Yes, there are rules, and they apply to a one-person shop sending a monthly newsletter just as much as to a big retailer. Under the federal CAN-SPAM Act, every marketing email you send needs an honest sender name and subject line, your physical mailing address, and a clear way to unsubscribe that you honor within 10 business days; Gmail and Yahoo add their own technical requirements on top of that.
I run a wellness center in Charlottesville as well as STANDBY, so I know the hesitation of sitting on a customer list and not being sure what is allowed. The rules are short and sensible. I am not a lawyer, so treat this as a practical summary and check the sources linked below.
Do I need permission before emailing my customers?
Under federal law, no, but in practice you should still only email people who expect to hear from you. CAN-SPAM is an opt-out law, not an opt-in law, so it does not require consent before you send commercial email.
The FTC's CAN-SPAM compliance guide for business covers any email whose main purpose is to advertise or promote a product or service, and it makes no exception for business-to-business email. That means a promo blast to past customers, a seasonal special from a restaurant, or an email to local property managers from a roofing company all count.
Where permission really matters is deliverability. If people did not ask for your emails, more of them hit the spam button, and the big inbox providers watch that closely.
What does every marketing email legally have to include?
Every commercial email needs truthful sender details, an honest subject line, a statement that it is an ad, your physical address and a working way to opt out. The FTC guide lists these as the core requirements:
- Honest header information. Your From name, Reply-To address and sending domain must accurately identify your business.
- A subject line that matches the content.
- A clear ad disclosure. The law gives you flexibility in how, but the email has to identify itself as an advertisement.
- Your physical postal address. A street address, a registered PO box or a registered private mailbox all qualify.
- A clear opt-out. Tell people how to stop getting your marketing emails, and make it easy to spot.
Most email platforms add the address and unsubscribe link to the footer automatically, as long as you fill in your business details correctly in the account settings.
How fast do I have to process unsubscribe requests?
The FTC says you must honor an opt-out within 10 business days, and your unsubscribe option has to keep working for at least 30 days after you send the email. You also cannot charge a fee, ask for more than an email address, or make people do more than reply or visit a single page.
Gmail and Yahoo expect faster. Yahoo's sender best practices ask bulk senders to honor unsubscribes within 2 days. Most email tools process them right away.
One trap to watch for: if you export your list from one tool and import it into another, make sure the unsubscribed contacts come along as unsubscribed. Once someone opts out, you also cannot sell or hand their address to another company.
Are receipts, appointment reminders and invoices covered too?
Mostly no. Transactional or relationship messages, such as receipts, order updates, appointment confirmations and account notices, are exempt from most of CAN-SPAM, though they still cannot contain false or misleading routing information.
The catch is mixing. The FTC looks at the primary purpose of the message. If your appointment reminder leads with a big promotion, or the subject line reads like an ad, it can be treated as a marketing email. Keep reminders and receipts focused on the transaction, and put promotions in their own emails.
What do Gmail and Yahoo require on top of the law?
Gmail and Yahoo want proof that your email really comes from your domain, plus a spam complaint rate below 0.3%. These are technical rules, but they decide whether your newsletter reaches the inbox at all.
Google's email sender guidelines require every sender to set up SPF or DKIM authentication for their domain and to keep spam rates reported in Postmaster Tools below 0.3%, with Google recommending you stay under 0.1%. Senders of 5,000 or more messages a day to Gmail accounts also need SPF, DKIM and DMARC, plus one-click unsubscribe and a visible unsubscribe link in the message.
Most small businesses never send 5,000 a day, but set up all three anyway. Your newsletter tool will walk you through adding a few DNS records with whoever manages your domain, and it protects your domain from being spoofed.
What can I do today to get this right?
You can cover almost everything in an afternoon. Here is the order I would do it in:
- Move off your personal inbox. Sending a promo from Gmail with 200 people in BCC gives you no unsubscribe link and no way to track opt-outs. Use a proper email marketing tool.
- Fill in your business name and mailing address in that tool so they appear in every footer.
- Authenticate your domain. Follow your tool's steps to add SPF, DKIM and DMARC records.
- Clean your list. Keep people who bought from you, booked with you or signed up. Drop purchased lists and random addresses you scraped from somewhere.
- Add a simple sign-up spot on your website and at checkout that says what people will get and how often.
- Write honest subject lines and keep promotions out of your receipts and reminders.
- Check that unsubscribe works by subscribing your own spare address and opting out.
The same thinking applies to text messages, which have their own separate rules. If you text customers too, read our guide to 10DLC registration for business texting. And if one of your emails asks for reviews, keep it within the platform rules covered in how to ask for Google reviews the right way.
What if someone else sends the emails for me?
You are still responsible. The FTC is clear that you cannot contract away your legal responsibility, and both the business being promoted and the company doing the sending can be held liable.
That matters because penalties are real: the FTC guide lists penalties of up to $53,088 for each separate email in violation. If a marketing helper, a booking platform or an agency sends emails in your name, ask them how they handle unsubscribes, what address appears in the footer, and whether your domain is authenticated.
If you would rather not think about any of this, this is the kind of work we handle for owners through our automation and follow-up service: setting up a compliant email tool, connecting it to your booking or checkout, and building simple follow-ups that sound like you. It also pairs well with a website build that has a clear sign-up spot. Not sure where email fits in your bigger picture? The free local business growth scorecard is a quick way to see what needs attention first.
Common questions
Can I email someone who gave me their business card?
CAN-SPAM does not require prior consent, so it is not illegal on its own, as long as the email meets every requirement above. But a person who never asked for a newsletter is more likely to mark it as spam, so a short personal follow-up is usually wiser than adding them to a mass list.
Do I need an unsubscribe link in a one-to-one email to a customer?
A normal reply about a quote, a job or an appointment is a transactional or relationship message, not marketing. Once you send the same promotional message to many people, treat it as marketing and include the unsubscribe option and your address.
Does CAN-SPAM apply to my contractor or B2B business?
Yes. The FTC says the law makes no exception for business-to-business email, so a plumber emailing property managers or a print shop emailing local offices follows the same rules.
If you want a second set of eyes on your email setup, or help deciding whether a newsletter is even worth it for your business, book a free 15-minute call with me. We will look at what you are sending today and what would make it easier to keep up.