What Are the Rules for Small Business Email Marketing?

By Bill Stilwell · Last reviewed October 17, 2026

The short answer

The federal CAN-SPAM Act sets the main rules for marketing email in the United States. Your emails need an accurate sender and subject line, a clear note that the message is an ad, a valid postal address, and a working way to unsubscribe. You must honor opt-outs within 10 business days. Sending only to people who agreed to hear from you, at a pace they expect, keeps you out of trouble and out of spam folders.

Why it matters

The Federal Trade Commission (FTC) says each email that breaks CAN-SPAM can bring a large penalty, and the amount is updated for inflation. Beyond the law, email providers filter mail that people mark as spam, so careless sending can hurt delivery of all your mail, including invoices and appointment messages.

18.3.1 Permission

What it means: confirming you have the right to send the message.

How to do it: CAN-SPAM itself is mostly an opt-out law, but good practice is to email only people who gave you their address and agreed to hear from you, like customers and people who signed up on your website. Record where and when they agreed (see 12.6 Communication Consent Records). Most email marketing services require permission-based lists in their terms, so check your tool’s rules.

Common mistake: adding every business card from a trade show to your newsletter.

18.3.2 Sender identity

What it means: making it clear who the email is from.

How to do it: the FTC says the From, To, Reply-To, and routing information must be accurate and identify the business. Send from your business domain (see 12.1.1 Business Email Domain) and use your real business name as the sender.

Common mistake: sending from a personal Gmail address with no business name.

18.3.3 Content

What it means: useful, truthful information that matches the subject line.

How to do it: the subject line must reflect what’s in the email. Say clearly that the message is an ad, in whatever way fits. Include a valid physical postal address, which the FTC says can be a street address, a registered post office box, or a registered private mailbox. Every claim must be true and provable (see 11.3.1 Truthful Advertising Claims).

Common mistake: a subject line like “Your account update” on a sales email.

18.3.4 Unsubscribe

What it means: a working way to opt out.

How to do it: put a clear unsubscribe link or instructions in every marketing email. The FTC says you can’t charge a fee, can’t ask for more than an email address, and can’t make people do more than reply to an email or visit one web page. The opt-out must keep working for at least 30 days after you send.

Common mistake: an unsubscribe link that asks people to log in first.

18.3.5 Suppression

What it means: honoring opt-outs in every system you send from.

How to do it: process opt-outs within 10 business days, which is the FTC’s limit. Keep one master do-not-email list and load it into every tool, including your customer records system and any one-off sending tool. The FTC says you can’t sell or transfer the addresses of people who opted out, except to a company that helps you comply. You stay responsible even if a vendor sends the email for you.

Common mistake: a contact unsubscribes in the newsletter tool, then gets a promo from the booking system.

18.3.6 Frequency

What it means: not sending more often than people expect.

How to do it: tell people how often you’ll email when they sign up, then stick to it. For most local businesses, monthly or seasonal is plenty. Send more only when there’s a real reason, like a cleanup offer after a big storm.

Common mistake: three emails a week to customers who signed up for “occasional tips.”

18.3.7 Tracking

What it means: measuring what happened after you sent.

How to do it: track delivery, bounces, clicks, replies, inquiries, booked jobs, unsubscribes, and spam complaints. Treat open rates as a rough signal only. Connect booked jobs to the email with a unique link or code (see 15.8 Lead-Source Tracking). A jump in unsubscribes or complaints is a sign to change the content or slow down.

Common mistake: judging success by opens instead of booked jobs.

Transactional emails

Receipts, appointment confirmations, and warranty notices are treated differently. The FTC says messages whose main purpose is transactional or relationship are exempt from most CAN-SPAM rules, but they still can’t use false or misleading routing information. If you add a promotion to a receipt, the message may be treated as marketing, so the rules above apply.

When to get help from a pro

An attorney who handles marketing law can review your sign-up wording and email footer. Questions to ask:

Does anything in my emails create risk under federal or state law on false or misleading messages?
Are my receipts and reminders safe as transactional messages, or do they count as marketing?
What should my email vendor contract say about opt-outs and data?

Bill’s note

[Bill: add a short note. For example, how SiteSmarty sends client newsletters or tips, or a client whose emails went to spam because of a bought list.]

How I did this for SiteSmarty

[Date I did this:]
[What I actually did, step by step: the SiteSmarty email tool, sign-up wording, footer, and suppression list]
[What it cost and how long it took:]
[What surprised me or what I’d do differently:]
[Screenshot or photo to add, with private info blurred: the email footer and suppression settings]
[Result so far:]

Questions people ask

Do I need permission to send marketing emails? CAN-SPAM focuses on opt-outs, but emailing only people who agreed to hear from you is the safe and effective practice, and most email services require it.

Do I have to include my address? Yes. The FTC says marketing emails need a valid postal address, which can be a street address, a registered post office box, or a registered private mailbox.

How fast must I process an unsubscribe? Within 10 business days, and the opt-out must keep working for at least 30 days after you send.

Am I responsible if my email company sends it? Yes. The FTC says both the business being promoted and the sender can be held liable.

Audit check

Outline line	Question	Pass looks like	Fail looks like	Evidence to collect
18.3.1 Permission	Does the list come from people who agreed to hear from you?	Recorded sign-up source	Bought or scraped list	List sources and consent records
18.3.2 Sender identity	Are sender details accurate and branded?	Business name and domain	Personal or misleading sender	Sample email headers
18.3.3 Content	Do subject lines match, ads identified, address included?	All present and true	Misleading subject, no address	Sample emails
18.3.4 Unsubscribe	Does every marketing email have a simple working opt-out?	One-click or one-page opt-out	Login required or broken link	Test unsubscribe
18.3.5 Suppression	Are opt-outs honored in every tool within 10 business days?	Master list in all tools	Opt-out ignored in one tool	Suppression list and tool settings
18.3.6 Frequency	Does sending match what people were told?	Stated pace followed	Rising unsubscribes from overload	Send calendar
18.3.7 Tracking	Are inquiries, sales, and complaints tracked?	Report ties emails to jobs	Opens only	Campaign report

Where this fits

Do this first: 12.6 Communication Consent Records, 12.1.6 Email Security

Do this next: 18.4 Text Message Marketing Rules

Sources

Federal Trade Commission, "CAN-SPAM Act: A Compliance Guide for Business" (checked October 17, 2026)
Federal Trade Commission, "Advertising FAQ's: A Guide for Small Business" (checked October 17, 2026)

This page explains general rules and Bill's own experience. It is not legal, tax, or insurance advice. Talk to a qualified professional about your situation.