CAN-SPAM is the United States law covering commercial email. It is the reason marketing mail carries a postal address, and it is far less demanding than the equivalent rules in Canada or the European Union, which is why a programme built to satisfy it alone will not travel.

This page describes what the rule requires, following the Federal Trade Commission's own [compliance guide](https://www.ftc.gov/business-guidance/resources/can-spam-act-compliance-guide-business). It is not legal advice. For what Bird does with unsubscribes on your behalf, see [email consent and CAN-SPAM](/docs/knowledge-base/compliance/email/consent).

## What does it require?

Seven things, in the FTC's own words:

> - Don’t use false or misleading header information.
> - Don’t use deceptive subject lines. The subject line must accurately reflect the content of the message.
> - Identify the message as an ad. The law gives you a lot of leeway in how to do this, but you must disclose clearly and conspicuously that your message is an advertisement.
> - Tell recipients where you’re located. Your message must include your valid physical postal address.
> - Tell recipients how to opt out of receiving future marketing email from you.
> - Remember that subscribers and members can opt out of marketing emails, too.
> - Monitor what others are doing on your behalf.

Notice what is absent: nothing requires the recipient to have agreed to hear from you. CAN-SPAM regulates how you send commercial email, not whether you may start.

The last requirement is the one that surprises companies who outsource. The FTC is explicit that "even if you hire another company to handle your email marketing, you can’t contract away your legal responsibility to comply with the law", and that both the company being advertised and the company sending can be held responsible.

## Which of my messages does it cover?

The ones whose primary purpose is commercial, which is a test rather than a label.

The FTC divides content into three kinds: commercial, transactional or relationship, and other. A message that is only transactional "may not contain false or misleading routing information, but is otherwise exempt from most provisions of the CAN-SPAM Act". A message that is only commercial has to meet all seven requirements. Mixed messages are decided by which purpose dominates:

> If a recipient reasonably interpreting the subject line would likely conclude that the message contains an advertisement or promotion for a commercial product or service or if the message’s transactional or relationship content does not appear mainly at the beginning of the message, the primary purpose of the message is commercial.

Two design rules fall straight out of that. A promotional subject line makes the message commercial regardless of what the body says. And placement counts: transactional content has to be at the top, not after the offer.

## What counts as transactional?

Five categories, and the FTC warns against reading them generously.

> - Facilitates, completes, or confirms a commercial transaction that the recipient already has agreed to;
> - gives warranty, recall, safety, or security information about a product or service the recipient bought;
> - notifies the recipient about a change in the terms or features of a membership, subscription, account, loan or other ongoing commercial relationship; notifies the recipient of a change in their standing with respect to that ongoing commercial relationship; or provides regular, periodic account balance information to the recipient;
> - provides information about an employment relationship or employee benefits; or
> - delivers goods or services as part of a transaction that the recipient already has agreed to.

And the warning:

> Keep in mind that the law views these categories narrowly. That means you shouldn’t assume that any message you send to recipients who have an ongoing commercial relationship with you – including subscribers or recipients who participate in a membership program – are transactional or relationship messages.

This is the practical error most senders make. Having customers does not make your mail to them transactional. A product newsletter to paying subscribers is commercial email, and it needs the address and the opt-out.

The same split exists in a sending platform, and it is worth getting right for a second reason: on Bird, [the category](/docs/guides/email/categories) decides whether an unsubscribe applies. Marking marketing mail as transactional does not exempt it from the law and does silently exempt it from your own opt-out handling.

## How must the opt-out work?

Free, simple, and honoured within ten business days.

> Any opt-out mechanism you offer must be able to process opt-out requests for at least 30 days after you send your message. You must honor a recipient’s opt-out request within 10 business days. You can’t charge a fee, require the recipient to give you any personally identifying information beyond an email address, or make the recipient take any step other than sending a reply email or visiting a single page on an Internet website as a condition for honoring an opt-out request.

Four constraints in one sentence, and each rules out something people build: no login wall, no "tell us why" form, no multi-step wizard, and no dead unsubscribe link on last month's campaign.

There is a further restriction after the opt-out. Once someone has opted out, "you can’t sell or transfer their email addresses, even in the form of a mailing list", except to a company helping you comply.

The FTC also permits a preference centre, with one condition:

> You may create a menu to allow a recipient to opt out of certain types of messages, but you must include the option to stop all marketing messages from you.

A preference centre that only offers "fewer emails" and no way out is not compliant.

## Is meeting CAN-SPAM enough?

Only if every recipient is in the United States, and only for the legal question.

Two gaps are worth naming. Territorially, CAN-SPAM's opt-out model is the outlier: [CASL](/explained/compliance/what-is-casl) requires consent before the first message, and [the European rules](/explained/compliance/what-does-gdpr-require-for-email-and-sms-marketing) require it too. A list that spans countries is governed by the strictest rule that applies to each recipient, not by the sender's home rule.

And separately from law, mailbox providers impose their own requirements that CAN-SPAM says nothing about, including [one-click unsubscribe](/explained/deliverability/what-is-one-click-unsubscribe) and complaint-rate ceilings. Legal compliance and delivery are different problems.