The rules the FTC finalized in 2008 are still the CAN-SPAM rules today. One advertiser can act as the single “sender” in a multi-advertiser email, opting out can’t cost the recipient anything or ask for more than an email address and one web page visit, and a registered P.O. box counts as a valid postal address. As of November 2026, a single non-compliant email can cost up to $53,088. The FTC skipped its usual 2026 inflation increase, so the 2025 figure still applies. The biggest change since 2008 has come from mailbox providers, not the law. Since 2024, Gmail and Yahoo have required bulk senders to use SPF, DKIM and DMARC, offer one-click unsubscribe, process unsubscribes within two days and keep spam complaints under 0.3%. Microsoft’s Outlook.com added similar authentication rules in May 2025.
What the 2008 Final Rule Changed
On May 12, 2008, the Federal Trade Commission (FTC) approved new rules under the CAN-SPAM Act of 2003. The final rule was published in the Federal Register on May 21, 2008 and took effect on July 7, 2008. It is part of the FTC’s CAN-SPAM regulations at 16 CFR Part 316. The rule made four main changes.
One advertiser can be the sole sender in a multi-advertiser email
In an email that promotes more than one advertiser, one of them can take on the role of sole “CAN-SPAM sender.” To qualify, that advertiser must:
- Meet the definition of “sender” in the CAN-SPAM Act of 2003.
- Be the only advertiser named in the “from” line.
- Comply with all the other sender requirements in the Act, including the requirement to include a “valid physical postal address.”
The final rule dropped an idea from the FTC’s 2005 proposal that the designated sender had to control the message content and choose the recipient list. That made the rule easier to use for co-branded newsletters and sponsored sends. There is a trade-off, though. Law firms commenting on the rule pointed out that it gives every partner in a joint send a supervisory burden. If the designated sender fails to comply, the other advertisers can be treated as senders and held liable. The FTC’s current guidance says the same thing: you stay responsible for email that others send on your behalf.
Here is how it works in practice. A newsletter carries ads from three retailers, and only Retailer A appears in the “from” line. If Retailer A handles the opt-out mechanism, honors opt-outs and includes its postal address, it is the only sender, and recipients opt out from Retailer A. If two names appear in the “from” line, the sole-sender rule doesn’t apply. Each named advertiser then has to meet the sender obligations, and that includes honoring its own opt-out list.
Unsubscribing must be free and simple
Senders must give recipients an easy, unburdened way to unsubscribe from commercial email. The FTC requires that consumers be able to opt out of future commercial email from an advertiser without:
- paying a fee
- giving any information beyond their email address and opt-out preferences
- taking on “any other obligation as a condition for accepting or honoring a recipient’s opt-out request”
That last point includes being made to visit more than a single Internet web page. A login wall, a “confirm your password” screen or a three-page survey before the unsubscribe goes through all break this rule.
The FTC had also asked for comment on shortening the 10-business-day deadline for honoring opt-outs. It decided against it, so the legal deadline is still 10 business days. The FTC’s compliance guide also says your opt-out mechanism must keep working for at least 30 days after you send the message. Once someone opts out, you can’t sell or transfer their address, except to a company you’ve hired to help you comply with the Act.
Who counts as a “person”
For CAN-SPAM purposes, a “person” is defined as an individual, group, unincorporated association, limited or general partnership, corporation or other business entity. The definition matters because the Act’s obligations fall on “persons” who send or initiate commercial email. So no business form is exempt, whether it’s a sole trader, a club or a corporation.
What counts as a valid physical postal address
A “valid physical postal address” is defined as “the sender’s current street address, a Post Office box the sender has accurately registered with the United States Postal Service, or a private mailbox the sender has accurately registered with a commercial mail receiving agency that is established pursuant to United States Postal Service regulations.”
Before 2008, many marketers weren’t sure whether a P.O. box was enough. The rule settled the question: a properly registered P.O. box or private mailbox qualifies. Home-based businesses and remote-first companies often use this so they don’t have to publish a home address in every footer.
You can download the complete final rule here: PDF
What CAN-SPAM Requires in 2026
The Act was enacted in 2003, and the FTC’s CAN-SPAM Rule was revised in 2008. The FTC’s compliance guide describes the Act’s core requirements. These apply to all commercial email, including business-to-business messages:
| Requirement | What it means for your campaigns |
|---|---|
| No false or misleading header information | “From,” “To,” “Reply-To” and routing details must accurately identify who sent the message |
| No deceptive subject lines | The subject line must reflect what the message is about |
| Identify the message as an ad | Disclosure must be clear and conspicuous, but no set wording is required |
| Tell recipients where you’re located | Include a valid physical postal address (street, registered P.O. box or registered private mailbox) |
| Tell recipients how to opt out | The opt-out must be clear and easy to spot, with no fee, no extra data and no more than one web page |
| Honor opt-outs promptly | Within 10 business days. The mechanism must work for at least 30 days after the send |
| Monitor what others do for you | You’re liable for agencies, affiliates and partners who send on your behalf |
Transactional and relationship messages, such as receipts, shipping notices and account alerts, are mostly exempt. They still can’t contain false or misleading routing information.
Penalties as of November 2026
Each separate email that violates CAN-SPAM can bring a civil penalty of up to $53,088. That amount took effect on January 17, 2025, up from $51,744. Normally the FTC adjusts it every January. For 2026, its September 15, 2026 Federal Register notice said penalty amounts stay unchanged. Following Office of Management and Budget guidance, the inflation multiplier was cancelled because the October 2025 consumer price data needed to calculate it wasn’t available. Since the cap applies per email, a careless list send can turn into a very large number.
Mailbox Provider Rules Go Further Than the Law
For deliverability, the rules that hurt most often today come from Gmail, Yahoo and Microsoft, not the FTC. CAN-SPAM gives you 10 business days to process an unsubscribe and says nothing about authentication. The big inbox providers are much stricter.
| Rule | CAN-SPAM (law) | Gmail | Yahoo Mail | Outlook.com |
|---|---|---|---|---|
| Who it applies to | All commercial email | All senders. Extra rules above about 5,000 messages a day to Gmail | All senders. Extra rules for bulk senders (no published threshold) | Domains sending over 5,000 messages a day |
| Authentication | Not required | SPF or DKIM for all. SPF, DKIM and DMARC for bulk | SPF, DKIM and DMARC for bulk | SPF, DKIM and DMARC (at least p=none) |
| Unsubscribe method | Working opt-out, one web page at most | One-click (RFC 8058) for marketing mail | One-click (RFC 8058 POST highly recommended) | Working unsubscribe link expected |
| Unsubscribe deadline | 10 business days | 2 days | 2 days | Not set as a fixed number |
| Spam complaint ceiling | None | Below 0.3%, aim for below 0.1% | Below 0.3% | Not set as a fixed number |
| In force since | July 7, 2008 (rule) | February 2024, one-click from June 2024 | February 2024, one-click from June 2024 | May 5, 2025 |
The practical rule is simple: build to the strictest column. If you process unsubscribes within two days through a one-click header, you meet Gmail’s and Yahoo’s expectations and easily beat the CAN-SPAM deadline. One-click unsubscribe takes these two headers on each marketing message:
List-Unsubscribe: <https://example.com/unsubscribe?id=abc123>, <mailto:[email protected]>
List-Unsubscribe-Post: List-Unsubscribe=One-Click
A minimal DMARC record that meets the bulk sender floor looks like this:
_dmarc.example.com. IN TXT "v=DMARC1; p=none; rua=mailto:[email protected]"
Most major ESPs, including Mailchimp, Klaviyo and HubSpot, add the List-Unsubscribe headers for you. Your DNS records are still your job, and so is DMARC alignment on your own sending domain.
The honest counter-argument is that CAN-SPAM is an opt-out law. Legally, you can email US recipients who never opted in, as long as you follow the rules above. In practice, mailing people who didn’t sign up drives complaint rates past 0.3% quickly, and Gmail will filter or reject that mail long before an FTC case would ever reach you. Buying lists or scraping addresses fails both tests. Permission-based lists are the only reliable route.
FAQ
Does CAN-SPAM require opt-in consent?
No. CAN-SPAM is an opt-out law, so US commercial email can legally go to people who haven’t opted in, as long as every message follows the Act’s rules. Other laws can be stricter, such as the EU’s GDPR and ePrivacy rules or Canada’s CASL, which generally require consent. Gmail and Yahoo complaint thresholds also make sending without permission a deliverability problem.
How fast do I have to process an unsubscribe request?
The legal deadline under CAN-SPAM is 10 business days, and the 2008 rule kept it there. Gmail and Yahoo expect bulk senders to process unsubscribes within two days. Two days is the realistic target if you want to stay in the inbox.
Can I use a P.O. box as my postal address in emails?
Yes. Since the 2008 rule, a P.O. box you’ve accurately registered with the United States Postal Service counts as a valid physical postal address. So does a private mailbox registered with a commercial mail receiving agency under USPS rules. It has to be current, so update your footer if you move.
Who is responsible in a co-sponsored or multi-advertiser email?
If one advertiser is the only name in the “from” line and meets every sender obligation, that advertiser can be the sole CAN-SPAM sender. If it falls short, or if several advertisers appear in the “from” line, the other advertisers can be liable too. Put responsibilities in writing with your partners and make sure opt-outs are shared.
How much can a CAN-SPAM violation cost?
Up to $53,088 per non-compliant email as of November 2026. That amount has applied since January 17, 2025, and the FTC left it unchanged for 2026. Because each email counts as a separate violation, penalties grow fast with list size.
Do CAN-SPAM rules apply to B2B email?
Yes. The Act makes no exception for business-to-business email. A commercial message sent to a work address has to meet the same header, subject line, ad disclosure, postal address and opt-out rules as one sent to a consumer.
The 2008 rule still sets the legal minimum, and inbox providers now set the higher bar that actually decides your deliverability. A good next step is to check one recent campaign against both tables above: footer address, one-click headers, a two-day unsubscribe process and a DMARC record on your sending domain.
Sources
- FTC: CAN-SPAM Act: A Compliance Guide for Business
- Federal Register, May 21, 2008: Definitions and Implementation Under the CAN-SPAM Act (final rule)
- Federal Register, September 15, 2026: FTC Civil Penalty Inflation Adjustments
- Google: Email sender guidelines
- Yahoo Sender Hub: Best practices and FAQs
- Microsoft Tech Community: Outlook’s new requirements for high-volume senders