US commercial email, marketing calls and texts are governed by two federal laws with very different risk profiles: CAN-SPAM, which regulators enforce per message, and the TCPA, which lets any recipient sue for $500 per call or text. CAN-SPAM (15 U.S.C. 7701 et seq. and the FTC's rule at 16 CFR Part 316) sets rules for headers, subject lines, identification and opt-out. The Telephone Consumer Protection Act (47 U.S.C. 227 and the FCC's rules at 47 CFR 64.1200) governs autodialled, prerecorded and artificial voice calls, texts, the Do Not Call registry and caller ID spoofing. This guide covers who and what each law reaches, the obligations that matter to security and engineering teams (header integrity, sender authentication, STIR/SHAKEN, consent and opt-out records), the 2025 and 2026 changes, and what both laws mean when AI agents and automated systems send the messages. It is for security, marketing operations, CRM and compliance teams. Status was checked on eCFR, the FCC, the Eleventh Circuit and the Supreme Court in October 2026.
Key takeaways
- CAN-SPAM is opt-out, the TCPA is consent-based. You may send commercial email without prior consent if you identify yourself and honour opt-outs within 10 business days; autodialled or prerecorded marketing calls and texts to mobiles need prior express written consent.
- Header falsity is the security core of CAN-SPAM. Materially false or misleading header and routing information is unlawful even in transactional email, and relaying through compromised machines or open relays is an aggravated violation.
- The TCPA is a litigation risk, not only a regulatory one. Recipients can claim $500 per violation, up to $1,500 if wilful or knowing, so a misconfigured campaign platform can produce class actions.
- The consent rules moved in 2025 and 2026. The Eleventh Circuit vacated the FCC's one-to-one consent rule in January 2025, the revocation-by-any-reasonable-means rules took effect on 11 April 2025, and the "revoke all" element is delayed to 31 January 2027.
- AI voices are "artificial" voices. The FCC ruled in February 2024 that AI-generated and cloned voices fall under the TCPA, so an AI calling agent needs the same consent, identification and opt-out as a prerecorded message.
Scope: who and what is covered
CAN-SPAM covers commercial email to any recipient, business or consumer. The TCPA covers calls and texts made with an automatic telephone dialling system (ATDS) or an artificial or prerecorded voice, and telephone solicitations to residential subscribers. Commercial email sent to a wireless carrier's email-to-device domain sits under a separate FCC rule (47 CFR 64.3100) that requires express prior authorisation.
| Question | CAN-SPAM | TCPA |
|---|---|---|
| Legal source | 15 U.S.C. 7701 to 7713; FTC rule 16 CFR Part 316 | 47 U.S.C. 227; FCC rules 47 CFR 64.1200 and Part 64 Subpart HH (caller ID authentication) |
| Channel | Commercial email; header rules also bind transactional or relationship email | Voice calls, prerecorded and artificial voice messages, texts to wireless numbers, fax advertisements |
| Consent model | Opt-out: no prior consent needed for ordinary commercial email | Prior express consent for ATDS or artificial voice calls to mobiles; prior express written consent for telemarketing |
| Who is liable | The initiator and the advertised seller; more than one party can be liable for the same email | The caller and, in many cases, the seller on whose behalf calls are made |
| Who enforces | FTC, sector regulators (including the FCC), state attorneys general, internet access service providers | FCC, state attorneys general and private plaintiffs |
| State law | Preempts state email laws except rules against falsity or deception | Does not preempt stricter state telemarketing laws |
Commercial, transactional or other: the primary purpose test
Under 16 CFR 316.3 a message is commercial if it consists exclusively of advertising or promotion. A message mixing promotion with transactional content is commercial if a reasonable recipient reading the subject line would conclude it is an advertisement, or if the transactional content does not appear, in whole or in substantial part, at the beginning of the body. The five transactional or relationship categories are construed narrowly. Security alerts such as password reset notices are transactional; a promotional banner near the top can make them commercial.
Key obligations
CAN-SPAM: what every commercial email must do
| Requirement | Source | What it means in practice |
|---|---|---|
| No materially false or misleading header information | 15 U.S.C. 7704(a)(1) | From, To, Reply-To and routing must identify the sender. Technically accurate headers are still misleading if the domain or IP was obtained by fraudulent pretences, or if mail is routed through another computer to disguise its origin |
| No deceptive subject lines | 7704(a)(2) | The subject must not mislead a reasonable recipient about a material fact about the content |
| Functioning opt-out | 7704(a)(3); 16 CFR 316.5 | Clear return address or web mechanism, working for at least 30 days after sending; a preference menu is allowed if it includes "all commercial email"; no fee and no steps beyond giving an email address and preferences, a reply email or a single web page |
| Honour opt-outs | 7704(a)(4) | Stop within 10 business days; never sell, lease or transfer an opted-out address except to a party helping you comply |
| Identify, notify, give an address | 7704(a)(5) | Identify the message as an advertisement (unless the recipient gave affirmative consent), give notice of the opt-out and a valid physical postal address |
| Sexually explicit label | 7704(d); 16 CFR 316.4 | Subject begins "SEXUALLY-EXPLICIT: " as its first 19 characters, with a plain initial view, unless the recipient gave prior affirmative consent |
The FTC is explicit that you cannot contract away responsibility when a vendor or affiliate sends for you. In multi-advertiser email, one designated sender in the From line carries the initiator duties; if it fails, every marketer in the message may be liable.
CAN-SPAM aggravated violations: the security list
Section 7704(b) reads like a description of spam infrastructure. Each is an aggravated violation when combined with an unlawful message, and the FTC notes some carry criminal penalties:
- Address harvesting: collecting addresses by automated means from sites that promised not to share them.
- Dictionary attacks: generating addresses by combining names, letters or numbers.
- Scripted account creation: using scripts to register multiple email or online accounts to send unlawful mail (the abuse pattern MITRE ATT&CK tracks as T1585.002 Email Accounts).
- Relay through unauthorised access: sending through a computer or network accessed without authorisation, including open relays and proxies (compare T1584 Compromise Infrastructure).
TCPA: the rules for calls and texts
| Rule | Source | Detail |
|---|---|---|
| Consent for ATDS and artificial or prerecorded voice calls to mobiles | 47 U.S.C. 227(b)(1)(A); 47 CFR 64.1200(a)(1) | Prior express consent, or an emergency purpose; texts are treated as calls |
| Written consent for telemarketing | 64.1200(a)(2), (f)(9) | Signed written agreement (e-signatures valid) naming the number, authorising the seller's calls and stating that consent is not a condition of purchase |
| Prerecorded voice to residential lines | 227(b)(1)(B); 64.1200(a)(3) | Prior express consent (written for telemarketing) unless an exemption applies |
| Revocation of consent | 64.1200(a)(10) to (a)(12) | Any reasonable method; replies such as STOP, QUIT, END, REVOKE, OPT OUT, CANCEL or UNSUBSCRIBE are per se reasonable; honour within 10 business days; one confirmation text allowed, presumed fine within five minutes |
| Calling hours | 64.1200(c)(1) | No telephone solicitations before 8am or after 9pm in the called party's local time |
| National Do Not Call registry | 64.1200(c)(2) | Safe harbour needs written procedures, training, a suppression list and a registry version no more than 31 days old |
| Company-specific Do Not Call | 64.1200(d) | Written policy, trained staff, record requests at the time made, honour within 10 business days and for five years |
| Abandoned calls | 64.1200(a)(7) | At most 3% of live-answered telemarketing calls per campaign over 30 days; connect to a live agent within two seconds of the greeting |
| Prerecorded message content | 227(d)(3); 64.1200(b) | Identify the caller at the start, give a number or address, release the line within 5 seconds of hang-up; telemarketing messages need an automated opt-out |
Caller ID spoofing and STIR/SHAKEN
The Truth in Caller ID provision (227(e)) makes it unlawful to transmit misleading or inaccurate caller ID with intent to defraud, cause harm or wrongfully obtain anything of value. Separately, the FCC's caller ID authentication rules (47 CFR Part 64 Subpart HH) required voice service providers and intermediate providers to implement STIR/SHAKEN in IP networks by 30 June 2021, signing calls with a certificate obtained through their own SPC token. Since an amendment of 19 August 2025, a provider using a third-party signing service must have calls signed with its own certificate, make all attestation decisions itself and keep the written agreement for two years after it ends. Every provider must run a robocall mitigation programme, file in the Robocall Mitigation Database, respond to traceback requests within 24 hours and recertify each year by 1 March. For enterprises, the attestation level your carrier gives your outbound calls (A, B or C) depends on whether it can verify your right to the number presented, so register outbound numbers with carriers. See the Vishing and Smishing Guide for the defensive side.
Timeline and current status
| Date | Event | Effect today |
|---|---|---|
| 1991 | TCPA enacted | In force, frequently amended by FCC rule |
| 1 January 2004 | CAN-SPAM Act effective | In force; FTC rule at 16 CFR Part 316 |
| 30 June 2021 | STIR/SHAKEN deadline for IP networks | In force, with later extensions for small and non-IP providers now expired |
| 8 February 2024 | FCC Declaratory Ruling FCC 24-17 on AI-generated voices | AI and cloned voices are "artificial" voices under the TCPA |
| 24 January 2025 | Insurance Marketing Coalition v. FCC (11th Cir., No. 24-10277) | Vacated the 2023 one-to-one consent and "logically and topically related" restrictions; consent obtained for several sellers on one form is not barred by that rule |
| 11 April 2025 | 2024 revocation of consent rules take effect | Any reasonable means, 10 business days, confirmation text |
| 20 June 2025 | McLaughlin Chiropractic Associates v. McKesson (US Supreme Court) | District courts in enforcement proceedings are not bound by FCC interpretations of the TCPA; they interpret the statute themselves, giving the agency appropriate respect |
| 6 January 2026 | FCC order DA 26-12 | Delays the "revoke all" element of 64.1200(a)(10) (an opt-out from one type of message applies to all unrelated robocalls and robotexts) to 31 January 2027, while the FCC considers changes |
After McLaughlin, long-standing FCC interpretations (what counts as an ATDS, the scope of consent) can be argued afresh in each district court. The revoke-all date has already moved twice: build the capability, but check the FCC docket before switching it on.
Enforcement and penalties
| Enforcer | Law | Exposure |
|---|---|---|
| FTC | CAN-SPAM | Civil penalties up to $53,088 per separate email (the FTC's current inflation-adjusted figure); deceptive advertising claims under FTC Act Section 5 |
| State attorneys general | CAN-SPAM 7706(f) | Up to $250 per violation, capped at $2 million except for header falsity; up to treble for wilful, knowing or aggravated violations |
| Internet access service providers | CAN-SPAM 7706(g) | Up to $100 per header-falsity violation and $25 for others, capped at $1 million except header falsity; up to treble |
| Department of Justice | Criminal provisions (including 18 U.S.C. 1037) | Fines and imprisonment for aggravated conduct; up to five years for knowing sexually-explicit labelling violations under 7704(d) |
| Private plaintiffs | TCPA 227(b)(3) and (c)(5) | $500 per violation or actual loss, up to $1,500 if wilful or knowing; Do Not Call claims need more than one call in 12 months; due-care compliance is an affirmative defence |
| FCC | TCPA 227(b)(4) and (e) | Forfeitures under 47 U.S.C. 503(b), plus up to $10,000 per intentional violation; spoofing up to $10,000 per violation, capped at $1 million per act |
There is no CAN-SPAM private right of action for individuals, which is why consumer litigation concentrates on the TCPA and on state laws that prohibit deceptive email.
What it means for AI agents and non-human identities
- AI calling and texting agents: under FCC 24-17, a voice agent that speaks with a synthetic or cloned voice is making artificial voice calls. It needs prior express consent (written for telemarketing), must identify the business at the start and must offer an automated opt-out. Treat a "human-sounding" agent no differently from a prerecorded message.
- Agents that send email: an AI agent drafting and sending outreach through a CRM or email API is the organisation initiating commercial email. Its templates need the postal address and opt-out, and it must check suppression before every send. See the Agentic AI Security Guide.
- Sending credentials are non-human identities: API keys for email service providers, SMTP relay accounts, DKIM private keys and SIP trunk credentials let anyone send as you. A stolen key can produce header-compliant but unlawful mail in your name, as the TruffleNet campaign showed when stolen AWS keys were used to abuse Amazon SES, and the Gravity SMTP exposure showed for email API keys on WordPress sites. Vault them, scope them per sender and rotate them. See the Secrets Management Guide.
- Consent records are evidence: integrations and agents that write to the consent store need least-privilege service accounts and an audit trail.
- Sender authentication: CAN-SPAM's header-integrity rule and mailbox provider bulk-sender rules point the same way: aligned SPF, DKIM and DMARC for every system that sends as your domain. See the DMARC, SPF and DKIM Guide.
Compliance steps
- Inventory every sender. List every system, vendor, agent and phone number that emails, calls or texts customers or prospects, with the domain or number it presents and the credential it uses.
- Classify message streams. Mark each stream commercial, transactional or mixed under 16 CFR 316.3, and calls or texts as informational or telemarketing, autodialled or manual, live or artificial voice.
- Authenticate the channels. Publish SPF, sign DKIM with your own domain, move DMARC towards p=reject, put bulk marketing on subdomains, and register outbound calling numbers with carriers for full attestation.
- Build one consent and suppression service. Store consent with timestamp, source, disclosure text shown and the number or address; capture opt-outs from every channel and enforce them across all senders within 10 business days.
- Test before go-live. Send test campaigns to seeded addresses and numbers, confirm the unsubscribe link works without login, reply STOP to texts and verify suppression propagates, and check the DNC scrub date is within 31 days.
- Contract for it. Require email, SMS and dialler vendors to honour suppression, keep logs and notify you of key compromise; remember that CAN-SPAM liability cannot be contracted away.
- Monitor and roll back. Watch complaint rates, DMARC reports and opt-out lag; if a stream breaches thresholds or a credential is exposed, pause the stream, revoke the key and replay suppression before restarting.
Small and large organisations
A small firm using one email platform can rely on its built-in unsubscribe and suppression, provided it adds the postal address, authenticates the domain and avoids autodialled or AI voice marketing without written consent. A large enterprise with several brands, regional call centres and AI agents needs a central preference service, because the commonest failure is an opt-out captured in one system and ignored by another.
Detection, measurement and framework mapping
- Opt-out lag: median and maximum time from request to suppression in every sending system (target well under 10 business days).
- Consent coverage: share of telemarketing calls and texts with a retrievable written consent record.
- DMARC pass rate: share of mail from your domains passing aligned DMARC, and unknown sources found in aggregate reports.
- Spam complaint rate: per stream, as reported by mailbox providers.
- DNC scrub age: age of the registry data in use at call time (at most 31 days).
- Call attestation: share of outbound calls signed at A attestation, from carrier reports.
| Obligation | NIST SP 800-53 Rev. 5 | NIST CSF 2.0 | ISO/IEC 27001:2022 Annex A |
|---|---|---|---|
| Know the legal requirements | PT-2 Authority to Process PII | GV.OC-03 | A.5.31 Legal, statutory, regulatory and contractual requirements |
| Consent and revocation records | PT-4 Consent; AU-11 Audit Record Retention | GV.OC-03 | A.5.34 Privacy and protection of PII |
| Disclosures and opt-out notice | PT-5 Privacy Notice | GV.OC-03 | A.5.34 |
| Header integrity and spam controls | SI-8 Spam Protection; SC-8 Transmission Confidentiality and Integrity | DE.CM-01 | A.8.20 Networks security |
| Vendors who send for you | SA-9 External System Services; SR-6 Supplier Assessments and Reviews | GV.SC-05 | A.5.19 Information security in supplier relationships |
Common failure patterns
- Fragmented suppression: an unsubscribe recorded by the marketing platform is not synced to the CRM, the SMS vendor or the AI outreach agent.
- Promotions in security email: marketing banners added to password reset or receipt templates turn them into commercial messages without an opt-out.
- Unverified purchased leads: claimed consent that cannot be produced when a TCPA claim arrives.
- Shadow senders: a regional team or vendor sends as the corporate domain without DKIM or with a shared API key nobody rotates.
- Ignoring free-text revocation: treating only the exact word STOP as an opt-out, when the rule covers any reply a reasonable person would read as revocation.
Practitioner checklist
- Inventory every system, vendor and agent that sends commercial email, calls or texts.
- Classify each stream under the primary purpose test and keep transactional security email free of promotion.
- Enforce aligned SPF, DKIM and DMARC for every sender of your domains.
- Run one consent and suppression service across email, SMS, voice and AI agents.
- Honour every opt-out within 10 business days and keep mechanisms live for at least 30 days after sending.
- Retain written consent records and DNC procedures as evidence for the safe harbour.
- Treat AI voice agents as artificial voice callers: consent, identification and automated opt-out.
- Vault, scope and rotate email API keys, DKIM keys and SIP credentials.
- Track the FCC revoke-all date (currently 31 January 2027) and design for it now.
Standards and references
- US Code: 15 U.S.C. 7704, CAN-SPAM requirements for commercial email
- eCFR: 16 CFR Part 316, CAN-SPAM Rule
- FTC: CAN-SPAM Act, A Compliance Guide for Business
- US Code: 47 U.S.C. 227, Restrictions on use of telephone equipment
- eCFR: 47 CFR 64.1200, Delivery restrictions
- eCFR: 47 CFR Part 64 Subpart HH, Caller ID Authentication
- FCC: Order DA 26-12 extending the revoke-all effective date
- US Court of Appeals for the Eleventh Circuit: Insurance Marketing Coalition v. FCC
Related NHI Mgmt Group resources: PECR Guide · Email Security Guide · Consent Management Guide: Cookies, CMPs and GPC · US State Privacy Laws Guide. This guide summarises the CAN-SPAM Act and the Telephone Consumer Protection Act and is not legal advice.