CAN-SPAM Compliance Checklist for E-commerce Emails

Who CAN-SPAM applies to

CAN-SPAM covers commercial email: messages whose primary purpose is advertising or promoting a commercial product or service, including content on a commercial website. Three points from the FTC’s guide surprise many store owners:

1. It isn’t limited to bulk email. The FTC states plainly that, despite its name, the law doesn’t apply just to bulk email. A single promotional message to one past customer is covered.
2. There’s no business-to-business exception. If you sell wholesale and email a promotion to a shop owner’s work address, the same rules apply.
3. Outsourcing doesn’t transfer responsibility. If you use an agency or an email platform to send for you, both the company whose product is promoted and the company that actually sends the message may be held legally responsible.

CAN-SPAM is an opt-out law. Unlike the EU rules, it doesn’t require you to get permission before sending commercial email to someone in the US. What it requires is that your messages are honest, identify you, and let people stop them easily. If you also have subscribers in the EU or UK, those rules are stricter; see our companion guide on GDPR and email consent, linked at the end.

Step 1: Sort your store’s emails by type

The FTC’s guide sorts email content into three kinds: commercial content, transactional or relationship content, and other content. Commercial messages must follow all of the requirements below. Transactional or relationship messages are largely exempt, though they still can’t contain false or misleading routing information. The FTC lists five narrow categories that count as transactional or relationship content:

1. Facilitating or confirming a commercial transaction the recipient already agreed to.
2. Giving warranty, recall, safety or security information about a product or service the recipient used or bought.
3. Giving information about a change in terms or features, or account balance information, for an ongoing membership, subscription, account or similar relationship.
4. Providing information about an employment relationship or related benefits.
5. Delivering goods or services the recipient is entitled to under a transaction they already agreed to.

Here’s how that maps onto the emails a typical online store sends. Treat the right-hand column as a starting point, not a ruling: what matters is the content and how it’s presented, which we cover in the next step.

Step 2: Check mixed messages with the primary-purpose tests

Stores often add promotions to transactional emails: “Thanks for your order — here’s 15% off your next one.” That’s allowed, but it can change how the email is classified. The FTC’s guide explains that when a message mixes commercial and transactional content, its primary purpose is commercial if:

1. a recipient reasonably interpreting the subject line would likely conclude the message contains an advertisement or promotion, or
2. the transactional or relationship content does not appear mainly at the beginning of the message.

For messages that mix commercial content with “other” content (for example, a blog-style newsletter with some product mentions), the FTC looks at factors such as the subject line, where the commercial content sits, how much of the message it takes up, and how much it’s emphasized with color, graphics and type size.

The practical rule for an order confirmation: keep the subject line about the order (“Your order #1042 is confirmed”), put the order details first, and keep any promotion short and below them. If you want a promotional subject line or a promotion-first layout, treat the email as commercial and give it the full set of requirements, including an unsubscribe link and your postal address.

Step 3: Work through the FTC’s requirements

The FTC’s compliance guide currently lists eight main requirements. (Older summaries often say seven; the guide now has a separate item stating that subscribers and members can opt out too.) Here is each one with what it means for a store.

1. Don’t use false or misleading header information

Your From, To, Reply-To and routing information, including the originating domain name and email address, must be accurate and identify the person or business that sent the message.

1. Use your store name, or a real person at your store, in the From name. “Maya at Northline Goods” is fine; a name customers won’t recognize is a risk.
2. Send from a domain you own or that clearly belongs to your store, not a look-alike.
3. Make the Reply-To address a mailbox someone actually reads. Replies may include unsubscribe requests (see requirement 7).

2. Don’t use deceptive subject lines

The subject line must accurately reflect the content of the message. For stores, the common traps are urgency and fake familiarity:

3. Identify the message as an ad

The FTC says the law gives you a lot of leeway in how you do this, but the disclosure that the message is an advertisement has to be clear and conspicuous. For most stores, a short line in the footer such as “You’re receiving this promotional email because you subscribed at northlinegoods.com” makes the nature of the message clear, alongside content that is obviously a sale or product announcement. If you’re unsure whether your wording is clear enough, make it more explicit rather than less.

4. Tell recipients where you’re located

Every commercial message must include your valid physical postal address. According to the FTC, that can be:

1. your current street address,
2. a post office box you’ve registered with the US Postal Service, or
3. a private mailbox you’ve registered with a commercial mail receiving agency established under Postal Service regulations.

Many home-based sellers use a registered PO box or private mailbox so they don’t have to publish their home address. Whatever you choose, make sure it’s current; an address you moved out of two years ago doesn’t meet the requirement.

5. Tell recipients how to opt out

Each commercial message must include a clear and conspicuous explanation of how the recipient can opt out of getting email from you in the future. The FTC asks you to write the notice so an ordinary person can easily recognize, read and understand it, and notes that type size, color and placement can improve clarity.

1. Give a return email address or another easy internet-based way to opt out. A link to a web page is the most common choice.
2. You may offer a menu of choices (for example, “sale emails only” or “new arrivals only”), but it must include an option to stop all commercial messages from you.
3. Make sure your spam filter doesn’t block opt-out requests that arrive by email.
4. Don’t hide the link in pale gray, tiny text at the bottom of a long image. If you have to squint to find it, so do your customers.

6. Remember that subscribers and members can opt out too

If you run a membership program, a subscription box or a paid club, your members don’t lose the right to stop marketing emails. The FTC’s guide states that recipients of email from a sender that runs a subscription service or membership program still have the right to opt out. Messages whose primary purpose fits one of the transactional categories (a shipment notice for their box, a renewal reminder) don’t need an opt-out, but your promotional emails to members do.

7. Honor opt-out requests promptly

This is where small stores most often slip, usually because opt-outs arrive in more than one place. The FTC’s rules:

1. Any opt-out mechanism you offer must be able to process requests for at least 30 days after you send the message.
2. You must honor an opt-out request within 10 business days.
3. You can’t charge a fee, require the person to give you any personally identifying information beyond an email address, or make them take any step other than sending a reply email or visiting a single page on a website.
4. Once someone has told you they don’t want more messages, you can’t sell or transfer their email address, even in the form of a mailing list. The only exception is transferring it to a company you’ve hired to help you comply with CAN-SPAM.

Notice the “single page” rule. An unsubscribe flow that sends people to a login screen, or asks them to confirm on a second page and then a third, goes beyond what the FTC allows. One page with a clear confirmation is the safe design.

8. Monitor what others are doing on your behalf

If you hire an agency, a freelancer or an affiliate to email on your behalf, you remain responsible. The FTC says both the company whose product is promoted and the company that sends the message may be held legally responsible. In practice:

1. Ask anyone sending for you how they handle opt-outs and how quickly your suppression list reaches them.
2. Share your unsubscribe list with them, and get theirs back.
3. Approve subject lines and From names before campaigns go out.

The FTC’s guide also covers emails that promote several companies at once. Those marketers can choose one of them as the “sender” for CAN-SPAM purposes, but that company must meet specific conditions, including being named in the From line. If the designated sender doesn’t meet its obligations, all the marketers may be liable. And if you reward customers for forwarding your emails to friends, for example with a referral discount, the guide explains that you may become responsible for those forwarded messages too.

Step 4: Build a compliant footer once

Most of the requirements land in the footer. Write it once, add it to every promotional template, and you’ve covered the address, opt-out and ad-identification points in one place. A plain-text version:

You're receiving this promotional email because you signed up
at northlinegoods.com.

Northline Goods
PO Box 1234, Portland, OR 97201, USA

Unsubscribe from all marketing emails: [unsubscribe link]
Questions? Just reply to this email.

Footer checklist:

1. Your business name as customers know it.
2. A current street address, registered PO box or registered private mailbox.
3. A visible unsubscribe link that works without logging in, and leads to a single page.
4. If you offer preferences, an “unsubscribe from all” option on that page.
5. A short statement that the email is promotional and why they’re receiving it.
6. Readable on a phone: normal text size, enough contrast, not embedded in an image.

Step 5: Set up your opt-out process behind the scenes

A working link is only half of compliance. The other half is making sure an opt-out actually stops every kind of marketing email you send, from every tool, within 10 business days. Walk through these questions:

Step 6: Run a pre-send check on every campaign

Before any promotional email goes out, run through this list. It takes two minutes once it’s routine.

1. From name and address: recognizably your store, on your own domain.
2. Subject line: accurately describes what’s inside. Any deadline in the subject is real.
3. Body: offers, prices and conditions match your site and checkout.
4. Footer: postal address present and current.
5. Unsubscribe: link present, visible, and tested by clicking it from a test send.
6. Audience: excludes everyone who opted out, including manual requests from the past 10 business days.
7. Third parties: if anyone else is sending or co-promoting, their suppression list matches yours.

Common e-commerce scenarios

The discount in the order confirmation. Fine, as long as the subject line is about the order and the order details come first. If you lead with the discount, treat the email as commercial.

The cart or “still thinking it over?” reminder. It promotes a purchase the customer hasn’t completed, so it’s safest to treat it as commercial: include the footer and honor opt-outs. If someone has unsubscribed from marketing, they shouldn’t get these either.

Review requests. A plain request to review a product someone bought sits close to the transaction, but once it includes coupons, product recommendations or “shop again” buttons, it reads as promotional. When in doubt, include the footer.

Wholesale buyers. No B2B exception. Your wholesale newsletter needs the same honest headers, address and opt-out.

A partner promotion. If you feature another brand in a joint email, agree in writing who is the sender and whose opt-out list applies, following the FTC’s multiple-advertiser guidance.

What happens if you get it wrong

According to the FTC’s guide, each separate email in violation of the CAN-SPAM Act is subject to penalties of up to $53,088, and more than one person may be held responsible: the company whose product is promoted and the company that originated the message can both be liable. The guide also notes that deceptive commercial email can violate other laws, including Section 5 of the FTC Act.

The guide separately describes “aggravated violations” that can carry criminal penalties, including imprisonment. They include harvesting addresses or generating them through dictionary attacks, registering multiple email accounts or domain names with false information, and relaying email through someone else’s computer or network without permission. No legitimate store should be doing any of these, and they’re one more reason never to buy a list of unknown origin.

CAN-SPAM is the floor, not the ceiling

Meeting CAN-SPAM doesn’t guarantee your emails reach the inbox, and it doesn’t make them compliant outside the US. Two other sets of rules usually matter for a store:

1. Mailbox provider requirements. Large inbox providers set their own rules for senders, such as authentication and easy unsubscribe. Our welcome email series guide summarizes Google’s sender guidelines.
2. Consent rules in other countries. If you sell to customers in the EU or UK, marketing email generally needs prior consent, with a narrow exception for existing customers. See GDPR and Email Marketing: Consent Basics for Small Online Shops.

Where marketingLABO fits

marketingLABO includes email newsletters with open and link-click tracking on the Light plan, and automated email journeys on the Standard plan (see the pricing section). A few things are worth knowing when you apply this checklist there:

1. The unsubscribe link isn’t added automatically. The email editors include an option to insert an unsubscribe link that becomes a personal link for each recipient when the email is sent. Add it to your footer, together with your postal address, and check it in a test send.
2. Unsubscribed contacts are skipped. People who unsubscribe aren’t sent newsletters, and they don’t receive the remaining emails in a journey they’re already in.
3. Manual requests can be recorded. If someone asks by reply or through a support email, you can mark that contact as unsubscribed in their contact record, which keeps them out of later sends from marketingLABO.
4. Order emails stay with your store platform. marketingLABO isn’t connected to your e-commerce platform and doesn’t send order confirmations or shipping notices. Those transactional emails come from your store system, and opt-outs recorded in marketingLABO don’t sync to other tools automatically, so manage suppression across tools as described in Step 5.

For the bigger picture of how automated email fits with your site, read What Is Marketing Automation? If you want to try the tools, you can sign up free.

FAQ

Do I need permission to email US customers under CAN-SPAM?
The FTC’s guide describes requirements for how commercial email is sent, not a prior-consent requirement. In practice, emailing people who asked to hear from you is still the better approach for engagement and inbox placement.

Does CAN-SPAM apply if I only send a few emails a month?
Yes. The law isn’t limited to bulk email, and each separate non-compliant email can be subject to penalties.

Can I use a PO box instead of my home address?
Yes, if it’s registered with the US Postal Service, or if it’s a private mailbox registered with a commercial mail receiving agency under Postal Service regulations.

My email platform handles unsubscribes. Am I covered?
Only for emails sent through that platform. You remain responsible for opt-outs that arrive by reply or support email, and for any other tool or agency sending marketing on your behalf.

Sources

Federal Trade Commission, “CAN-SPAM Act: A Compliance Guide for Business”: https://www.ftc.gov/business-guidance/resources/can-spam-act-compliance-guide-business