United StatesCAN-SPAM Act
15 U.S.C. 7701 et seq.; 16 CFR Part 316
In force since .
A commercial messages rule binding public and private bodies.
- Obligation class
- Consent, Disclosure
What it requires
- Every commercial email must carry accurate header and routing information, a subject line that is not deceptive about the message's contents, clear and conspicuous identification that the message is an advertisement unless the recipient gave prior affirmative consent, a functioning return address or other opt-out mechanism, and a valid physical postal address of the sender.NIST Privacy FrameworkCM.AW-P1NIST Privacy FrameworkCT.PO-P3
- Honor an opt-out request within 10 business days, and do not sell, lease, or transfer the recipient's address after receiving the request except to a person retained to help you comply with it.NIST Privacy FrameworkCT.PO-P3
- This is an opt-out regime, not opt-in: you may send a commercial email without the recipient's prior consent so long as it carries the disclosures above. A transactional or relationship message, such as one that facilitates a transaction the recipient already agreed to or delivers goods the recipient is entitled to, is exempt from these commercial-message duties unless a recipient would reasonably conclude its primary purpose is commercial.
- Do not harvest email addresses from a website or generate them by an automated dictionary attack, and do not falsify the domain name registration information used to send the mail.NIST Privacy FrameworkCT.PO-P1
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
- CT.PO-P3Policies, processes, and procedures for enabling individuals’ data processing preferences and requests are established and in place.
- CM.AW-P1Mechanisms (e.g., notices, internal or public reports) for communicating data processing purposes, practices, associated privacy risks, and options for enabling individuals’ data processing preferences and requests are established and in place.
- FINOS AIGF
- AIR-DET-021Agent Decision Audit and Explainability
Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
If you get it wrong
Private right of actionNo
Penalty structure
Federal Trade Commission civil penalty under 15 U.S.C. 45(m)(1)(A)/(B), for enforcement of this chapter as an unfair or deceptive act or practice under 15 U.S.C. 7706(a).
- Rule
- Per violation only
- As of
- Currency
- USD
- Per violation unit
- Violation
- Per violation amount
- 53,088
Statutory damages
Not available to an individual recipient. A State, suing as parens patriae for its residents under 15 U.S.C. 7706(f), may recover the greater of actual monetary loss or statutory damages of up to $250 per violation (uncapped for a falsified-header violation under section 7704(a)(1), otherwise capped at $2,000,000 in aggregate), trebled at the court's discretion for a willful or knowing violation. A provider of Internet access service adversely affected by a violation may separately sue under 15 U.S.C. 7706(g) for up to $100 per violation of the falsified-header provision or $25 per violation of any other provision, capped the same way.
- As of
- Currency
- USD
Who enforces it
Enforcement body
Federal Trade Commission; certain Federal banking, securities, and transportation regulators over entities they otherwise supervise; State attorneys general as parens patriae; an adversely affected provider of Internet access service
What this law does
The CAN-SPAM Act uses an opt-out model: a sender may transmit a commercial electronic mail message without the recipient's prior consent, so long as the message carries accurate header and routing information, a non-deceptive subject line, clear and conspicuous identification that it is an advertisement (unless the recipient gave prior affirmative consent), a functioning opt-out mechanism, and a valid physical postal address, and the sender stops messages within 10 business days of an opt-out request.
A transactional or relationship message, one that facilitates an already-agreed transaction or delivers warranty, safety, or entitled-goods information, is exempt from these commercial-message duties under 16 CFR 316.3 unless a recipient would reasonably conclude its primary purpose is commercial. Aggravated violations, address harvesting, dictionary attacks, and falsified domain registration used to send the mail, carry heightened damages.
The Act is enforced by the Federal Trade Commission as an unfair or deceptive act or practice and by certain sector regulators; it gives no individual recipient a private right of action, but a State attorney general suing as parens patriae for its residents, or an Internet access service provider adversely affected by a violation, may recover statutory damages without proving loss.
How courts have read itPremium data
Our analysis of this law draws on 1 court ruling.
What each ruling held, what it means for an app, and whether it still stands are premium data, in the Plus, Pro and Enterprise plans.
When LexLint raises it
When your app profile says your app sends commercial email.
Back to the example · Lint your app
Page updated .