Governance, risk & compliance

CAN-SPAM Act and FTC CAN-SPAM Rule 15 U.S.C. 7701 to 7713; 16 CFR Part 316 (eCFR 2026-10-20)

The Controlling the Assault of Non-Solicited Pornography and Marketing (CAN-SPAM) Act of 2003, 15 U.

S. C.

7701 to 7713, and the FTC rule at 16 CFR Part 316, for commercial email sent to US recipients. It is an opt-out law: no prior consent is needed to send commercial email, but the message must not have false or misleading header information (s.

7704(a)(1)) or a deceptive subject line (s. 7704(a)(2)), must carry a working opt-out mechanism that is valid for at least 30 days (s.

7704(a)(3)), must be honoured within 10 business days (s. 7704(a)(4)), and must identify itself as an advertisement unless the recipient consented, give an opt-out notice and include a valid physical postal address (s.

7704(a)(5)). The sender may not charge a fee or ask for more information than an email address to opt out (16 CFR 316.

5) and may not transfer the address of someone who opted out. Aggravated violations (s.

7704(b)) cover harvesting addresses, dictionary attacks, automated account creation and relaying through unauthorized access. The FTC business guide says the law has no business-to-business exception and that a company cannot contract away its legal responsibility to a vendor; both the advertiser and the party that initiates the message can be responsible (ss.

7702 and 7705). Enforcement is by the FTC, other federal agencies, state attorneys general (statutory damages of up to $250 per message, capped at $2,000,000 except for header violations, and increased up to three times for willful or aggravated violations) and Internet access service providers; ordinary recipients have no private right of action (s.

7706). The FTC civil penalty figure in 16 CFR 1.

98 was $53,088 per violation in the eCFR text of 20 October 2026 and is adjusted every year. State laws are preempted except for falsity and deception (s.

7707(b)). Tiers: SENDER for advertisers and anyone who initiates messages, and ESP for email service providers that send for others.

General information, not legal advice.

Assessment tiers & levels Lavawall supports

Lavawall assesses CAN-SPAM Act and FTC CAN-SPAM Rule at every level below, so you can start where you are and step up as your program matures.

How Lavawall® helps you get to CAN-SPAM Act and FTC CAN-SPAM Rule compliance

Most of CAN-SPAM Act and FTC CAN-SPAM Rule comes down to technical controls you have to run and prove: keeping systems patched, hardening configuration, detecting breaches early, backing up what matters, controlling access, and keeping evidence that all of it actually happened. Lavawall® runs those controls across Windows, macOS, Linux, and Microsoft 365 / Google Workspace from one console, maps them to CAN-SPAM Act and FTC CAN-SPAM Rule, and tracks your posture continuously instead of once a year at audit time.

• Assess your current state against CAN-SPAM Act and FTC CAN-SPAM Rule in the Lavawall GRC module, with the questionnaire and control set built in.
• Remediate the gaps with the same platform — automated patching, configuration fixes, backups, and access review — not a separate project.
• Evidence everything with timestamped, exportable records auditors, insurers, and clients accept.

Related

Lavawall® supports CAN-SPAM Act and FTC CAN-SPAM Rule as part of a built-in catalogue of compliance frameworks. Framework requirements are summarized for planning purposes; always confirm the current official text before certifying.