How to Run a Shop Email List That Complies With CAN-SPAM

Why this matters

A shop email list is one of the cheapest ways to fill a slow week: a spring tune-up offer to past customers books calls within the hour. The federal law that governs it, the CAN-SPAM Act, is not hard to follow, and that is why violations tend to be habits rather than decisions: the unsubscribe that goes to an inbox nobody reads, the tech who blasts his customer contacts from a personal account, the "Re: your service appointment" subject line on a sales email. The FTC can seek civil penalties per email, so a habit repeated across a list of a few thousand addresses adds up quickly. This is the procedure for setting up a list and a send so every message clears the law, with the shop's own habits set tighter than the legal floor where the floor is easy to trip over.

The law in brief, and which layer it is

The CAN-SPAM Act (15 U.S.C. 7701 and following), with the FTC's rule at 16 CFR Part 316, governs commercial electronic mail messages: email whose primary purpose is advertising or promoting a product or service. It is an opt-out law: it does not require permission before you email someone, but it requires honest identification, a postal address, and a working way to stop the mail, honored promptly.

It is unusual in one respect. CAN-SPAM preempts state laws that expressly regulate commercial email, except to the extent a state law prohibits falsity or deception in it. So for email, the federal rule does most of the work and the state layer is thin, unlike most of consumer law. Two things it does not reach: text messages, which fall under the TCPA and its own consent rules (see related: TCPA and 10DLC Compliance for Business Texting), and recipients in other countries, where laws such as Canada's anti-spam statute require consent before sending at all.

This is not legal advice.

The procedure

1. Sort every email you send by primary purpose

Go through every automated and manual email the shop sends and put each in one of two piles. Commercial: promotions, seasonal offers, newsletters that sell, membership pitches. Transactional or relationship: appointment confirmations and reminders, invoices and receipts, warranty and safety information, account notices, and messages finishing a transaction the customer already agreed to. Transactional messages are exempt from most of the rules below but must still not contain false or misleading header information. Why first: every later step applies to the commercial pile, and the most common violation is a commercial message wearing transactional clothes. What breaks if skipped: an appointment reminder that gains a paragraph about a membership sale can tip into commercial under the FTC's primary-purpose test, which looks at the subject line and at what the body leads with, and it then needs everything below.

2. Make the header information honest

The From name, the sending address, the Reply-To and the routing information must accurately identify the shop as the sender. Send from a domain you control, in the shop's name. Why: false or misleading header information is prohibited outright, and it is one of the few points where the law also reaches transactional mail. What breaks if skipped: a promotion sent through a vendor under the vendor's name, or from a no-reply address that bounces, fails the honest-identification rule and makes your opt-out mechanism look broken.

3. Write a subject line that matches the body

The subject line may not mislead the recipient about the content or subject matter of the message. "Spring AC tune-up: book a March visit" is fine. "Re: your service appointment" on a promotion is not, and neither is "Your warranty is expiring" when the email sells a maintenance plan to someone whose warranty is not expiring. Why: this is the rule that catches marketing copy written to raise open rates.

4. Identify the message as an advertisement

A commercial message must clearly and conspicuously identify itself as an advertisement or solicitation. The law does not prescribe wording; a plain line in the footer is a common and adequate approach. There is an exception for recipients who gave prior affirmative consent to receive your commercial mail, so a list built from a "yes, send me offers" checkbox does not need the label, though many shops include it anyway because the list always ends up mixing consented and unconsented addresses.

5. Put a valid physical postal address in every commercial message

Every commercial message must include the sender's valid physical postal address: a current street address, a post office box registered with the Postal Service, or a private mailbox registered with a commercial mail receiving agency under Postal Service rules. What breaks if skipped: a home-based shop that leaves the address off for privacy has violated the rule on every send; the fix is a registered box, not omission.

6. Give an opt-out that works and honor it fast

Every commercial message needs a clear explanation of how to stop future commercial mail, and a working return email address or internet-based mechanism to do it. The rules attached to it:

• The mechanism must work for at least 30 days after you send.
• You must honor a request within 10 business days.
• You may not charge a fee, require any information beyond the email address and opt-out preferences, or make the person do more than reply to an email or visit a single web page.
• You may offer a menu of message types, but it must include an option to stop all commercial messages from you.
• Once someone opts out, you may not sell or transfer their address, except to a company helping you comply.

Set the shop habit tighter than the floor. Ten business days is the outer limit; most email platforms remove a link-click unsubscribe instantly. The exposure is the opt-out that arrives another way: a reply saying "take me off", a voicemail, a comment to a tech. Set a shop standard of two business days for any opt-out by any route, with one named person owning the replies inbox and a backup when they are out.

7. Keep one suppression list across every tool and every person

The shop's email platform, its field-service software, any second platform used for newsletters, and every staff member who emails customers from their own account must draw from one suppression list. Why: the law looks at the sender, defined around whose product the message promotes, so an offer a tech sends from his personal account to the shop's customers about the shop's services is the shop's commercial message. What breaks if skipped: a customer opts out of the newsletter and gets the same offer a week later from the field-service software's campaign feature, and the shop has violated the opt-out rule without anyone deciding to.

8. Hold vendors to the same rules, in writing

If a marketing agency or lead vendor sends for you, you are still responsible, and both of you can be liable. Put the requirements in the agreement and ask to see the footer and the suppression process before the first send. See related: How to Vet a Lead Vendor's Consent Practices.

Worked example: the spring tune-up send

A six-tech HVAC shop builds a spring campaign to its 2,400 past-customer addresses. Steps 1 to 5 produce this commercial email:

From:    Shop Name Heating and Air <office@shopdomain>
Reply:   office@shopdomain
Subject: Spring AC tune-up: book a March visit
--------------------------------------------------
(the offer, its terms and how to book)
--------------------------------------------------
This is an advertisement from Shop Name Heating
and Air, PO Box 2210, Anytown, ST 00000.
You get this because you have had service with us.
Unsubscribe in one click, no login: (link)
Or reply "remove me" and we will take you off
within two business days.

The PO box is registered with the Postal Service, which is what step 5 requires of a box. The subject line describes the body. The ad label is there because about a third of the list never ticked a consent box.

The send goes out on a Tuesday. By Friday, 31 recipients have opted out: 26 through the link, removed by the platform the moment they clicked, and 5 by replying to the office inbox. The shop's two-business-day standard means the 5 reply opt-outs, the last of which arrived Friday morning, must be on the suppression list by end of day Tuesday of the following week. The legal floor would allow until the end of the 10th business day after each request, two weeks later for the Friday reply, not counting any federal holiday in between.

The fork that makes the habit worth having. The owner wants a "last chance" email to the same list the following Monday. If the 5 replies have not been processed by then, they get it. That second send arrives inside the 10-business-day window, so it is not by itself a violation of the honoring rule, but it is exactly the message that generates a complaint, and the person who complains has the reply showing they asked. The shop's rule is that no send goes to a list until the replies inbox is clear. The office manager processes the 5 on Monday morning, the suppression list now holds 31 new addresses, and the last-chance email goes to 2,369 (2,400 minus 31).

The second finding. While building the suppression list, the office manager learns that one tech emails about 60 of his regular customers each spring from his personal account with his own tune-up offer for the shop's services. Under step 7 that is the shop's commercial email, and none of it carries an address, a label or an opt-out. Two of the 31 who opted out are on his list. The fix is not a ban on the tech's outreach, which customers like; it is that his offer goes into the shop's platform, under the shop's footer, to his customers who are not on the suppression list.

What changes the answer. If the shop's list includes customers in Canada, from a branch near the border, those addresses fall under Canada's law, which requires consent before sending and has its own identification rules, so the shop sends them only if it has their consent. If the campaign were a text blast instead of email, none of this procedure would be the right one; the TCPA's consent rules apply, and they are stricter.

What the floor does not cover

CAN-SPAM permits sending to anyone you have an address for. That does not make it wise. Email platforms suspend accounts with high complaint rates, and the major mailbox providers filter senders whose mail is marked as spam, so a list of people who never heard of you can harm delivery to the customers who want your mail. The law sets the minimum; deliverability is usually what sets a shop's real standard. See related: The Email List You Should Be Building.

References

• CAN-SPAM Act of 2003, 15 U.S.C. 7701 and following
• FTC, CAN-SPAM Rule, 16 CFR Part 316 (including the primary-purpose criteria)
• FTC, CAN-SPAM Act: A Compliance Guide for Business
• See related: TCPA and 10DLC Compliance for Business Texting; How to Vet a Lead Vendor's Consent Practices
• See related: The Email List You Should Be Building