Stage 10: Email and texts

The short answer

Every marketing email you send in the US needs a truthful sender and subject, your postal address, and an unsubscribe link that works and is honored within 10 business days, and business email is not exempt. Gmail, Yahoo and Outlook add their own rules: set up email authentication for your domain and add one-click unsubscribe, or your mail goes to spam. For people in the EU, the UK and Canada, get consent before you send marketing email, and for marketing text messages anywhere in the US, get written consent first.

Why this matters

• Up to $53,088 per email. The FTC (the US Federal Trade Commission) says each separate email that breaks CAN-SPAM can bring a penalty of up to $53,088 (FTC guide). There was no increase for 2026: an FTC notice says the 2025 amounts "will remain unchanged during 2026" (FTC notice). State attorneys general can also sue, for up to $250 per message and up to $2 million for most violations (15 U.S.C. 7706).
• Business email counts. The FTC's guide is direct: "The law makes no exception for business-to-business email."
• Your email vendor does not carry the risk for you. The same guide says you "can't contract away your legal responsibility to comply with the law". The company whose product is promoted and the company that sends the email can both be liable.
• The inbox providers enforce their own rules. Since 2024-02-01, Gmail requires authentication from every sender, and stricter rules for bulk senders (Google). Since 2025-05-05, Outlook.com sends mail from high-volume domains that fail the checks to the junk folder, and may then reject it (Microsoft).
• A text can cost $500 to $1,500. Under the TCPA, a person can sue for $500 per violation, and a court can triple that for a willful or knowing violation (47 U.S.C. 227).
• Canada's caps are high. Canada's anti-spam law allows penalties up to CAD 1 million per violation for an individual and CAD 10 million for any other person, such as a company (CASL s. 20).

I got this wrong in my own app at first. Until 2026-10-09, the only way to leave Ducktate's email list was to reply and ask, and nothing in our database recorded the request. The fix is in the core concepts below, along with the part that is still open.

Core concepts

Commercial or transactional

US email law sorts every email into two kinds. A commercial email has the main purpose of selling or promoting a product or service. A transactional email (the rule calls it a "transactional or relationship" message) does a job for a customer: it confirms a purchase, gives safety or security information, tells someone about a change to their account or subscription, or delivers what they bought (16 CFR 316.3). The FTC reads the transactional list narrowly.

Most of CAN-SPAM's rules apply only to commercial email. Transactional email is exempt from most of them, but it must still not have false or misleading header information, such as the From name or the routing (15 U.S.C. 7704).

A mixed email is the tricky case. It is commercial if a reasonable reader would expect an ad from the subject line, or if the transactional part does not appear mainly at the start of the message.

Worked example. Here are five emails an app might send:

The fourth row is the trap. The renewal notices from Stage 9 are transactional. Put an upsell at the top and the email may become commercial, with all the duties below. Keep account emails plain, and send promotions in a separate stream with its own unsubscribe.

What CAN-SPAM requires

CAN-SPAM is the US federal law on commercial email. The FTC's guide lists the duties (FTC guide):

1. Do not use false or misleading header information. The From name, the reply address and the routing must be true.
2. Do not use a deceptive subject line.
3. Identify the message as an ad.
4. Include a valid physical postal address.
5. Tell people clearly how to opt out of future email from you.
6. Honor opt-outs promptly: within 10 business days.
7. Keep the opt-out working for at least 30 days after you send the message.
8. Monitor what others do on your behalf.

The statute has a narrow exception for people who gave you prior affirmative consent, a clear yes to your marketing email (15 U.S.C. 7704). Do not build on it. Keep the unsubscribe link and the address in every marketing email, even to people who asked for your newsletter.

The postal address can be a street address, a PO box registered with the US Postal Service, or a private mailbox registered with a commercial mail receiving agency. A solo founder who does not want a home address in every email can use one of the last two.

Worked example. A compliant footer for a marketing email:

You get this email because you signed up at example.com.
Unsubscribe: https://example.com/unsubscribe?t=TOKEN
Example App LLC, PO Box 1234, Springfield, ST 00000

Three lines cover the address, the opt-out and the reason the person is getting the email. The token in the link identifies the subscriber, so the page needs no login.

The Gmail, Yahoo and Outlook sender rules

These are not laws. They are the conditions under which the big inbox providers deliver your mail. They need three DNS settings. DNS is the public address book for your domain, where you add records in your domain registrar's dashboard.

• SPF (Sender Policy Framework) is a DNS record that lists the servers allowed to send email for your domain.
• DKIM (DomainKeys Identified Mail) adds a digital signature to each email, which the receiver checks against a key in your DNS.
• DMARC (Domain-based Message Authentication, Reporting and Conformance) is a DNS record that tells receivers what to do when a message fails SPF and DKIM, and makes the visible From domain line up with them.

What each provider requires:

Sources: Google, Yahoo, Microsoft. Microsoft's rule covers its consumer email services, not Microsoft 365 business mail.

One-click unsubscribe is a standard (RFC 8058) that lets the mail app show its own Unsubscribe button. It needs two headers, which are hidden lines at the top of each email:

List-Unsubscribe: <https://example.com/unsubscribe?t=TOKEN>
List-Unsubscribe-Post: List-Unsubscribe=One-Click

When the reader presses the button, the mail provider sends a request to that address, and your server records the opt-out. Do all of this even if you send far fewer than 5,000 emails a day. You will grow past it, and Gmail asks for basic authentication from everyone.

What I fixed, and what is still open

When I checked Ducktate's email on 2026-10-09, the opt-out was a mailto header and a line that said to reply to unsubscribe. Nothing stored the request, so a later send script could email that person again. Under CAN-SPAM, that is the "honor opt-outs" duty at risk every time you send.

I fixed it the same day:

1. A preferences table in the database, with Row Level Security on (see Stage 1), that records who has opted out.
2. An unsubscribe function that accepts a signed token. A signed token is a code made with a secret key, so only my server can create a valid link for an address, and nobody can unsubscribe someone else by guessing.
3. An unsubscribe page on the website, the one-click headers above, and a link in the footer of broadcast emails.
4. Send scripts that check the table before they send, so an opt-out takes effect at once, not in 10 business days.

One detail is worth copying. Just opening the unsubscribe link never changes anything; only a deliberate action does. Some mail systems run security scanners that open every link in an email to test it. If opening the link were enough, a scanner could unsubscribe people who never asked.

What is still open as of 2026-10-09: there is no postal address in any of my email templates, which is CAN-SPAM duty number 4. I also have not yet confirmed that every send path, such as the waitlist confirmation, checks the opt-out table. Run the prompt below and you will find gaps like these in your own app.

EU, UK and Canada: consent first

US law lets you email first and stop when asked. Europe and Canada work the other way round.

EU. Under Article 13 of the ePrivacy Directive, marketing email needs the recipient's prior consent. There is one exception, the soft opt-in: you may email your existing customers about your own similar products, if you gave them a free and easy way to opt out when you collected the address and in every message (ePrivacy Art. 13, UK-hosted copy). That link is the copy on legislation.gov.uk, because the official EU site would not load for my research. Each EU country adds its own detail, for example on business addresses.

UK. The PECR regulations, regulation 22, set the same prior-consent rule with the same soft opt-in (PECR reg. 22).

Canada. CASL, Canada's anti-spam law, bans a commercial electronic message unless the recipient consented, either expressly or by implication, and the message identifies the sender, gives contact details and has an unsubscribe mechanism (CASL s. 6). An unsubscribe must take effect within 10 business days, and the mechanism must keep working for at least 60 days after you send (CASL s. 11).

Worked example. Your sign-up form has a pre-ticked box: "Send me product news." A US user who leaves it ticked can get your newsletter, as long as every email follows CAN-SPAM. A user in France has not given consent. European regulators treat consent as a positive action, so a box ticked before the user arrives does not count (EDPB cookie banner report, written about cookies, with the same idea of consent). The fix is an unticked box, a record of who ticked it and when, and a newsletter list that only includes people who did.

Text messages and the TCPA

The TCPA (Telephone Consumer Protection Act) is the US law on calls and texts. The FCC, which enforces it, defines a robocall to include a text sent with an autodialer, meaning automated dialing equipment (FCC draft order). Most texts from an app are sent by software, so plan as if the rule applies to yours.

• Autodialed calls and texts to cell phones need prior express consent. Marketing ones need prior express written consent (47 CFR 64.1200).
• Written consent is a signed agreement (an e-signature counts) that names the phone number and says the consent is not a condition of buying anything.
• A person can sue for $500 per violation, and up to $1,500 if the violation was willful or knowing (47 U.S.C. 227).
• Since 2025-04-11, people can take back consent by any reasonable method, and replies like "stop" or "unsubscribe" count. You must honor it within a reasonable time of no more than 10 business days.

A related part of the rule, under which one "stop" would end all unrelated messages too, was delayed to 2027-01-31. In September 2026 the FCC circulated an order to narrow that part. A law-firm report says it was adopted, but I had not seen it in the Federal Register as of 2026-10-09 (Inside Global Tech, a law-firm blog). Many states also have their own texting laws. I did not research them.

Worked example. Your app sends a one-time login code by text when a user asks for it. That is not marketing. Later you want to text a discount to every user who gave a phone number for login codes. Those users never signed a written consent for marketing texts. Do not send it. Add a separate, unticked consent box that names the number and says consent is not required to buy, and text only the people who tick it.

Key terms

The checklist

• Sort every email your app sends into transactional or commercial, and keep promotions out of receipts, password resets and account notices.Must doSource: 16 CFR 316.3, FTC CAN-SPAM guide
• Put a valid postal address in the footer of every marketing email: a street address, a registered PO box or a registered private mailbox.Must doSource: FTC CAN-SPAM guide, 15 U.S.C. 7704
• Put a clear unsubscribe link in every marketing email, and keep it working for at least 30 days after you send.Must doSource: FTC CAN-SPAM guide, 15 U.S.C. 7704
• Store every opt-out in your own database, and make every send script check that list before it sends.Must doSource: FTC CAN-SPAM guide
• Stop marketing email within 10 business days of an opt-out, and aim for the same day, because Yahoo asks for 2 days.Must doSource: FTC CAN-SPAM guide, Yahoo sender best practices
• Use a true From name and reply address, a subject line that matches the content, and a clear label when the email is an ad.Must doSource: FTC CAN-SPAM guide
• Set up SPF and DKIM for your sending domain (Gmail requires at least one from every sender), and add DMARC even if you send fewer than 5,000 emails a day.Should doSource: Google sender guidelines, Yahoo sender best practices
• If you send more than 5,000 emails a day to Gmail or Outlook.com, publish a DMARC record aligned with your From domain, on top of SPF and DKIM.Must doSource: Google sender guidelines, Microsoft postmaster policies
• Add the List-Unsubscribe and List-Unsubscribe-Post one-click headers to marketing email, plus a visible unsubscribe link in the body.Should doSource: Google sender guidelines, Yahoo sender best practices
• Keep your spam complaint rate below 0.1%, and never let it reach 0.3%.Should doSource: Google sender guidelines, Yahoo sender best practices
• Review what your email vendor and any agency send in your name, because you stay responsible for it.Should doSource: FTC CAN-SPAM guide
• Get prior consent before you send marketing email to people in the EU or UK, and use the soft opt-in only for your own similar products sent to existing customers.If it appliesSource: ePrivacy Art. 13 (UK-hosted copy), PECR reg. 22
• For recipients in Canada, have express or implied consent, name yourself and your contact details, and honor unsubscribes within 10 business days.If it appliesSource: CASL s. 6, CASL s. 11
• Before you send any marketing text, collect written consent that names the phone number and says consent is not a condition of buying.If it appliesSource: 47 CFR 64.1200, 47 U.S.C. 227
• Honor STOP, unsubscribe and similar replies to texts at once, even though the rule allows up to 10 business days.If it appliesSource: 47 CFR 64.1200, FCC draft order

The prompt for your agent

Copy this into Claude Code, Codex or Cursor from the root of your project. It looks at your email templates, send code and text messages.

Audit this project for Stage 10 of a launch checklist: marketing email and text messages.
Do not change any code, template, DNS setting, or send script until I approve a plan.

For each item below, report PASS, FAIL, or UNKNOWN, with the file and line that
proves it. If you cannot prove an item from the code, report UNKNOWN. Never report
PASS without evidence.

1. List every email the app or its scripts send. Mark each transactional or
   commercial. Flag any transactional email with a promotion near the top.
2. For each commercial email template: is there a postal address in the footer?
   Quote it.
3. Is there an unsubscribe link in every commercial email? Where does it go?
4. Where are opt-outs stored? Does every send path (app code, scripts, scheduled
   jobs, the email vendor's lists) check that store before sending?
5. Does any code add List-Unsubscribe and List-Unsubscribe-Post headers? Quote it.
6. Does simply opening the unsubscribe link (a GET request) change anything? It
   should not; only a deliberate action or the one-click POST should.
7. Is the unsubscribe link signed or tokenized, so one person cannot unsubscribe
   another by guessing?
8. Are SPF, DKIM, and DMARC set up for the sending domain? Look for DNS notes,
   vendor setup docs, or config in the repo. If there is no evidence, say UNKNOWN.
9. Quote the sign-up form's marketing consent. Is the box unticked by default? Is
   the consent, its time, and its source stored?
10. Does the app send text messages? If yes, quote the consent text, show where
    consent is stored, and show how STOP replies are handled.

End with a table: item, status, evidence (file and line), and the smallest fix you
suggest. Then stop and wait for my approval.

Items 8 and 9 often come back UNKNOWN, because DNS lives in your domain dashboard and consent may live in your email vendor. Check those two by hand.

Common mistakes

• Treating the email vendor's unsubscribe as the whole system, while a separate script or the app sends to everyone in your own database.
• "Reply to unsubscribe" with nothing that records the reply.
• Leaving out the postal address because you work from home. A registered PO box or private mailbox solves that.
• Putting an upsell at the top of a receipt or renewal notice, which can turn it into commercial email.
• Assuming business email is exempt. CAN-SPAM has no business-to-business exception.
• Skipping DMARC because you are small, then finding your launch email in spam.
• Reusing phone numbers collected for login codes to send marketing texts.

Check yourself

Resources

• FTC: CAN-SPAM Act compliance guideGuidanceFree

  The duties, the penalty, and the business email and vendor rules in plain words.

• 15 U.S.C. 7704LawFree

  The CAN-SPAM requirements in the statute.

• 16 CFR 316.3LawFree

  The primary purpose test for commercial and transactional email.

• Google: Email sender guidelinesDocsFree

  What Gmail requires from every sender and from bulk senders.

• Yahoo: Sender best practicesDocsFree

  Yahoo's authentication, unsubscribe and complaint rules.

• Microsoft: Outlook.com postmaster policiesDocsFree

  The high-volume sender rule for Outlook.com.

• ePrivacy Directive Art. 13 (UK-hosted copy)LawFree

  The EU consent rule and the soft opt-in.

• CASL, Justice LawsLawFree

  Canada's anti-spam law, starting with the consent section.

• 47 CFR 64.1200LawFree

  The FCC rule on consent for calls and texts, and how people revoke it.

• 47 U.S.C. 227LawFree

  The TCPA, including the damages for each violation.

Next stage

You have now worked through every area. Stage 11 puts it all together: one audit prompt for the whole course, a rules block that makes your coding agents remember these decisions on every build, and what I found when I ran it on Ducktate.