. | 7704(a)(3), (a)(5)(A)(ii) |
| Prompt opt-out handling | Stop within 10 business days. No fee, no extra information beyond the email address and preferences, no steps beyond a reply or one web page. Do not sell or transfer the address. | 7704(a)(4); 16 CFR 316.5 |
| Oversight of senders | Whoever initiates or procures the email stays responsible. | 15 U.S.C. 7702 |
The FTC guide now lists eight headings. The extra one reminds senders that subscribers and members can opt out of marketing email too. This site groups it as seven requirements plus that reminder.
Key numbers and dates
| Item | Amount or date | Year in force | Source |
|---|---|---|---|
| FTC civil penalty | Up to $53,088 per separate email in violation | 2025 amount, still in force in 2026 | FTC guide; 16 CFR 1.98 |
| Opt-out method must work | At least 30 days after sending | Statute | 7704(a)(3) |
| Honor an opt-out | No later than 10 business days after receipt | Statute | 7704(a)(4) |
| Law in effect | 1 January 2004 | Statute | Pub. L. 108-187 |
| FTC rule review | Rule kept unchanged on 4 April 2019 | 2019 | 84 FR 13115 |
Source: FTC CAN-SPAM guide and 15 U.S.C. 7706
Recent and pending changes
No amendment to the statute and no amendment to the CAN-SPAM Rule was found after the FTC kept the rule unchanged in April 2019. The per-email penalty figure was $50,120 in 2023 and $51,744 in 2024. It became $53,088 for penalties assessed after 17 January 2025.
Penalties and enforcement
The FTC enforces the Act as an unfair or deceptive practice under the FTC Act. Other regulators handle banks, credit unions, brokers and insurers. Section 7706 lets state attorneys general and internet access providers sue. It does not list individual consumers among those who can sue. Aggravated violations include harvesting addresses from sites that forbid it and relaying messages through unauthorized computers.
| Who | What they can seek | Limit |
|---|---|---|
| FTC | Civil penalties | Up to $53,088 per separate email |
| State attorney general | Actual loss or statutory damages | Up to $250 per message; $2,000,000 cap outside header violations; up to three times for willful or aggravated violations |
| Internet access provider | Actual loss or statutory damages | Up to $100 per header violation and $25 per other violation; $1,000,000 cap outside header violations; up to three times |
| Criminal (18 U.S.C. 1037) | Prison, fines, forfeiture | Up to 5, 3 or 1 year, depending on the conduct |
To apply these rules, use the checklist and FAQs. Government penalties are generally not deductible under IRC 162(f); see business expense deductions and small business owners.
Official sources
- FTC: CAN-SPAM Act, A Compliance Guide for Business
- Cornell Law School LII: 15 U.S.C. 7704, commercial email requirements
- Cornell Law School LII: 15 U.S.C. 7706, enforcement
- Cornell Law School LII: 18 U.S.C. 1037, fraud in connection with email
- eCFR: 16 CFR 1.98, FTC civil penalty amounts
This page is a plain-language summary. The official source controls if there is any difference.