E-commerce
September 16, 2026
Are you wondering what the CAN-SPAM rules are to comply with when sending commercial emails to US-based customers? The answer lies in a few specific requirements: clear sender identification, a valid physical address, a functional opt-out link, and prompt processing of requests. This is essential for any merchant who wants to grow their store without the risk of financial penalties.
The CAN-SPAM Act of 2003 applies to almost all commercial email messages, whether they are intended for individuals or professionals. It does not require prior consent, but it strictly regulates the content and the management of recipient lists. An oversight can be costly, even for a small business.
So, how do you make your email campaigns compliant? On the agenda:
What is the CAN-SPAM Act and who does it apply to?
What are the mandatory disclosures in every email?
How do you handle opt-out requests properly?
What are the penalties for non-compliance?
How does Qstomy help secure your mailings?
Let's get started.
Summary
What is the CAN-SPAM Act and why should you know about it?
The CAN-SPAM Act, signed in 2003, regulates the sending of commercial electronic messages to recipients located in the United States. Its objective is to protect consumers from misleading or unsolicited emails. The full name is "Controlling the Assault of Non-Solicited Pornography And Marketing".
This regulation applies to any electronic communication with a commercial purpose, whether it is intended for individuals (B2C) or professionals (B2B). It covers both marketing messages and transactional messages, such as order confirmations. For a merchant, knowing it is essential if you sell online to the United States.
Unlike other laws, such as Canadian legislation, CAN-SPAM does not require you to obtain explicit consent before sending an email. On the other hand, it imposes strict rules on content and opt-out management. An error can result in significant fines.
Convert over 2,000 customers on average per month with Qstomy.
The world’s 1st Shopify AI dedicated to customer conversion
Empowering 200+ e-commerce merchants
What is the difference between transactional email and marketing email?
The distinction is important because the requirements are not the same. A transactional email confirms an action already taken by the customer, such as an order, a payment, or an appointment. For this type of message, the main rule is that the information provided must be accurate and not misleading.
A marketing email, on the other hand, aims to promote a product, an offer, or a brand. It must comply with all obligations of the CAN-SPAM Act: clear identification of the sender, non-misleading subject line, mention of its advertising nature, physical address, and an opt-out link.
Let's take a concrete example: an email confirming a service appointment is transactional. An email offering a discount on a future visit is marketing. Make sure to clearly identify the nature of each message you send in order to apply the correct rules.
What information must be included in your emails?
Every commercial email you send must contain accurate and verifiable information. The goal is to avoid any confusion for the recipient. The "From" field must clearly identify your company or brand. It is forbidden to use a name that is not yours, such as "Amazon" if you are not Amazon.
The subject line of the message must accurately reflect the content. A catchy subject line is allowed, but it must not be misleading. If your email is an advertisement, the content must visibly mention it, for example with the label "Advertisement" or "Promotional Offer".
Finally, you must include a valid physical address in the body of the email. This can be your headquarters address or a P.O. Box. This address is used, among other things, for opt-out requests sent by physical mail.
How does the unsubscribe link obligation work?
The CAN-SPAM Act requires that every marketing email contain a clear and conspicuous unsubscribe link. This link must allow the recipient to opt out of all your mailing lists, not just a specific campaign. It must be easy to find and use.
When a customer clicks on this link, you must process their request within 10 business days. Most emailing platforms automate this process. As soon as someone unsubscribes, their address must be added to a global suppression list.
This list must be kept indefinitely, even if you change email service providers. Failing to comply with this requirement is considered a violation of the law. Remember to regularly check that your unsubscribe process is working properly.
How long does it take to process a cancellation request?
The legal timeframe for processing an unsubscription request is 10 business days. This period begins the moment the recipient clicks on the unsubscribe link. Once this period has passed, you can no longer send them commercial messages.
Professional e-mailing platforms generally handle this operation automatically. Therefore, you do not have to perform any manual action. However, you must ensure that synchronization is correct, especially if you use multiple tools or if you change service providers.
It is forbidden to request additional information from the recipient to process their request, such as a password or confirmation by email. The process must be simple and direct. One exception: you can request a confirmation if the unsubscribe link is used by a third party.
Who is responsible in the event of non-compliance with the law?
Responsibility does not lie solely with the sender. Agencies and consultants who send emails on behalf of a client are also responsible. If you use a service provider for your campaigns, you must ensure that they comply with the rules.
This means you must verify that your emails contain all mandatory information, even if an agency writes and sends them. A violation can lead to prosecution against both parties.
To avoid any issues, establish a clear contract with your service providers. Specify who is responsible for list compliance, content, and unsubscribe management. Good communication prevents bad surprises.
What are the penalties under the CAN-SPAM Act?
Financial penalties can be heavy. The law provides for fines of up to $43,792 per violation. Each non-compliant email can be considered a separate violation, which can make the bill climb very quickly.
Fortunately, most email marketing platforms integrate protection mechanisms. For example, they refuse to send an email without an unsubscribe link or a physical address. These safeguards help avoid good faith errors.
It is important to note that penalties also apply to transactional emails if the information is false or misleading. Even if the requirements are less stringent for this type of message, the accuracy of the information remains an absolute obligation.
How to set up a compliant e-mailing strategy?
To be compliant, start by auditing your current practices. Verify that every email sent contains clear identification, a non-misleading subject line, a physical address, and an opt-out link. Regularly test your forms and links.
Use a reputable email service provider that adheres to industry standards. These platforms update their features to stay compliant with legal developments. They help you manage opt-outs and keep your lists clean.
Also, consider training your marketing team. Explain the basics of the CAN-SPAM Act and the consequences of non-compliance. An informed team is less likely to make costly mistakes. To go further, discover how email marketing fits into an overall strategy.
What are the pitfalls to avoid with the CAN-SPAM Act?
The first trap is to think that the law only applies to large senders. In reality, it concerns any business that sends commercial emails to US recipients, regardless of its size. Even a small online store is affected.
The second trap is to neglect transactional emails. Although the requirements are reduced, they must contain accurate information. A misleading subject line in an order confirmation can be penalized.
Finally, do not think that unsubscribing is optional. Some merchants hesitate to add it for fear of losing subscribers. This is a mistake: the link is mandatory and its absence can lead to fines. A clean list is more effective than a purchased or unengaged list.
How does the CAN-SPAM Act interact with other regulations?
The CAN-SPAM Act is not the only regulation governing digital communications. Other data protection laws, such as the GDPR in Europe, impose additional obligations. If you sell internationally, you must comply with each applicable legislation.
For example, the GDPR requires explicit consent before sending marketing emails, which CAN-SPAM does not require. You must therefore adapt your strategy based on the location of your customers. A segmented approach is often the best solution.
For merchants using platforms like Shopify, it is essential to correctly configure consent collection and management tools. This protects you legally and improves your customers' trust. A good customer support policy can also help clarify your practices.
How does Qstomy help secure your shipments and client relationships?
Qstomy, the Shopify AI agent, helps you streamline customer relations, which reduces the risk of complaints and unsubscribe requests. By guiding your buyers to the right products and ensuring efficient parcel tracking, you improve their experience and limit unsolicited messages.
With Qstomy, you can automate part of your after-sales service: answers to frequently asked questions, order tracking, return policy. A satisfied customer is less likely to consider your emails as spam. This protects your sender reputation.
Qstomy also helps you better understand your customers' behavior to personalize your campaigns. Relevant emails are less frequently marked as spam. In addition, a well-thought-out digital marketing strategy reinforces the effectiveness of your mailings.
What checklist should you use before sending your next campaign?
Before clicking "Send", check the following points to stay compliant with the CAN-SPAM Act. This simple checklist will help you avoid costly mistakes.
In brief
Identification: the sender's name is clear and accurate.
Subject line: it reflects the content without being misleading.
Physical address: it is present in the body of the email.
Opt-out: the unsubscribe link is visible and functional.
Timeframe: requests are processed within 10 business days.
FAQ
Does CAN-SPAM apply to B2B emails? Yes, the law covers all commercial messages, including those intended for professionals.
Can I buy an email list? The law does not forbid it, but it requires your messages to be compliant. A purchased list increases the risk of complaints.
What happens if I do not include an unsubscribe link? You risk fines of up to $43,792 per email sent.
To go further: Why use social media for e-commerce customer service? - Qstomy, E-commerce digital marketing: channels, tools and tactics - Qstomy, E-commerce support policy: writing clear rules for customers and agents - Qstomy, E-commerce SEO strategy for category pages - Qstomy, How does e-commerce use email marketing? - Qstomy, How does SEO work for e-commerce sites? - Qstomy, Which platform to choose to sell digital products? - Qstomy.
Enzo
September 16, 2026
