Section: Money & identity · Last updated: October 27, 2026
This guide is based on the text of the CAN-SPAM Act as codified at 15 U.S.C. 7702, 7704 and 7706 (U.S. Government Publishing Office), and the FTC’s CAN-SPAM Rule at 16 CFR Part 316 (eCFR version of October 1, 2026). It is general information, not legal advice.
Clicking “unsubscribe” on a marketing email is backed by federal law. The CAN-SPAM Act tells senders what every commercial email must include, how long an opt-out link has to keep working, and how quickly your request must be honored. This guide goes through those rules as the statute and the FTC rule write them.
1. The rule at a glance
| Question | What the law says |
|---|---|
| Opt-out mechanism | Every commercial email needs a working reply address or other internet-based way to opt out, clearly and conspicuously displayed (7704(a)(3)) |
| How long it must work | At least 30 days after the email was sent |
| Deadline to stop sending | No more covered emails more than 10 business days after the sender receives your request (7704(a)(4)) |
| What you can be asked for | Only your email address and opt-out preferences; no fee, and no step beyond a reply email or a visit to a single web page (16 CFR 316.5) |
| Your address after opting out | May not be sold, leased, exchanged or otherwise transferred, except to comply with the law |
| Every commercial email must show | That it is an ad or solicitation, a notice that you can opt out, and the sender’s valid physical postal address (7704(a)(5)) |
2. Which emails are covered
The opt-out rules apply to a commercial electronic mail message: an email whose primary purpose is the commercial advertisement or promotion of a product or service (15 U.S.C. 7702(2)). A transactional or relationship message is not a commercial email under the Act. The FTC rule, 16 CFR 316.3(c), lists what counts as transactional or relationship content:
- Facilitating, completing or confirming a transaction you already agreed to, such as an order confirmation.
- Warranty, product recall, safety or security information about something you bought or use.
- For an ongoing subscription, membership, account or loan: notice of a change in terms or features, a change in your status, or regular account statements.
- Information about an employment relationship or benefit plan you are part of.
- Delivering goods or services, including product updates or upgrades, you are entitled to under an earlier transaction.
So a shipping notice or a monthly bank statement usually will not carry an unsubscribe link, and the 10-day rule does not apply to it. Note that the false-header rule in 7704(a)(1) does still apply to transactional messages.
3. Emails that mix ads and account news
Many emails combine both. Section 316.3(a)(2) says a message with both advertising and transactional content is treated as commercial if either of these is true:
- A recipient reading the subject line would likely conclude the email contains an advertisement or promotion.
- The transactional content does not appear, in whole or in substantial part, at the beginning of the body.
For emails that mix ads with other content that is not transactional, such as a newsletter, the test looks at the subject line and at whether a reasonable reader of the body would see advertising as the main purpose. The rule names placement, the share of the message given to ads, and the use of color, graphics and type size as factors.
4. The 10-business-day clock
- You send the request. Use the mechanism in the email: the unsubscribe link, a reply address, or a preference page.
- The sender receives it. The clock runs from receipt, not from when the sender gets around to processing it.
- After 10 business days. The sender may not send you commercial email within the scope of your request. Anyone acting on the sender’s behalf is also barred if they know, or it is fairly implied, that the email falls within your request.
A sender can offer a menu so you choose which kinds of email to stop, but the menu must include an option to stop all commercial email from that sender (7704(a)(3)(B)). If you later give affirmative consent again, for example by re-subscribing, the ban no longer applies (7704(a)(4)(B)).
A link that is temporarily down does not by itself break the rule, if the outage is unexpected, caused by a technical problem beyond the sender’s control, and fixed within a reasonable time (7704(a)(3)(C)).
5. What a sender cannot ask you to do
Section 316.5 of the FTC rule is short and specific. To opt out, a sender may not require you to:
- Pay any fee.
- Provide any information other than your email address and your opt-out preferences.
- Take any step other than sending a reply email or visiting a single web page.
That means a page asking you to log in, create an account, or answer a survey before it will unsubscribe you goes beyond what the rule permits. A single page where you confirm your address and choose preferences is within it.
6. Who enforces it
| Who | Basis in 15 U.S.C. 7706 |
|---|---|
| Federal Trade Commission | Enforces the Act as an unfair or deceptive practice (7706(a)), except where another agency is assigned |
| Bank regulators and other agencies | Enforce it for the institutions they oversee (7706(b)) |
| State attorneys general | May sue on behalf of state residents, including for a pattern or practice of ignoring opt-outs (7706(f)) |
| Internet access providers | May sue when they are adversely affected (7706(g)) |
The enforcement section does not list individual recipients among those who can bring a lawsuit. For an individual, the practical step is a report to the FTC, and keeping a record of the date you opted out and the emails that arrived afterward.
FAQ
Q. I unsubscribed yesterday and got another email today. Is that a violation?
Not yet. The statute allows up to 10 business days after the sender receives your request. Emails after that point, within the scope of your request, are what the rule prohibits.
Q. Can a company sell my address after I opt out?
No. Section 7704(a)(4)(A)(iv) bars selling, leasing, exchanging or otherwise transferring the address of someone who made an opt-out request, except for compliance with the law.
Q. Why didn’t my order confirmation have an unsubscribe link?
Order confirmations are transactional messages, which are not commercial email under the Act. The opt-out requirements apply to commercial messages.
Q. The unsubscribe page wants my password. Do I have to log in?
The FTC rule limits what a sender can require to your email address and opt-out preferences, through a reply email or a single web page. Requiring a login goes beyond that list.
Official sources
- 15 U.S.C. 7702 — Definitions: commercial electronic mail message, transactional or relationship message (U.S. Code, GovInfo)
- 15 U.S.C. 7704 — Other protections for users of commercial electronic mail, subsection (a) (U.S. Code, GovInfo)
- 15 U.S.C. 7706 — Enforcement generally (U.S. Code, GovInfo)
- 16 CFR Part 316 — CAN-SPAM Rule, sections 316.3 and 316.5 (eCFR, October 1, 2026)
This article is general information based on the federal statute and regulation text. It does not cover text messages to phones, state laws, or rules for senders outside the United States. For a specific problem, contact the Federal Trade Commission or your state attorney general.