The Law Called ‘CAN-SPAM’ Does the Opposite of What It Sounds Like

What the letters actually stand for

CAN-SPAM is short for Controlling the Assault of Non-Solicited Pornography And Marketing Act, passed by Congress in 2003. It's codified at 15 U.S.C. Section 7704, and it's a federal law, not a state one, which matters more than it sounds like it should. It applies the same way whether the company emailing you is down the street or across the country, and it doesn't need your state to have its own privacy law on the books to give you a right here.

What it actually requires of a sender

Every commercial email, meaning anything whose primary purpose is advertising or promoting a product or service, has to follow rules that sound obvious until you realize they're legally mandatory, not optional courtesy:

• The “from,” “to,” and routing information can’t be misleading.
• The subject line can’t deceive you about what’s inside.
• The email has to be identifiable as an ad (it doesn’t have to scream it, but it can’t hide it).
• It has to include the sender’s real physical postal address.
• It has to include a clear, working way to opt out of future email.
• That opt-out has to actually work, honored within 10 business days.
• Once you’ve opted out, they can’t sell or transfer your address to anyone else.

That opt-out requirement is the whole reason an “unsubscribe” link is supposed to mean something. It isn’t a feature a company chose to add. It’s federal law telling them they have to.

Why it applies to you specifically

CAN-SPAM doesn’t only cover companies you have an account with. It covers any commercial email sent to you, from a retailer you bought a lamp from once in 2019, to a company that got your address from a list and emailed you cold. It doesn’t require that you opted in for the opt-out right to exist, and it doesn’t exempt small businesses or one-person operations. If it’s a marketing email and it landed in your inbox, this law already covers it, whether you’ve ever heard of the sender or not.

What it doesn’t do (the honest limits)

CAN-SPAM is opt-out, not opt-in. It doesn’t stop a company from emailing you the first time, it only obligates them to stop once you’ve told them to. It also doesn’t cover transactional or relationship messages like a receipt, a shipping update, or a password reset, even from a company you’ve unsubscribed from marketing-wise. And critically, it doesn’t give you a personal right to sue a company yourself. Enforcement runs through the FTC, not through you filing a lawsuit, which changes what “doing something about it” actually looks like.

How enforcement really works

Because you can’t personally sue over one ignored unsubscribe, the leverage here is evidence and pattern, not a single complaint. The FTC generally doesn’t respond one-on-one to individual reports, but complaint volume and documented patterns are exactly what drives its enforcement actions, and per-violation penalties can be significant once a case is built. What actually matters is being able to show: I unsubscribed on this date, and they emailed me again after that date. That’s the entire case, and it’s also exactly what most people have no record of, because nobody keeps a log of when they clicked unsubscribe six weeks ago.

Why ReclaimInbox tracks this automatically

This is the actual reason the dashboard keeps a permanent unsubscribe history instead of just letting you click a button and forget about it. Every request gets a timestamp, and if that sender shows up in your inbox again afterward, it’s flagged right on that history entry. That’s the exact fact pattern CAN-SPAM cares about, sitting there with a date on it, instead of buried across months of emails you’d have to dig up yourself later.