Skip to content
English
Contact us
  • There are no suggestions because the search field is empty.

What does CAN-SPAM require, and how do you handle unsubscribes and do-not-contact requests?

Honest headers, a working unsubscribe, and a suppression list that never leaks.

CAN-SPAM requires honest headers and subject lines, identification of the message as an ad, a valid physical postal address, a clear way to opt out, and that you honor opt-outs promptly. The FTC's compliance guide states you must honor an opt-out request within 10 business days.

What the FTC guide actually says

  • Do not use false or misleading header information. The From, Reply-To and routing must identify who sent it.
  • Do not use deceptive subject lines. The subject has to reflect the content.
  • Identify the message as an advertisement.
  • Include your valid physical postal address. The guide accepts a street address, a registered PO box, or a registered private mailbox.
  • Tell recipients how to opt out, and make the mechanism easy.
  • Honor opt-outs within 10 business days, and keep the opt-out mechanism working for at least 30 days after the message was sent.
  • Monitor what others do on your behalf. Hiring an agency does not transfer the legal responsibility.

The FTC's guide states that each separate email in violation is subject to penalties of up to $53,088. Separately, mailbox providers have their own rules that are stricter than the law: both Google and Yahoo now require one-click unsubscribe support for bulk marketing mail, using the List-Unsubscribe headers described in RFC 8058, and Yahoo states unsubscribes should be honored within 2 days. Ten business days is the legal floor. Two days is the practical standard.

What LevelUp builds

Compliance fails at the operational layer, when a request is honored in one system and not another. So we build two things on every engagement:

First, a single master non-marketable suppression workflow. It sweeps vendors, employees, do-not-call contacts, disqualified leads, unsubscribed contacts and bounced addresses into one static exclusion list, and every marketing send excludes that list. One list, one source of truth.

Second, a separate Do Not Contact lead status. Unsubscribing from marketing email and asking a company to stop contacting you entirely are different requests, and a sales rep with a call task does not read email subscription preferences. A distinct status makes the request visible to sales, marketing and service in the same place.

SMS has its own consent rules, covered in our compliant SMS guide. Our data handling is in the privacy policy. This is general guidance, not legal advice.

Related: Can LevelUp Digital build custom HubSpot workflows and automations?. Is HubSpot HIPAA compliant for healthcare businesses?. What HubSpot services does LevelUp Digital offer?.