Email Marketing After Two Years of CAN-SPAM Enforcement
What changed for business owners weighing email marketing in 2006, now that two years of CAN-SPAM enforcement has shown who gets prosecuted and why.
A year ago, the question business owners asked about email marketing was mostly whether to start. By 2006, with more than two years of CAN-SPAM enforcement behind us, the more useful question has become clearer: what does the actual track record of enforcement tell us about how much compliance risk a legitimate small business is carrying, and does that change how we should run a program.
What enforcement looked like
The cases that made headlines were not small businesses that forgot to update a postal address in their footer. They targeted volume spam operations: forged headers, harvested addresses, deceptive subject lines used to sell dubious products and outright refusal to honor opt-out requests. One widely covered case involved a prolific spam operator convicted under state anti-spam law whose appeal was still working through the courts this year, a reminder that the legal exposure was aimed squarely at people running spam as a business model, not at companies emailing their own customers.
For a business that built its list through genuine opt-in and included a working unsubscribe link, the enforcement record of the last two years has been reassuring rather than alarming. The law did what it was designed to do: it gave regulators a tool against the worst offenders without turning routine commercial email into a legal minefield for everyone else.
What changed in practice
The more meaningful shift in 2006 is technical rather than legal. Sender authentication standards, things like Sender ID and domain-based signing, started gaining real adoption among major mailbox providers this year as a way to verify that a message claiming to come from your domain did. This matters more for deliverability than CAN-SPAM compliance ever did, because ISPs increasingly use authentication status as one signal in deciding whether your mail reaches the inbox or gets filtered. A business serious about email marketing in 2006 should be looking at whether its sending domain is properly authenticated, not just whether its footer has an address in it.
Deciding if it is worth it, one year on
If your business has hesitated on email marketing out of concern about the legal risk, the two-year track record should put most of that worry to rest, provided you are doing the basics: real permission, honest subject lines and a working unsubscribe process. The remaining question is the same one it always was: do you have, or can you build, a list of people who want to hear from you, and can you commit to sending them something worth opening on a regular basis.
What a sound program looks like now
A business starting or refining a program this year should prioritize three things above everything else. First, authenticate your sending domain so mailbox providers trust your mail. Second, keep list hygiene tight by removing addresses that bounce or never engage, since inactive addresses drag down your sender reputation for everyone on the list. Third, treat the compliance requirements as the floor, not the ceiling, and build actual value into what you send rather than just meeting the legal minimum.
Two years into the CAN-SPAM era, the picture is settled enough to act on with confidence. The businesses still on the sidelines are not avoiding legal risk by waiting; they are just giving competitors more time to build the kind of direct, owned relationship with customers that email marketing, done honestly, reliably produces.
Keep exploring: browse more Email Marketing guides, see everything we published in 2006 or check out the Digital Business Marketing Awards.
