emailrules.today
In forceContentIn force 17 Jan 2025

CAN-SPAM is $53,088 per email, and that did not rise in 2026

What is the CAN-SPAM fine per email?

United States

In one sentence

US does not require — it requires honest subjects, a physical address, and a working within ten business days.

Plain English

Unlike much of Europe, US federal law lets you email commercial messages without prior if you meet the rules: no deceptive From/subject, a real postal address, clear commercial nature when required, and honour within ten business days. Civil penalties are quoted per email (the inflation-adjusted figure changes), which is why volume matters.

Why it matters. EU playbooks over-block US lists; US playbooks under-protect EU lists. Know which law you are actually under.

Dotted words open definitions. Full glossary.

What to do

Your move — not a lecture

Part platform, part you

The platform covers the mechanical bit. The judgement is still yours.

Your puts the postal address and link in the footer template, processes opt-outs automatically, and does it well within ten business days. The mechanical compliance is genuinely handled.

Your part: The subject line, and anything sent outside the . A sales rep mail-merging from a laptop is commercial email too, and it is the usual source of exposure.

What to do first

Open your last campaign and check the footer address against where the company actually is now. Companies move; footers do not.

You can skip this if: You never email anyone in the United States.

Who this applies to

Anyone sending commercial email to US recipients, wherever you are based. There is no small-sender exemption and no volume threshold.

Checklist

  • 01Check the postal address in your footer is real and current. An old office address is a live violation on every send.
  • 02Keep the subject line honest about what is inside. Deception is the limb regulators actually pursue.
  • 03Audit anything that emails prospects outside the , especially sales sequencing tools.
  • 04Remember you stay liable for what an agency sends on your behalf. Hiring someone does not move the obligation.

That’s enough to act. Sources and exact wording are below for counsel, bosses, or AI tools that need a citation. Not legal advice.

Proof

Exact position, enforcement, sources

For records and people who will check you. Skip if Monday’s move is already clear.

The exact position

is an regime, not : you may email without prior , but every message needs accurate , a non-deceptive subject line, a valid physical postal address, a working opt-out, and the opt-out honoured within 10 business days. Each non-compliant email carries a civil penalty of up to $53,088. That figure took effect on 17 January 2025 and still stands, because the FTC's usual January inflation adjustment was cancelled for 2026.

What happens if you do not

Real but infrequent against ordinary marketers, and historically aimed at deceptive senders rather than sloppy footers. The important 2026 detail: the FTC adjusts these penalties every January, but the Office of Management and Budget cancelled the 2026 adjustment because the government shutdown from 1 October to 12 November 2025 stopped the Bureau of Labor Statistics calculating October 2025 CPI-U. So the 2025 figure carries through 2026 unchanged. Anyone quoting a higher 2026 number is guessing.

Sources

  • Federal Register, No Adjustment to Civil Monetary Penalty Amounts (2026 adjustment cancelled)
    Published 7 Jul 2026Read primary source
  • Federal Register, Adjustments to Civil Penalty Amounts (the $53,088 figure)
    Published 17 Jan 2025Read primary source
  • FTC, CAN-SPAM Act: A Compliance Guide for Business
    No publisher dateRead primary source

History of this page

  • Re-verified against primary sources (bulk/auth/consent core).
  • Added. The baseline US rule was missing entirely, and the 2026 penalty figure is widely misreported because the annual adjustment was cancelled.

FAQ

Awkward questions

Who is this actually for?

People who ship email and are too busy to re-read every PDF: week-one marketers, lifecycle/CRM, deliverability, multi-country ops, DTC brands, agencies — on Klaviyo, Mailchimp, Braze, HubSpot, SFMC, or something else. Pick your tool and geos so product-specific pages only appear when they match. EU and UK are first-class filters. Not for people who sell tools about email and need a fake score to demo.

Why only ~40 rules? Isn’t that… thin?

On purpose. A wall of 400 undated “best practices” is how you look busy and still get burned. Every page needs a primary source we actually read. Thin and checkable beats fat and folklore. Europe, bulk inbox rules, measurement honesty, and protocol topics like BIMI/DMARC policy are on the shelf when we can cite them — not every Member State and not every vendor myth. Coverage map lists what we still refuse to invent.

Is this legal advice?

No. If it were, you’d have a billable hour and a longer PDF. This is a dated operator reference written by an email geek. Confirm anything high-stakes with counsel who knows your facts. Same for “will this make me compliant?” — no tool does that. Lawyers and judges do. We say what the sources say and what to do first on Monday.

Why no trust score out of 100?

Because we refuse to invent a number you can’t audit. Fake scores sell seed tests and panic. You get findings, dates, and links. If that feels less exciting than a red dial, good — you’re not the red-dial customer.

Why should I trust you more than my ESP’s blog?

ESPs sell seats. Seed-score vendors sell fear. AI invents citations when nobody watches. We sell nothing today — no pixels, no placement scores, no affiliate — so we can say when a tool is the problem. A human verifies, dates, and corrects in public. Tools may help draft; they do not ship unsourced claims. Check the primary links. Fail that test and leave.

Do I need an account?

No. Filters live in this browser and the URL. Share the link. That’s it. Accounts come later only if they earn it — not so we can nurture you about email.

I’m an agency. Where’s multi-client mode?

We tried a client-name CRM on the setup card. It made the product feel like work before it felt useful. Role filters + copy link + one-page brief (optional PDF title) is enough for now. Complexity comes back when the free shelf is habit, not before.

Is the quiet changelog a bug?

No. Quiet means nothing material moved. We don’t invent urgency so the homepage looks “alive.” Sticky risks still show what usually needs a person when the market is still.