Does CAN-SPAM Apply to PR Pitches and Press Release Email?

Does it really cover PR email?

The question is asked constantly and the FTC answers it directly. Its CAN-SPAM compliance guide states: "The law makes no exception for business-to-business email. That means all email must comply with the law."

That sentence disposes of the most common assumption in outreach, which is that emailing professionals in their professional capacity sits outside consumer protection law. It does not.

The harder question is which messages are commercial. The Act distinguishes commercial messages, whose primary purpose is advertising or promoting a product or service, from transactional or relationship messages. A genuine pitch offering a story to a journalist is not obviously either, and the answer turns on the primary purpose of the particular message rather than on the sender's job title.

The prudent reading for anyone running outreach at scale is that a good deal of it is commercial in purpose, and that designing compliant messages costs little compared with the exposure if that reading is right.

It is worth separating two populations that outreach programmes treat identically. A journalist who has covered your sector and might want a story is a different recipient from a purchased list of addresses at companies in a target segment, and the second is far more likely to be sending commercial messages within the Act's meaning.

The safest working assumption for a mixed programme is that the mechanical requirements cost almost nothing to satisfy, so meeting them everywhere is cheaper than adjudicating which messages are commercial.

What do the rules require?

Five things, all mechanical and all checkable before a campaign goes out.

Accurate headers: "your 'From,' 'To,' 'Reply-To,' and routing information must be accurate." Accurate subject lines: "the subject line must accurately reflect the content." That second one bears on a common outreach habit of writing subject lines engineered for opens rather than for accuracy.

Identification: commercial messages must "disclose clearly and conspicuously that your message is an advertisement." A valid physical postal address must appear. And the message must include "a clear and conspicuous explanation of how the recipient can opt out."

Then the operational obligation: senders must "honor a recipient's opt-out request within 10 business days." That is a process requirement rather than a drafting one, and it is where outreach programmes most often fail, because it needs a suppression list that actually works across tools and campaigns.

One further requirement is easy to miss in outsourced programmes: the obligation does not transfer to whoever presses send. A company using an agency or a tool remains responsible for messages sent on its behalf, which is the same allocation the FTC applies to advertisers and intermediaries in its endorsement framework.

How large is the exposure?

Per message, which is the detail that changes the arithmetic of bulk outreach.

The FTC states that "each separate email in violation of the CAN-SPAM Act is subject to penalties of up to $53,088." The unit is the email, not the campaign.

A programme sending a few thousand pitches with a missing postal address is therefore not exposed to one penalty; it is exposed to a number multiplied by the send volume. That is a different risk profile from most of the disclosure rules examined in this series, which attach to a piece of published content.

It is also the clearest illustration of why volume outreach and volume placement carry structurally similar problems. Both scale cheaply, and both scale their compliance exposure at exactly the same rate.

The per-message unit also changes how a programme should be tested. Sending a small batch, checking the mechanics against the FTC's list, and only then scaling is the difference between one correctable mistake and several thousand identical ones.

Where does outreach usually go wrong?

In the same three places, none of which is about the pitch itself.

Subject lines first. Outreach is optimised for open rates, and the techniques that raise them — implied familiarity, implied replies, urgency that the body does not support — run directly against the requirement that a subject line accurately reflect the content.

Addresses second. Many outreach tools do not insert a postal address by default, and a template built without one sends thousands of messages missing a required element.

Opt-outs third, and most seriously, because the failure is invisible. A recipient who asks to be removed and is then contacted again by a different tool, list or colleague has had their request ignored, whatever the sender intended. Honouring opt-outs within ten business days requires a single suppression list that every sending system respects.

None of this makes outreach improper. It makes it a regulated activity conducted at scale, which is a description most PR programmes would not recognise and should.

Personalisation tokens deserve a mention of their own. A subject line that implies a prior relationship or a continuing thread, generated automatically for a recipient who has never corresponded with the sender, is inaccurate in exactly the way the header and subject requirements address.

How does this relate to the rest of the disclosure landscape?

It is the same regulator applying the same instinct to a different surface.

The FTC's native advertising guidance asks whether a reader can tell that published content is advertising. CAN-SPAM asks whether a recipient can tell that a message is an advertisement, who sent it, and how to make it stop. Both are about a person being able to identify what they are looking at and who is behind it.

The pattern holds across every regime in this series. Google News and Discover require sponsorship to be disclosed to readers; the Wikimedia Terms require paid editors to name their client; Section 17(b) requires the amount paid to be stated. Different surfaces, one principle.

For a company running both placement and outreach, the practical implication is that the compliance question is not several unrelated problems. It is one habit — say who is behind this and what it is — applied wherever the company communicates.

The convergence is practical rather than philosophical. A company that adopts one habit — state who is behind this, what it is, and how to stop receiving it — satisfies an email statute, a native advertising guide, two platform policies and a volunteer encyclopaedia's sourcing rules without tracking any of them separately.

What this means for anyone running PR outreach

Audit the mechanics before the message. Postal address present, opt-out present and working, headers accurate, subject line honest. Those are checkable in an afternoon and they are where the rule actually bites.

Build one suppression list and make every tool respect it. The ten-business-day obligation is a systems problem, and it is the one most likely to be breached by a well-meaning team using several platforms.

Write subject lines the email supports. The same discipline this series recommended for headlines under Google Discover's preview rule applies here, for the same reason: a promise the content does not keep is the thing being regulated.

Media Morpheus sells placement and distribution rather than outreach software, and the honest note is that the exposure here scales with volume in a way buyers rarely price. A thousand pitches is a thousand opportunities to be right, and the penalty is stated per message.

Keep the suppression list outside any single vendor. Tools get replaced, and an opt-out honoured only inside a platform you later stop paying for is an opt-out you will breach the moment you migrate.

Treat the audit as recurring rather than one-off, since templates drift as teams change.

Methodology and limitations

This report is based on the Federal Trade Commission's published CAN-SPAM Act compliance guide for business, quoted for the header and subject line requirements, advertisement identification, physical address, opt-out mechanism and timing, the stated penalty amount, and the application to business-to-business email. Five limits apply. First, this is not legal advice; whether a given message is a commercial message under the Act turns on its primary purpose and is fact-specific. Second, the report describes the federal statute as summarised by the FTC and does not analyse state law, enforcement actions or case law. Third, the penalty figure is the maximum stated in the guide and is adjusted periodically for inflation. Fourth, the Act addresses commercial email and treats transactional and relationship messages differently, a distinction this report describes only in outline. Fifth, guidance is revised and this describes the position at the date of publication.

Conclusion

The most useful sentence in the FTC's guidance is the one that closes the argument PR teams usually have: "the law makes no exception for business-to-business email." From there the requirements are mechanical — accurate headers and subject lines, clear identification as an advertisement, a valid postal address, a working opt-out honoured within ten business days — and the penalty is stated per message at up to $53,088. That last detail is what makes this different from the content rules elsewhere in this series. A sponsored article that breaches a labelling rule is one page; an outreach programme that ships without a postal address is one failure multiplied by the send list.

Frequently Asked Questions

Sources

1. official US Federal Trade Commission. CAN-SPAM Act: A Compliance Guide for Business, for the requirements, timing and penalty figure.
2. official US Federal Trade Commission. Native Advertising: A Guide for Businesses, cited for the parallel disclosure principle.