What is CAN-SPAM Act?

The CAN-SPAM Act is the United States law that sets rules for commercial email. It came into force in 2004 and is enforced by the Federal Trade Commission. Unlike the GDPR or India’s DPDP Act, CAN-SPAM does not require consent before you send a commercial email. Instead it requires that every message is honest and that people can easily stop further messages.

Its main requirements are: header information (From, To, Reply-To and routing) must be accurate; subject lines must not mislead about the content; the message must be identifiable as an advertisement where it is one; it must include a valid physical postal address for the sender; and it must offer a clear way to opt out. Opt-out requests must be honoured within 10 business days, and the opt-out mechanism must keep working for at least 30 days after the email is sent.

The law applies to commercial messages received in the US, whoever sends them. An Indian business emailing customers in the United States is covered for those messages. Transactional or relationship messages, such as order confirmations and account notices, are largely exempt from most requirements but must not contain false or misleading routing information.

Penalties are set per email and can be very large, and both the company whose product is promoted and the one that sends the message can be held responsible. A practical approach for Indian senders with US subscribers is to follow the stricter consent-based standard you already need for India and the EU, then make sure your postal address and unsubscribe link appear in every marketing email.