Business tower · floor
Email marketing laws, and the exception that does not exist
Anybody looking up email marketing laws in the United States meets one sentence early and ought to meet it first, because it decides whether the rest applies to them. It is in the second paragraph of the Federal Trade Commission’s guide, and it removes the exception most senders assume they are covered by.
Seven requirements. None of them is about how many people you send to.The FTC’s own rundown, in its order
Read that list again with one thing in mind: not one of the seven is about volume, and not one is about consent. United States law does not require permission before you send a commercial email. What it requires is that the message be honest about who sent it, honest about what it is, honest about where you are, and equipped with a working way out. The right the law protects is the right to leave, not the right not to be contacted.
This is the sentence that catches people who are certain the rules are not about them. The FTC’s
own example is deliberately mundane: “a message to former customers announcing a new product
line”. Not a purchased list, not a campaign — an announcement to people you have actually done
business with. The test the law applies is the message’s primary purpose, and a
small, polite, personally written email advertising a product is a commercial message
exactly as a mailshot to fifty thousand people is.“Despite its name, the CAN-SPAM Act doesn’t apply just to bulk email… The law makes
no exception for business-to-business email.”
That is worth holding on to if you are used to rules built the other way round. The seven requirements the FTC lists are all properties of the message — its headers, its subject, its disclosure, its address, its way out. Whether the recipient asked to hear from you is not among the things the list asks about, and this floor states that as an observation about the list rather than as legal advice about any particular email.
How long your opt-out mechanism must keep working after you send the message. A link that
expires with the campaign, or a landing page taken down when the promotion ends, fails this
one — and the failure happens after you have stopped paying attention. The deadline to honour an opt-out. You may not charge for it, may not demand any personal
information beyond the email address, and may not require more than a reply email or a
single web page. Worth measuring your own unsubscribe route against that sentence and
counting the steps.
What makes those two numbers awkward is that both outlive the thing they attach to. The thirty-day rule outlives the campaign: an unsubscribe link in a message sent in March has to still work in April, which matters when the landing page belonged to a promotion that ended. And the ten-day rule is generous on time while being strict on method — the FTC names the maximum effort you may demand, and it is a reply email or a single web page.
There is one more restriction attached to the opt-out that is easy to miss because it applies after the person is gone. Once somebody has opted out, in the FTC’s words, “you can’t sell or transfer their email addresses, even in the form of a mailing list.” The single exception it names is transferring the address to a company hired to help you comply. So a suppression list is not an asset you may pass on; it is the opposite of one.
The clause you cannot write. The FTC: “even if you hire another company to handle your
email marketing, you can’t contract away your legal responsibility to comply with the
law.” And responsibility is not transferred, it is shared — “Both the company whose product is
promoted in the message and the company that actually sends the message may be held legally
responsible.” So the practical question when choosing a sending platform is not whether it advertises
compliance features. It is whether you can see what it sent, to whom, and whether the
unsubscribes were processed — because if it gets that wrong, the FTC’s position is that the
problem is also yours.
On the size of the risk, the FTC states it per message rather than per campaign: “Each separate email in violation of the CAN-SPAM Act is subject to penalties of up to $53,088.” The guide adds that certain aggravated violations may give rise to additional fines, and that the law provides for criminal penalties, including imprisonment, for some conduct. The figure is inflation-adjusted — the FTC notes at the foot of the guide that it was edited in January 2024 to reflect the current maximums — so it is a number worth reading from the source rather than from memory.
Where these rules apply. Everything on this floor is United States federal law — the CAN-SPAM Act, enforced by the Federal Trade Commission, as set out in the FTC’s compliance guide for business. Other countries regulate commercial email differently, and several of them start from consent rather than from opt-out, which is a structural difference rather than a detail. A page written about one jurisdiction is not evidence about another, and this floor does not pretend to cover the rest.
The floors below take it three ways: what must be in the message, the two clocks and what they oblige you to keep working, and the platform question — who is responsible when the sending is done by somebody else.
Where to start
Three ways in.
- “Is my small B2B list covered?”
- Start at what counts as commercial
- “What has to be in the email?”
- Go to what the message must contain
- “My platform handles this, surely.”
- That is who is responsible
What counts as commercial
The test is the message’s primary purpose, not the size of the send or the warmth of the relationship. The FTC’s own example is an announcement to former customers.
What the message must contain
A truthful header, a truthful subject, a disclosure that it is an advertisement, a physical postal address, and a route out that an ordinary person can find.
Who is responsible
Both the company promoted in the message and the company that sent it. The FTC says the responsibility cannot be contracted away, which changes what to ask a platform.
What this tower will not do
It will not tell you that a small list is outside the rules. The FTC says the law makes no exception for business-to-business email, and that sentence is the reason this floor exists.
It will not treat the sending platform as the compliant party. The FTC names both the promoted company and the sending company as potentially responsible.
And it will not present United States law as universal. Several other countries start from consent rather than opt-out, and that is a different rule, not a stricter version of this one. What holds instead is simple: the seven requirements, the two deadlines, the restriction on transferring addresses after an opt-out, the responsibility of both companies and the per-message penalty are quoted from the Federal Trade Commission’s compliance guide, listed below.
Where this page got its facts
- Federal Trade Commission, CAN-SPAM Act: A Compliance Guide for Business (that the law covers all commercial messages and makes no exception for business-to-business email; the seven main requirements including accurate headers, non-deceptive subject lines, identifying the message as an advertisement, a valid physical postal address and a clear opt-out notice; that subscribers and members retain the right to opt out; that the opt-out mechanism must work for at least 30 days and requests must be honoured within 10 business days with no fee, no personal information beyond an email address and no more than a reply email or a single web page; that opted-out addresses may not be sold or transferred except to a company hired to help you comply; that responsibility cannot be contracted away and both the promoted and the sending company may be liable; and that each separate violating email is subject to penalties of up to $53,088, with additional and criminal penalties for aggravated violations) — www.ftc.gov, read 22 August 2026.
Written by Alberto Gulotta
Founder and editor of AI Tools Primer, writing from Palermo, Italy. Thirty-five years of taking computers apart, starting with a Commodore 64 — the long version is on the about page.
Something wrong on this page? Write to aitoolsprimer@gmail.com and it gets fixed.
Written on 22 August 2026.
Independence and limits
No affiliate links and no paid placements anywhere on this site. Nobody pays to appear here, and no company has seen this page before you did.
This is general information, not professional advice. Where a page touches money, health, safety or the law, it names its source and the date it was read — and your situation may still differ. See the privacy page and the cookie policy.