The CAN-SPAM Act is a federal law that covers any commercial email — meaning emails sent to promote or sell something. That includes newsletters, product announcements, promotional offers, basically anything that isn’t just a personal message between two people. And one of its clearest requirements is this: every commercial email you send must include a visible, working way for the recipient to opt out.
No unsubscribe link? That’s a violation. And the fine isn’t a slap on the wrist.
According to the FTC, each separate email in violation can cost you up to $53,088. Not per campaign. Per email. So if you sent one blast to 500 subscribers without an unsubscribe option, you could theoretically be looking at millions of dollars in penalties — though the FTC typically pursues enforcement against businesses with patterns of violations rather than one-off mistakes. Still, that’s how seriously the federal government takes this.
And they actually enforce it. In 2023, the FTC took action against a business for CAN-SPAM violations — the proposed settlement hit $650,000 in civil penalties, plus the company had to change how it operates going forward.
One thing worth knowing: CAN-SPAM applies to commercial email only. Political messages and non-commercial bulk emails aren’t covered. But if you’re collecting emails through a website to sell, promote, or market anything — you’re in commercial territory, and the rules apply to you.
Also keep in mind: if your email list includes people in Canada or the European Union, those countries have their own stricter email laws (Canada’s CASL and the EU’s GDPR, for example). CAN-SPAM is the US floor, not the global ceiling.
The fix is easy. Every email platform worth using (Mailchimp, ConvertKit, Substack, all of them) builds unsubscribe functionality in automatically. If you’re rolling your own email system or using something sketchy, double-check that the opt-out is there and that it actually works. A broken unsubscribe link counts as a violation too.