CAN-SPAM for B2B email lists: a plain guide

Yes. The Federal Trade Commission is clear that CAN-SPAM has no exemption for business-to-business email. It applies to any email whose primary purpose is to advertise or promote a commercial product or service, whoever receives it.

The law separates three kinds of message:

• Commercial messages promote a product or service. A note to an agent offering pre-approvals, photography or software is commercial. All the rules below apply.
• Transactional or relationship messages complete a transaction the recipient already agreed to, such as a receipt, a delivery notice or an account update. These are mostly exempt, but they must not contain false or misleading routing information.
• Other content, such as a purely informational newsletter, can still be commercial if its main purpose is promotion.

When an email mixes content, the FTC looks at what a reasonable recipient would think its primary purpose is, judged mostly by the subject line and the opening. If in doubt, treat it as commercial and follow every rule.

Note what CAN-SPAM does not require: consent before the first email. That is why emailing agents from a purchased list is legal in the United States, as long as each message follows the rules.

The FTC sums up the law in seven rules.

1. Do not use false or misleading header information. The From name, Reply-To and routing must identify you or your business accurately.
2. Do not use deceptive subject lines. The subject must reflect the content. A first email that starts with "Re:" or "Fwd:" to suggest an earlier conversation is a classic violation.
3. Identify the message as an ad. The law does not prescribe wording, but the email must make clear that it is an advertisement.
4. Tell recipients where you are. Include a valid physical postal address: a street address, a post office box registered with the US Postal Service, or a private mailbox registered with a commercial mail receiving agency.
5. Tell recipients how to opt out. Give a clear, conspicuous way to stop future emails, such as a link or a reply address, that someone can use easily.
6. Honor opt-outs promptly. See the next section.
7. Monitor what others do for you. If you hire an agency or contractor to send for you, you are both responsible. You cannot contract away your compliance.

Each separate email that breaks the law can bring a civil penalty of more than $50,000, an amount the FTC adjusts for inflation each year. State attorneys general and internet service providers can also bring cases. In practice, most trouble for B2B senders comes from complaints, so a clean, honest email protects your deliverability as well as your legal position.

The opt-out rules are where most senders slip.

• Your opt-out must work for at least 30 days after you send the message.
• You must honor a request within 10 business days. After that, you cannot email that address again for commercial purposes.
• You cannot charge a fee, ask for any information beyond an email address, or make someone do more than reply to an email or visit a single web page to opt out.
• You cannot sell or transfer the email addresses of people who opted out, except to a company you hired to help you comply.

The practical answer is a suppression list. Every unsubscribe, every "please remove me" reply and every bounce goes into one list, and every send, from any tool and any team member, is checked against it first. When you buy a new edition of a list, check it against your suppression list before you load it, because people who opted out of your emails will still be licensed agents in the new file.

We help from our side too. Agents who ask us to remove them are suppressed in every future edition we deliver. But your list of opt-outs from your own campaigns is yours to keep, and it is the one regulators will ask about.

Many agent files include phone numbers, and phones fall under different, stricter laws.

The Telephone Consumer Protection Act restricts calls and texts made with an autodialer or a prerecorded voice to mobile numbers unless you have the recipient's prior consent. Texts count as calls. Private lawsuits under the TCPA allow damages of $500 per call or text, and up to $1,500 when the violation is willful, so a single automated campaign can carry real risk.

Many agents use their mobile number as their business line, and that does not take the number out of the TCPA. A manual call, dialed by a person one number at a time, is outside the autodialer rules, but it is still subject to Do Not Call rules.

The National Do Not Call Registry applies to telemarketing calls. If you call agents to sell something, scrub your list against the registry at least every 31 days, keep your own internal do-not-call list, call only between 8am and 9pm in the recipient's time zone, and identify yourself and your company at the start of the call. There is a business-to-business exemption, but it is narrow and does not cover every product, so most sellers scrub every list.

The safe pattern: email first under CAN-SPAM, call by hand after a Do Not Call scrub, and text only people who have agreed to it.

CAN-SPAM overrides most state laws about commercial email, except state rules against falsity or deception, so the email rules are much the same everywhere. Phones and data are where states differ.

• State telemarketing laws. Florida and Oklahoma have their own versions of the TCPA with stricter consent rules for automated calls and texts, and private lawsuits under them. Several states require telemarketers to register or post a bond, and some have their own do-not-call lists or tighter calling hours.
• Privacy laws. California's CCPA and the privacy laws in Colorado, Connecticut, Virginia, Texas, Oregon and other states give residents rights over their personal information, including business contact details in some cases. If someone asks you what you hold about them, or asks you to delete it, have a process ready.
• Licensee data rules. Some states limit how their licensing records may be used, as covered in our license lookup guide.

If you run phone campaigns at scale, or you are in a regulated industry such as mortgage lending, talk to a lawyer about the states you call into.

Run through this before every campaign to agents.

1. From line: your real name or company, from a domain you own, with a reply address that reaches a person.
2. Subject line: honest and specific, no fake "Re:" or "Fwd:". Our free subject line tester checks this.
3. Body: says plainly what you are offering. If it is an advertisement, it is clear that it is one.
4. Footer: your physical postal address and a working unsubscribe link or reply instruction.
5. Suppression: the list has been checked against every opt-out and bounce you hold, including from earlier campaigns.
6. Opt-out handling: someone or something processes unsubscribes within 10 business days, and the link will keep working for 30 days.
7. Vendors: anyone sending for you knows these rules and uses your suppression list.
8. Sending setup: SPF, DKIM and DMARC are set up on your sending domain, the domain is warmed up, and you send in steady daily batches rather than one blast.
9. Phones: if you will follow up by phone, the numbers have been scrubbed against the Do Not Call Registry within the last 31 days, and nobody is autodialing mobile numbers without consent.

Paste your draft into our free compliance checker for a quick pass against the basics. And when you choose a list, pick one where every email has been verified and every row shows its source, so you can answer the question every careful sender should be able to answer: where did you get my address?