CAN-SPAM for course senders: the footer checklist

What the law actually regulates

CAN-SPAM, in force since 2004, governs commercial electronic mail: messages whose primary purpose is to advertise or promote a commercial product or service. It draws a line between those and transactional or relationship messages, the ones that complete a transaction the recipient has already agreed to or deliver information about an existing relationship. Transactional messages are exempt from most of the requirements but not from the first one: the header information may not be false or misleading in any message.

There is no consent requirement and no small-sender exemption. The FTC guide is explicit that the law covers all commercial messages including business-to-business email, and that there is no exception for a first message or for a list you bought. Nor is there a threshold: the same rules apply to a hundred messages a month and to a hundred million.

For an email course the primary-purpose test is usually easy and occasionally not. A course whose emails teach something and end with an invitation to buy is commercial, and treating it as anything else is a bet on how a regulator reads your own copy. Put the footer on all of it.

The seven requirements, in the FTC’s own order

The compliance guide lists seven main requirements. Six of them are things in the message, and the seventh is about anybody you pay to send it. The table below is that list with what each one means for a small sender.

What getting it wrong costs

The FTC guide states that each separate email in violation of CAN-SPAM is subject to a civil penalty, and the maximum is adjusted for inflation each year; in recent years the published figure has stood above $50,000 per message. Per message is the part that matters. There is no per-campaign cap, so the arithmetic on a footer that was missing an address for a send to a list of ten thousand is not a number anybody wants to defend.

Additional provisions cover aggravated violations such as address harvesting and dictionary attacks, and some conduct can be criminal. Those are not risks a careful small sender runs into by accident, which is the point worth taking from this section: the whole exposure for an honest course sender is a footer, a working unsubscribe and a suppression list applied before the next send.

How it differs from the GDPR and CASL

CAN-SPAM is an opt-out regime. You may send until the recipient asks you to stop, and the law regulates the manner of sending and the exit. European rules are an opt-in regime: the ePrivacy rules generally require consent before an unsolicited commercial message, and the GDPR defines what that consent has to be and requires you to be able to demonstrate it. Nothing in CAN-SPAM asks you to keep a record of how an address arrived.

Canada’s CASL is stricter than both in its starting position. It requires express or implied consent before a commercial electronic message, requires you to keep records of that consent, requires prescribed sender identification, and requires an unsubscribe mechanism that works for at least 60 days. The CRTC publishes maximum administrative monetary penalties of up to CAD 1 million for an individual and CAD 10 million for an organisation.

The practical consequence of three regimes is not three lists. If you publish in English you have readers in all three jurisdictions, and the only maintainable answer is to run the strictest version everywhere: consent recorded before the first message, sender and postal address in every footer, an unsubscribe honoured immediately rather than within any of the published windows. Compliance then stops being a per-country question and becomes one path through the code.

The footer, written out

Here is the whole of what CAN-SPAM asks for in the message, as text you can paste and fill in. Put it at the foot of every email in the course, including day one, and keep it as real text rather than an image so that it survives a client with images off.

The footer, line by line:

• You are getting this because you signed up for [the course title] at [your site] on [the date]. That sentence is not required by the statute, and it is the single most effective line for stopping a spam complaint from somebody who has forgotten.
• [Your name or business name], [street address or registered post office box], [city, region, postcode, country]. A real physical postal address, required in every commercial message.
• Unsubscribe: [one link, plain visible text, no login, no reason required]. Honoured immediately in practice, well inside the 10 business days the law allows and the two days the large mailbox providers require.