Email Follow-Up Rules for Small Businesses: CAN-SPAM in Plain English

Follow-up emails, seasonal reminders and “we’re booking spring cleanups now” messages are some of the lowest-cost marketing a service business can do. They’re also covered by a federal law, the CAN-SPAM Act, which the Federal Trade Commission enforces. This guide sums up the FTC’s own compliance guide in plain words, then adds what Gmail and Yahoo require of senders. It’s general information, not legal advice.

Which emails does CAN-SPAM cover?

Federal (FTC): the FTC’s guide says that, despite its name, CAN-SPAM “doesn’t apply just to bulk email.” It covers all commercial messages, which the law defines as “any electronic mail message the primary purpose of which is the commercial advertisement or promotion of a commercial product or service.” The FTC adds: “The law makes no exception for business-to-business email.”

So a single email to past customers announcing a new service counts. What matters is the message’s primary purpose.

What does CAN-SPAM require?

The FTC lists these main requirements:

1. Don’t use false or misleading header information. Your “From,” “To,” “Reply-To” and routing information must be accurate and identify who sent the message.
2. Don’t use deceptive subject lines. The subject line must accurately reflect the content.
3. Identify the message as an ad. The FTC says you have “a lot of leeway” in how, but the disclosure must be clear and conspicuous.
4. Tell recipients where you’re located. Include a valid physical postal address: your street address, a registered U.S. Postal Service box, or a registered private mailbox.
5. Tell recipients how to opt out of future marketing email, in a way that’s easy for an ordinary person to recognize and understand.
6. Honor opt-outs promptly. Your opt-out must work for at least 30 days after you send, and you must honor a request within 10 business days. You can’t charge a fee, ask for more than an email address, or make people do more than reply or visit a single web page.
7. Don’t sell or transfer the addresses of people who opted out, except to a company you’ve hired to help you comply.
8. Monitor what others do on your behalf. If you hire an email marketing company, you’re still legally responsible.

The FTC’s guide says each separate email in violation “is subject to penalties of up to $53,088.” That was the figure on the guide when we checked; see the FTC page for the current amount.

What about appointment reminders and invoices?

The FTC calls these “transactional or relationship” messages. If an email’s primary purpose is, for example, to confirm a job the customer already agreed to, give warranty or safety information about work you did, or deliver an invoice for an agreed transaction, it is exempt from most of CAN-SPAM, though it still can’t have false or misleading routing information.

The catch is mixed emails. The FTC says that if a recipient reading the subject line would likely think the email is an ad, or if the transactional part doesn’t appear mainly at the beginning, the primary purpose is commercial. An appointment reminder with “20% off gutter cleaning!” in the subject line is a commercial email. The FTC also says it views the transactional categories “narrowly.”

What do Gmail and Yahoo require?

Separate from the law, the big inbox providers set rules for senders. If you send through a reputable email service, most of the technical items are handled for you once you verify your domain, but check.

• Gmail: Google’s sender guidelines say that starting February 1, 2024, all senders to Gmail accounts must set up SPF or DKIM authentication, use TLS and keep spam rates reported in Postmaster Tools below 0.3%, among other requirements. Senders of more than 5,000 messages a day must also set up DMARC, and their marketing messages “must support one-click unsubscribe, and include a clearly visible unsubscribe link in the message body.”
• Yahoo: Yahoo’s Sender Hub lists similar requirements: SPF or DKIM for all senders and a spam rate below 0.3%. Bulk senders need both SPF and DKIM, a DMARC policy of at least p=none, one-click unsubscribe, and must “honor unsubscribes within 2 days.”

Yahoo’s 2-day window is shorter than CAN-SPAM’s 10 business days. Honoring unsubscribes right away keeps you inside both.

What should your email footer include?

A footer that covers the CAN-SPAM basics can be short. For example:

Most email services add the address and unsubscribe link automatically once you fill them in under account settings. Send yourself a test and click the unsubscribe link to make sure it works. If you offer a preferences page with different types of email, the FTC says it must still include an option to stop all marketing messages from you.

Who is responsible if a vendor sends the email?

You are, along with the sender. The FTC’s guide says that even if you hire another company to handle your email marketing, “you can’t contract away your legal responsibility to comply with the law,” and that both the company whose product is promoted and the company that sends the message may be held legally responsible. If a marketing agency or lead service emails people on your behalf, ask to see a sample, the footer and how they handle opt-outs.

Can you use AI to write marketing emails?

Yes, for drafts. Check the result against the list above: an AI tool doesn’t know your postal address or which subject lines are accurate. Watch for subject lines that overpromise, because CAN-SPAM requires that the subject line reflect the content. Don’t paste your customer list into a consumer AI tool; our guide to using AI for customer replies covers privacy settings, and the AI prompt starter kit has an email prompt.

Does CAN-SPAM cover text messages?

Marketing texts are covered by other federal rules, including the Telephone Consumer Protection Act, with their own consent requirements. Our sister site has a plain-English guide to texting customers and TCPA rules.

Marketing email checklist

• “From” name and address clearly show your business.
• Subject line accurately describes what’s inside.
• The email is clearly identifiable as an ad or promotion.
• Your valid postal address is in the footer.
• A visible unsubscribe link that works for at least 30 days.
• Unsubscribes honored right away (CAN-SPAM allows 10 business days; Yahoo asks bulk senders for 2 days).
• Your sending domain is set up with SPF and DKIM, and DMARC if you send in bulk.
• If a vendor sends for you, you’ve checked their settings.

Email is most useful as part of a follow-up plan. See how to answer new leads fast and how to track leads with GA4 using UTM tags on email links.