CAN-SPAM Act

CAN-SPAM sets the ground rules for commercial email sent to US recipients. It covers marketing email, and it generally covers cold B2B outreach too. The core design choice is that it's opt-out rather than opt-in: a sender doesn't need permission before the first email, but has to make it easy to say no and then honor that request once it comes in.

In practice that means using accurate sender identification instead of a spoofed or misleading From line, writing subject lines that describe what's actually inside the email, including a physical address, and processing opt-out requests promptly. The specifics of what counts as fully compliant sit with counsel, not a glossary entry, but those are the pillars the law is built around.

CAN-SPAM is also narrower than it sometimes gets treated. It's a legal floor, not a deliverability strategy. A sender can be fully compliant with the law and still land in spam, because inbox placement runs on authentication, sending reputation, and recipient engagement, none of which the law itself governs. Whether a message is legal and whether it lands are two different questions, evaluated by two different systems, even though the same email has to clear both.