CAN-SPAM Compliance in AcelleMail: The 7-Point Checklist

CAN-SPAM applies to every commercial email you send to a US recipient — fines reach $51,744 per violating message. This checklist walks the 7 rules, marks the ones AcelleMail enforces for you, and tells you exactly where to set the rest.

What this is for

The CAN-SPAM Act (US, 2003) applies to every commercial email you send to a recipient in the United States — regardless of where you or your server is located. The Federal Trade Commission can fine you up to $51,744 per non-compliant message, and that ceiling is adjusted upward for inflation each January.

The good news: AcelleMail handles the technical half of compliance for you. The other half is editorial — honest subject lines, correct from-name, an accurate physical address on file. This is the buyer-side checklist.

The 7 requirements, mapped to AcelleMail

# Rule Who handles it Where in AcelleMail
1 Don't use false or misleading header info You Lists → [list] → Edit — your From name and From email must accurately identify your business
2 Don't use deceptive subject lines You Subject is what you type in the Campaigns wizard — never use "Re:" / "Fwd:" / fake urgency
3 Identify the message as an advertisement You If you don't have express consent (e.g. cold outreach), say "Advertisement" in the body or footer
4 Tell recipients where you're located AcelleMail (after you fill it in) Account → Contact — fill in Company info + Address once; AcelleMail injects it into every campaign footer
5 Tell recipients how to opt out AcelleMail Every campaign automatically gets an unsubscribe link — you cannot turn it off
6 Honor opt-out requests within 10 business days AcelleMail Unsubscribed subscribers are suppressed immediately — they cannot be re-imported into the same list
7 Monitor what others do on your behalf You If you give an agency access to your AcelleMail account, you're still liable for their sends

Where to fill in your physical address

Go to Account → Contact. The page has two cards: Company info (legal name + display name) and Address (Address 1, Address 2, City, State, ZIP, Country). Save once — AcelleMail uses these values in the campaign footer for every list. If the address card is empty, the footer will fall back to your account email, which is not CAN-SPAM compliant.

A valid address is a street address, PO Box, or commercial mailbox registered with the USPS. A residential apartment is fine. A virtual mailbox (e.g. iPostal1, Earth Class Mail) is fine. A "we have offices in San Francisco" tagline is not — you need a specific deliverable address.

What AcelleMail enforces automatically

  • Unsubscribe link in every campaign footer. The template language {UNSUBSCRIBE_URL} resolves to a per-subscriber one-click link.
  • Suppression after unsubscribe. Once a subscriber clicks unsubscribe, they're flagged unsubscribed on that list and excluded from all future sends. They can re-subscribe via your signup form if they choose, but you cannot re-import them.
  • List unsubscribe headers (List-Unsubscribe and List-Unsubscribe-Post). AcelleMail adds the RFC 8058 one-click headers Gmail and Yahoo now require. Most modern clients render an "Unsubscribe" button in the message header from these.

What you still need to watch

Issue Fix
Your From name is your CEO's first name only ("Sarah") Change it to a business identifier — "Sarah at Awesome Solutions". From-line must identify the sender.
You're sending to people who never asked — and your footer doesn't say "Advertisement" Add an "Advertisement" or "Promotional message" line in the footer area of your template, OR get explicit opt-in first.
You bought a list and want to email it CAN-SPAM allows it (it's "opt-out" not "opt-in"), but Gmail/Yahoo deliverability will tank. Don't. See Email List Hygiene.
You set up a different unsubscribe page in your template Don't — AcelleMail's built-in {UNSUBSCRIBE_URL} is the only one that triggers automatic suppression.

Common issues

What you see What to do
Campaign footer shows your account email instead of an address Go to Account → Contact, fill in Address 1 / City / Country, save. The next send will use it.
Subscriber complains they unsubscribed but got another email Verify they clicked the link in the footer (not a custom "stop" link in your body). If they did, check Lists → [list] → Subscribers and confirm their status is unsubscribed. If not, contact support — auto-suppression should be instant.
You want to re-import someone who previously unsubscribed Don't. CAN-SPAM forbids it without fresh consent. Have them sign up again via your form.

What to do after

  1. Open Account → Contact and confirm both Company info and Address cards are filled in.
  2. Open one of your last sent campaigns and scroll to the footer — confirm the address renders, and the unsubscribe link works.
  3. Read Double Opt-In vs Single Opt-In — double opt-in dramatically reduces CAN-SPAM exposure even though it isn't legally required.

Related articles

13 Kommentare

5 Kommentare

  1. v.petrova.ru
    Passed a SOC 2 audit last quarter using this as part of our documentation set. Auditors specifically noted the data-flow diagram was helpful.
    1. admin
      Thanks for the numbers. Worth pulling into a follow-up post on volume-tier sizing.
  2. tnovak.cz
    For HIPAA — is AcelleMail considered a Business Associate? Looking at whether we need a BAA.
    1. admin
      There's no built-in way today. Two workarounds: (1) cron + custom script polling the API every N minutes, (2) webhook-driven if your event source supports it. Most operators go with #2.
    2. admin (bearbeitet)
      Right — for RDS specifically, you can change wait_timeout via the parameter group without a reboot if it's set as 'dynamic'. Most defaults are
  3. jmorrison.itop…
    The GDPR data-eport article is what I sent to our DPO. Saved us a meeting.
  4. linhvu.dev
    add audit logging for every admin action. we added a small middleware that logs to s3 — invaluable when answering compliance questions retroactively
    1. admin
      worth adding to the article. pr welcome if you want to author the addition...
    2. admin (bearbeitet)
      Yep, same pattern works for us. Thanks for sharing...
  5. hung.nguyen.it
    the GDPR data-export article is what I sent to our DPO. Saved us a meeting.
    1. admin
      Thanks for the kind words. We try to keep these source-grounded so they age well
    2. admin (bearbeitet)
      Appreciate it. If anything in this needs updating, ping us — we revisit articles every few months. 👀
    3. admin (bearbeitet)
      thanks for the kind words. we try to keep these source-grounde so they age well

More in Security & Compliance