Signatoro

CAN-SPAM and your email signature

The physical address and opt-out requirements live in the commercial message, not automatically in every signature you sign a reply with.

The US CAN-SPAM Act requires a valid physical postal address and a working opt-out mechanism on commercial email. It does not require those two things to sit inside a personal reply signature, and a confidentiality disclaimer is not the same requirement and does not satisfy it. What counts as "commercial" is about the message's primary purpose, not who is CC'd.

Who this applies to

CAN-SPAM (15 U.S.C. ch. 103, implemented by the FTC at 16 CFR Part 316) applies to commercial electronic mail: messages whose primary purpose is advertising or promoting a commercial product or service. It applies regardless of whether the sender is a business-to-consumer or business-to-business company - the Act does not carve out a B2B exception. Ordinary transactional and relationship messages, and personal one-to-one email that is not promoting anything, generally fall outside it.

What it actually requires

A valid physical postal address
Every commercial message needs a current street address, a registered P.O. box, or a private mailbox registered with a commercial mail-receiving agency. It has to be genuinely reachable - a defunct address does not satisfy the requirement.
A clear, working opt-out mechanism
Recipients need an obvious way to say no to future commercial email from you, and that mechanism has to keep working for at least 30 days after the message was sent. Once someone opts out, the sender has 10 business days to honor it and cannot charge a fee, require more information than an email address, or require anything beyond a visit to a single web page or a reply email.
Accurate header and subject-line information
The "From," "To," and routing information must accurately identify the sender, and the subject line cannot be deceptive about the content of the message.
A clear identification that the message is an ad, where applicable
If the message is an advertisement, it must be clearly and conspicuously identified as such, unless the recipient has given prior affirmative consent.

Myths we hear often

The myth

My company is B2B, so CAN-SPAM does not apply to us.

What the source actually says

The FTC's own guidance is explicit that CAN-SPAM covers all commercial messages, including business-to-business email - there is no B2B carve-out. What matters is whether the message's primary purpose is commercial, not who the recipient is.

The myth

A confidentiality disclaimer in my signature satisfies CAN-SPAM.

What the source actually says

A confidentiality notice ("This email is intended only for the recipient...") addresses a different concern entirely - it says nothing about a physical address or an opt-out mechanism, and it does not substitute for either.

The myth

Every email I send needs a physical address and unsubscribe link in my signature.

What the source actually says

The requirement attaches to the commercial message, generally handled in the campaign footer of marketing and newsletter tools, not to the reply signature on every one-to-one email a salesperson sends. A message that is not commercial in primary purpose is not the message CAN-SPAM's address-and-opt-out rule is written for.

A worked example

A fictional example: Alderleaf Outfitters
Alderleaf Outfitters, a fictional outdoor-gear retailer, sends a monthly promotional newsletter through its email marketing platform and its sales reps send one-to-one replies to customer questions from their own inbox. The newsletter template carries the company's registered mailing address and an unsubscribe link in its footer, set once in the marketing platform - that is the commercial message CAN-SPAM's address-and-opt-out rule is written for. The reps' personal signatures carry a name, title, and phone number; they are not run through the same rule, because the emails they sign are answering a question, not advertising a product.

Questions people ask

Does CAN-SPAM apply to B2B email?

Yes. The FTC's guidance states plainly that CAN-SPAM applies to all commercial email, including business-to-business messages. There is no exemption for messages sent to a business address or to a professional contact.

Does my personal email signature need an unsubscribe link?

Generally, the unsubscribe requirement attaches to commercial email - messages whose primary purpose is advertising or promoting a product or service. A personal reply that answers a question rather than promoting something is typically not the kind of message the requirement targets, though a company running a review of its own compliance should treat this as a question to raise with counsel rather than a rule to guess at.

Is a confidentiality disclaimer the same as CAN-SPAM compliance?

No. A confidentiality disclaimer is about who is allowed to read a message; CAN-SPAM is about identifying the sender, giving a physical address, and offering an opt-out on commercial email. They solve different problems and one does not stand in for the other.

Put your own details on every signature you send

Signatoro puts your name, title and contact details on every signature, free for one person. From the Up to 15 plan, a company adds one compliance footnote to everyone's signature.

Create my companyBuild my own signature, free

Other pages in this series

GDPR and your email signaturePECR and marketing email signaturesUK company email signature requirementsHIPAA email disclaimer mythsFINRA email disclaimer mythsCompliance hub

Sources