CAN-SPAM and CASL

Treat every cold email as a jurisdiction check before a copy check. Decide whether the message is commercial, route it by recipient country, and run the right identity, disclosure, and opt out checks before sending. Consent changes the plan: CAN-SPAM does not require prior consent for commercial email,¹ while CASL requires consent for unsolicited commercial electronic messages unless the recipient has expressly or impliedly consented.²

Start with the message and recipient

Before writing, record the recipient's country and the message's primary purpose. That record determines the review path and keeps the team from treating every address the same way.

CAN-SPAM covers a commercial message when its primary purpose is advertising or promoting a commercial product or service. That includes email promoting content on commercial websites.³

Before drafting, ask:

• Is the main purpose of this message commercial?
• Where is the recipient located?
• Which rule set applies to that location?
• What fact lets us classify the message if someone reviews it later?

Keep the classification with the send record. If useful information becomes promotional in purpose, review the message again.

Run the US check

Treat the US path as a send gate. Check sender identity, message labeling, subject accuracy, contact information, and the recipient's exit path before the message enters a sequence.

CAN-SPAM gives recipients the right to stop further emails and sets requirements for commercial messages.⁴ The FTC enforces the CAN-SPAM Act and the accompanying CAN-SPAM Rule.⁵

Ask:

• Can the recipient tell who initiated the message from the From, To, Reply-To, and routing information?⁶
• Does the subject line describe the message accurately?
• Is the commercial nature of the message clear?
• Can the recipient use a simple path to stop future emails?
• Have you included the contact information required by both regimes?⁷

Stop when an answer is missing. Fix the record, message, or send control before continuing. Run the review when the email is assembled, since a correct template can still have the wrong sender or reply path.

Run the Canadian check

The Canadian path starts with permission and ends with a working exit. Confirm the basis for sending before polishing the copy.

For each recipient, ask:

• Do we have express or implied consent for this commercial electronic message?
• Where is that consent recorded?
• Does the message identify the sender and provide contact information?
• Does the unsubscribe mechanism work in the version the recipient will receive?

If the consent answer is unclear, hold the send. Hold it if the identity or unsubscribe check fails as well. Keep a review record that another person can inspect without reconstructing the decision from scattered notes.

Build the send control

Make legal review part of the sending process. Put the checks beside the address, message, and sending method so the person launching the email can see the result before delivery.

CAN-SPAM risks span content, data, workflow, and platform administration.⁸ Build one preflight record with the recipient's country, the message purpose, the sender identity, the consent basis where required, the contact details shown, and the unsubscribe status. Let the send proceed only when every field has an answer.

Keep opt out status outside the copy document. A person can appear in a new list, sequence, or manual task after asking to stop, so the suppression decision needs to travel with the address. Test the visible sender, reply path, subject, contact details, and unsubscribe action in the final rendered email. Do not rely on the template editor alone.

Give the review an owner who can stop a send. The FTC's enforcement role gives this control a consequence beyond formatting.⁵

What not to do

• Do not treat business-to-business email as outside CAN-SPAM. The law makes no exception for business-to-business email.⁹
• Do not limit the review to bulk campaigns. The CAN-SPAM Act applies to more than bulk email.¹⁰
• Do not use false or misleading header information.¹¹
• Do not use deceptive subject lines in commercial email.¹²
• Do not send a Canadian commercial electronic message without the required consent, sender identification, contact information, and functioning unsubscribe mechanism.¹³
• Do not assume the risk is spread across a campaign. Each separate email that violates CAN-SPAM can incur a penalty of up to $53,088.¹⁴