The short answer
CAN-SPAM applies to commercial email regardless of whether the recipient is a business, and it has no consent requirement at all — you may email someone who never asked. What it does require is a truthful header and subject line, a physical postal address, a clear identification that the message is an advertisement, and an opt-out that works within ten business days. Penalties run per message.
CAN-SPAM is the inverse of the TCPA. The TCPA is strict about permission and quiet about content; CAN-SPAM does not require permission at all and is strict about what the message must contain. Brokers who learned compliance through the TCPA tend to get this backwards in both directions.
- Header information must be accurate. The from, reply-to and routing must identify who actually sent it.
- The subject line must not misrepresent the contents. "Re:" on a message that is not a reply is the classic violation.
- The message must be identifiable as an advertisement, though the law is flexible about how.
- A valid physical postal address must appear. A PO box that you registered counts.
- A working opt-out mechanism must be present, and it must work for at least 30 days after sending.
- Opt-outs must be honoured within 10 business days, and the address must not be sold or transferred afterwards.
Where brokers actually get caught
| Practice | Problem |
|---|---|
| "Re:" or "Fwd:" on a cold email | Deceptive subject line |
| Sending from a lookalike personal address | Inaccurate header information |
| No postal address in the footer | Straightforward violation |
| Unsubscribe that requires a login | Not a functioning opt-out |
| Selling a list containing opted-out addresses | Prohibited transfer |
None of these is subtle, and all of them are common in cold outbound aimed at merchants. The first is the one to stop doing today: fake reply prefixes are the single most-cited deceptive-subject practice, and they are used precisely because they work on open rates.
The rule that is not in the statute
Deliverability. Mailbox providers enforce sender reputation far more aggressively than the FTC enforces CAN-SPAM, and they enforce it against your domain. Authenticate with SPF, DKIM and DMARC, warm a sending domain before you use it at volume, and keep complaint rates low — or the compliant campaign lands in spam anyway.