Spam Email: Your Rights Under the CAN-SPAM Act

The CAN-SPAM Act, formally known as the Controlling the Assault of Non-Solicited Pornography And Marketing Act of 2003, is the primary federal law governing commercial email in the United States. Codified at 15 U.S.C. 7701-7713 and enforced by the Federal Trade Commission, the law establishes requirements for commercial messages, gives recipients the right to stop receiving emails, and sets penalties for violations.

What the CAN-SPAM Act Covers

The law applies to any electronic mail message whose primary purpose is the commercial advertisement or promotion of a commercial product or service. This includes email that promotes content on a commercial website. The law does not apply to transactional or relationship messages (such as order confirmations, account statements, or warranty information), although these messages may not contain false or misleading routing information.

The CAN-SPAM Act applies regardless of whether the recipient is a customer or a stranger. Even if someone has purchased from the sender before, the sender must still comply with the law when sending marketing or promotional emails.

The Seven Requirements for Commercial Email

The FTC has identified seven main requirements that senders of commercial email must follow:

• No false or misleading header information. The "From," "To," "Reply-To," and routing information must be accurate and identify the person or business that initiated the message.
• No deceptive subject lines. The subject line must accurately reflect the content of the message.
• Identify the message as an advertisement. The law gives senders flexibility in how to do this, but the disclosure must be clear and conspicuous.
• Include the sender's valid physical postal address. This can be a current street address, a P.O. Box registered with the U.S. Postal Service, or a private mailbox registered with a commercial mail receiving agency.
• Tell recipients how to opt out. Every commercial email must include a clear and conspicuous explanation of how the recipient can opt out of receiving future email from the sender.
• Honor opt-out requests within 10 business days. Once a recipient opts out, the sender must stop sending within 10 business days. The sender may not charge a fee, require any information beyond an email address, or make the recipient take any step other than sending a reply email or visiting a single page on a website.
• Monitor what others are doing on your behalf. Even if a company hires another company to handle its email marketing, the originating company remains legally responsible for compliance.

Penalties for Violations

Each separate email sent in violation of the CAN-SPAM Act is subject to penalties. The FTC can impose fines of up to $51,744 per violation under its enforcement authority. For a company sending thousands of non-compliant emails, the potential liability can be substantial.

How the Law Is Enforced

The CAN-SPAM Act is enforced by the Federal Trade Commission, state attorneys general, and Internet Service Providers. Unlike many other consumer protection statutes such as the FCRA, the FDCPA, and the TCPA, the CAN-SPAM Act does not provide a private right of action for individual consumers. This means that individual recipients of spam email cannot file a lawsuit under the CAN-SPAM Act to recover damages.

What You Can Do About Spam Email

While you cannot sue under the CAN-SPAM Act directly, there are several effective steps you can take:

• Use the opt-out mechanism. Every legitimate commercial email must include a way to unsubscribe. Use it. The sender has 10 business days to honor your request.
• Report spam to the FTC. Forward unwanted or deceptive spam email to spam@uce.gov. The FTC uses these reports to build enforcement cases against the worst offenders.
• Report to your email provider. Most email providers (Gmail, Outlook, Yahoo) have built-in spam reporting tools. Reporting helps improve filtering for all users.
• File a complaint with the FTC. You can file a formal complaint at reportfraud.ftc.gov if you believe a company is violating the CAN-SPAM Act.
• Document the emails. If the spam is persistent and connected to other violations (such as robocalls, debt collection, or identity theft), save the emails as evidence for potential related claims.

When Spam Email Connects to Other Claims

While the CAN-SPAM Act itself does not give individuals the right to sue, spam email is often part of a broader pattern of illegal conduct that IS actionable under other federal statutes:

• Robocalls and spam texts (TCPA): Companies that send spam email frequently also make robocalls or send automated text messages. The Telephone Consumer Protection Act provides $500 to $1,500 per violation for unwanted calls and texts, and individuals CAN sue directly.
• Debt collection harassment (FDCPA): If the spam email is from a debt collector using deceptive or abusive tactics, the Fair Debt Collection Practices Act may apply, with statutory damages and fee-shifting.
• Deceptive business practices: Under New York GBL 349/350, deceptive marketing practices, including misleading email campaigns, may give rise to state law claims with treble damages.
• Identity theft: Phishing emails that impersonate legitimate businesses may constitute identity theft, and inaccurate information resulting from such schemes can be challenged under the FCRA.

If you are receiving spam email and are also being contacted by robocalls, text messages, or debt collectors, you may have actionable claims under statutes that do provide a private right of action. Contact us for a free consultation to evaluate whether your situation involves violations beyond the CAN-SPAM Act.