Understanding CAN-SPAM Compliance for Business Emails

Do you use email in your business? The CAN-SPAM Act is a law that sets rules for commercial emails, outlines requirements for such messages, gives recipients the right to request that you stop emailing them, and imposes tough penalties for non-compliance.

Despite the name, the CAN-SPAM Act applies to more than just bulk emails. It includes all commercial messages, defined as “any electronic mail message the primary purpose of which is the commercial advertisement or promotion of a commercial product or service.” This also includes emails promoting content on commercial websites. The law applies to business-to-business emails as well, so even messages like announcements about new product lines to former customers must comply.

Each email violating the CAN-SPAM Act can result in penalties of up to $43,280, making non-compliance expensive. Fortunately, following the law is straightforward. Below are the key requirements of the CAN-SPAM Act:

• Avoid misleading header information. Your "From," "To," "Reply-To," and routing information must be accurate. This includes the domain name and email address. These details should clearly identify the sender or business responsible for the message.

• Use truthful subject lines. Your subject line must match the content of the email. Deceptive subject lines are prohibited.

• Identify the email as an advertisement. While the law provides flexibility in how this is done, your email must clearly and prominently disclose that it is an advertisement.

• Include your physical location. Your message must display a valid physical postal address. This could be your street address, a P.O. box registered with the U.S. Postal Service, or a private mailbox registered through a commercial mail agency under Postal Service rules.

• Explain how to opt out of future emails. Your email must offer clear instructions for recipients to opt out of receiving future messages. This should be easy to recognize and understand, and you can use features like type, size, color, or placement to make it more visible. Provide a return email address or another internet-based option for recipients to opt-out. You can give them the choice to opt out of specific types of messages, but you must also include an option to stop all commercial emails. Ensure that your spam filters do not block opt-out requests.

• Process opt-out requests quickly. Any opt-out mechanism must remain functional for at least 30 days after you send the email. Requests to opt-out must be honored within 10 business days. You cannot charge fees, ask for more personal information than an email address, or require recipients to take any action beyond replying or visiting a single webpage. Once someone opts out, their email address cannot be sold or transferred.

• Oversee third-party actions. If you hire a company to handle email marketing on your behalf, you are still responsible for compliance. Both the business whose products are being promoted and the company sending the emails can be held accountable.

Need More Information?

Here are some common questions businesses ask about complying with the CAN-SPAM Act:

Q: How can I tell if the emails my business sends fall under the CAN-SPAM Act?
A: The key factor is the “primary purpose” of the message. Emails can include three main types of content:

• Commercial content – This promotes or advertises a commercial product or service, including content related to a commercial website.

• Transactional or relationship content – This supports an already agreed-upon transaction or provides updates about an ongoing transaction with a customer.

• Other content – This refers to content that is neither commercial nor transactional or relationship-based.

If the email contains only commercial content, its primary purpose is considered commercial, and it must follow the rules outlined in the CAN-SPAM Act. If the email contains only transactional or relationship content, its primary purpose is transactional or relationship-based. Such emails are exempt from most CAN-SPAM requirements but must still avoid using false or misleading routing information.

Q: How do I know if an email qualifies as a transactional or relationship message?
A: The primary purpose of an email is considered transactional or relationship-based if it contains only content that:

• Facilitates or confirms a commercial transaction the recipient has already agreed to.

• Provides warranty, recall, safety, or security details about a product or service.

• Notifies the recipient of changes in terms, features, or account balances related to a membership, subscription, account, loan, or other ongoing commercial relationship.

• Shares information about an employment relationship or employee benefits.

• Delivers goods or services as part of a transaction the recipient has already agreed to.

Q: What if an email includes both commercial content and transactional or relationship content?
A: It’s not unusual for businesses to send emails that combine commercial content with transactional or relationship content. In these cases, the primary purpose of the email determines how it is categorized.

To decide the primary purpose:

• If the subject line would lead a reasonable recipient to believe the email is promoting or advertising a commercial product or service, the email is considered commercial.

• If the transactional or relationship content is not presented primarily at the start of the message, the email is also deemed commercial.

So, when an email contains both types of content, if the subject line suggests it’s a commercial message, it is treated as such under the CAN-SPAM Act. Similarly, if the transactional or relationship portion of the message doesn’t appear prominently at the beginning, the email is classified as commercial for compliance purposes.

See an example below:

MESSAGE A
TO: Jane Smith
FROM: XYZ Distributing
SUBJECT: Your Account Statement

We shipped your order of 25,000 deluxe widgets to your Springfield warehouse on June 1st. We hope they arrived in good condition. If any widgets were damaged during transit, please contact our Customer Service Office at (877) 555-7726. As stated in our contract, payment of $1,000 is due by June 30th. A 10% late fee will be applied if the payment is not received by this date. For questions, feel free to reach out to our Accounts Receivable Department.

Check out our website to see our exciting new line of mini-widgets!

MESSAGE A is likely a transactional or relationship message and is only subject to the CAN-SPAM requirement of truthful routing information. A key factor is that the account-related information appears at the start of the email, while the brief promotional content is placed at the end.

MESSAGE B
TO: Jane Smith
FROM: XYZ Distributing
SUBJECT: Your Account Statement

We offer a wide selection of widgets in the latest designer colors and styles, all at unbeatable discount prices. Be sure to check out our website to explore our exciting new line of mini-widgets!

Sizzling Summer Special: Place your order by June 30th to get 20% off all waterproof, commercial-grade super-widgets. Plus, show us a competitor’s bid, and we’ll match it. At XYZ Distributing, we guarantee the best prices.

Your order has been processed and is scheduled for delivery on Friday, June 1st.

MESSAGE B is likely considered a commercial message and is subject to all CAN-SPAM requirements. Although the subject line reads “Your Account Statement,” which often suggests a transactional or relationship message, the content at the beginning is promotional. The brief transactional or relationship information is included at the end of the message.

Q: What happens if an email includes both commercial content and content classified as "other"?
A: If an email contains both commercial elements and content that falls under the category of "other," the message is considered commercial under the CAN-SPAM Act if:

• A recipient interpreting the subject line would reasonably believe the message is promoting or advertising a product or service.

• A recipient interpreting the body of the message would reasonably conclude that the primary purpose of the message is to advertise or promote a product or service.

Factors that influence this determination include the placement of the commercial content (e.g., whether it appears at the beginning of the email), the amount of the message dedicated to commercial content, and the use of design elements like color, graphics, type size, or style to emphasize the promotional content.

Q: If an email includes promotions from multiple companies, who is responsible for CAN-SPAM compliance?
A: When an email promotes goods, services, or websites from more than one company, there is a clear way to determine which company is responsible as the “sender” under the CAN-SPAM Act. The marketers involved can agree to designate one of them as the sender, provided that the chosen sender:

• Meets the Act’s definition of a “sender,” meaning they initiate the commercial email to advertise or promote their own products, services, or website.

• Is clearly identified in the “From” line of the email.

• Complies with the requirements for initiators under the Act, such as ensuring the email does not include misleading transmission information or subject lines, providing a valid postal address, including a functioning opt-out link, and clearly labeling the message as commercial or sexually explicit if applicable.

If the designated sender fails to fulfill these responsibilities, all companies mentioned in the message may be held accountable as senders under the CAN-SPAM Act.

Q: My company sends emails with a “Forward to a Friend” link. Who is responsible for complying with the CAN-SPAM Act in these cases?
A: Whether the sender or forwarder is considered the "initiator" or "sender" under the CAN-SPAM Act depends on the circumstances. Compliance responsibility often hinges on whether the seller provides an incentive for forwarding the email. For instance, if the seller offers rewards such as money, coupons, discounts, prizes, sweepstakes entries, or other benefits for forwarding the message, the seller may be held accountable under the Act. Similarly, if a seller compensates someone for generating traffic to a website or providing referrals, the seller is likely responsible for ensuring compliance with CAN-SPAM requirements.

Q: What are the penalties for violating the CAN-SPAM Act?
A: Each individual email that violates the law may incur penalties of up to $43,280. Multiple parties can be held liable for violations. For example, both the company whose product or service is promoted and the company that sends the message could face legal consequences.

Emails containing false or misleading claims about products or services may also fall under laws against deceptive advertising. Additionally, certain aggravated violations can lead to higher fines. Criminal penalties, including imprisonment, may apply to:

• Gaining unauthorized access to another person’s computer to send spam.

• Using false information to register multiple email accounts or domain names.

• Relaying or retransmitting spam through another computer to conceal the message’s origin.

• Collecting email addresses through harvesting or generating them via dictionary attacks (sending emails to random combinations of letters and numbers in hopes of reaching valid addresses).

• Exploiting open relays or proxies without permission.

Violating these provisions can result in severe consequences, so it’s essential to understand and adhere to the law.

Q: Are there specific rules for emails containing sexually explicit material?
A: Yes, emails with sexually explicit content must adhere to additional rules. The subject line must begin with the warning “SEXUALLY-EXPLICIT:”. Furthermore, the body of the message must include the electronic equivalent of a “brown paper wrapper.” When the recipient opens the email, the only visible content should be:

• The words “SEXUALLY-EXPLICIT:”.

• The same information is required for any commercial email, such as a clear disclosure that the message is an advertisement, the sender’s physical postal address, and instructions on how the recipient can opt out of future messages.

This initial display does not allow graphics. This ensures that recipients cannot see sexually explicit material unless they take an intentional action, such as scrolling down or clicking a link.

However, this requirement does not apply if the recipient has already given clear, affirmative consent to receive sexually explicit messages from the sender.