CAN-SPAM checklist for small business email
If your business sends marketing email, the CAN-SPAM Act applies, including to emails sent to other businesses. Here are the requirements as the FTC lists them, and how to meet each one.
Published October 21, 2026 · Keystone Solutions
The seven requirements
From the FTC’s “CAN-SPAM Act: A Compliance Guide for Business.”
Don’t use false or misleading header information
Your From, To, Reply-To and routing details must be accurate and identify who is sending.
Don’t use deceptive subject lines
The subject line has to reflect what the message is about.
Identify the message as an ad
Marketing email must disclose clearly that it is an advertisement. The law gives you flexibility in how.
Tell recipients where you’re located
Include a valid postal address: a street address, a post office box registered with the Postal Service, or a registered private mailbox.
Tell recipients how to opt out
Explain clearly how to stop receiving marketing email from you, and make it easy.
Honor opt-outs promptly
Process opt-out requests within 10 business days, and keep the opt-out working for at least 30 days after you send.
Monitor what others do on your behalf
Hiring an email company doesn’t move your responsibility. The FTC says “you can’t contract away your legal responsibility to comply with the law.”
Questions owners ask
- Does it apply to emails to other businesses?
- Yes. The FTC’s guide says “the law makes no exception for business-to-business email.”
- What about receipts and appointment confirmations?
- Transactional or relationship messages are mostly exempt, but they still can’t contain false or misleading routing information, and a message whose main purpose is marketing is treated as commercial.
- How serious are the penalties?
- The FTC’s guide states that each separate email in violation can bring penalties of up to $53,088.
What CAN-SPAM doesn’t cover
CAN-SPAM is about email. Text messages and automated calls follow different rules, including consent requirements, which is why Keystone never sends cold text messages and only texts people who agreed to hear from you.
Email providers set their own rules too, and many prohibit sending to purchased or scraped lists even when the law would allow it. Check your provider’s acceptable-use policy before sending marketing email.
This guide is general information, not legal advice. For questions about your situation, talk to your own lawyer.
Sources
- CAN-SPAM Act: A Compliance Guide for Business Federal Trade Commission Read 2026-10-21.
- CAN-SPAM Rule Federal Trade Commission
Related
Asking for reviews
What the FTC’s consumer review rule and Google’s review policy allow when a small business asks customers for reviews, and a simple process that stays within both.
Follow-up automation
Polite, spaced follow-up for quotes and inquiries that stops the moment a customer replies, books or opts out. No more forgotten callbacks.
Security and data
How Keystone protects client data: separate workspaces, encrypted integration keys, hashed passwords, role-based access, audit logs and data export.
Get a free response audit
Tell us how leads reach you today. We’ll show you where they slip through and what we’d set up first. No obligation.
Thanks, your request is in.
your request is in. We’ll reply to set up a short call.
This form opens shortly. In the meantime, email us and we’ll reply.