Most of the CAN-SPAM Act is about honesty: real sender names, subject lines that match the email, a postal address. But the part that trips up small businesses in practice is the opt-out. The law is specific about how an unsubscribe has to work, how long it has to keep working, and how fast you have to act on it. This article goes through those rules one by one, with the wording from the statute and the FTC's guide, and ends with examples of footers that meet them.
For the full list of CAN-SPAM requirements, see our CAN-SPAM guide. This article covers only the opt-out part. It is general information, not legal advice.
The opt-out rules at a glance
| Rule | What it means for your newsletter | Where it comes from |
|---|---|---|
| A clear and conspicuous way to opt out | Every commercial email needs an obvious explanation of how to stop receiving mail from you | 15 U.S.C. § 7704(a)(3) and (a)(5) |
| Reply email or a single web page only | The opt-out has to work by replying to the email or visiting one web page. Nothing more may be required | 16 CFR § 316.5 |
| The mechanism must work for at least 30 days | The link or reply address has to keep functioning for no less than 30 days after you send the message | 15 U.S.C. § 7704(a)(3)(A)(ii) |
| Honor the request within 10 business days | After 10 business days, sending another commercial email covered by the request is unlawful | 15 U.S.C. § 7704(a)(4)(A) |
| No fee, no extra information, no login | You cannot charge, ask for anything other than an email address and preferences, or add steps | 16 CFR § 316.5 |
| No selling or transferring opted-out addresses | You may not sell, lease, exchange or release an address once its owner has opted out | 15 U.S.C. § 7704(a)(4)(A)(iv) |
Rule 1: a clear way to opt out, in every commercial email
The statute makes it unlawful to send a commercial email that does not contain "a functioning return electronic mail address or other Internet-based mechanism, clearly and conspicuously displayed" that the recipient can use to say they do not want future commercial email from you. Separately, every commercial message must give "clear and conspicuous notice of the opportunity" to decline further email.
In plain terms: an unsubscribe link in the footer, in readable type, with words a normal person understands. The FTC's compliance guide adds two practical points. You may offer a menu of choices (for example, "monthly digest only" or "stop everything"), but one option must stop all commercial messages. And you should make sure your own spam filter does not block incoming opt-out requests, which matters if you use a reply-to-unsubscribe address.
Rule 2: reply email or a single web page, nothing else
The FTC's rule at 16 CFR § 316.5 says you cannot require the recipient to "take any other steps except sending a reply electronic mail message or visiting a single Internet Web page." That rules out some things that still show up in the wild:
- A link that leads to a login screen before the person can unsubscribe.
- A form that asks for a name, a reason, or a password.
- A two-page flow: a preferences page, then a confirmation page, then a final button.
A page with a single "Unsubscribe" button is fine. A page that pre-fills the address and asks the person to click once is fine. The moment the person has to type anything other than their email address, or visit a second page, you have gone past what the rule allows.
Rule 3: the link must keep working for 30 days
The opt-out mechanism must remain "capable of receiving such messages or communications for no less than 30 days after the transmission of the original message." The 30 days count from the send date of each individual email. The practical answer is to never expire unsubscribe links at all. There is no benefit to switching them off, and an expired link is the kind of mistake that shows up in a complaint.
Watch out for this when you change email tools. If your old tool's unsubscribe links stop working the day you cancel the account, emails you sent in the previous month now have dead opt-out links. Keep the old account alive for at least 30 days after your last send from it.
Rule 4: honor the request within 10 business days
Once someone opts out, it is unlawful for you, or anyone sending on your behalf, to send them a commercial email "more than 10 business days after the receipt of such request." Ten business days is a ceiling, not a target. Mailbox providers expect faster: Yahoo's sender best practices tell bulk senders to honor unsubscribes within 2 days. Most newsletter tools, including ours, remove the address immediately.
"Honor" also means honoring it everywhere the request applies. If the person clicked "stop everything," that covers all of your commercial lists, not just the one they were on when they clicked. Keep a single suppression list across every list and every tool you use, and check it before you import addresses from a spreadsheet or a trade-show scanner.