The Real Cost of a CAN-SPAM Violation: Up to $53,088 Per Email

The math is brutal: civil penalties now reach up to $53,088 per violating email with no ceiling on total fines, according to the FTC's compliance guide. A single reactivation campaign sent to a few thousand past customers can expose a business to millions in liability before the first appointment books. The record $2.95 million fine against Verkada in August 2024 proves the FTC is actively collecting.

Liability cannot be outsourced. Both the company whose service is promoted and the company that hits send are legally responsible, even when a third-party vendor handles the outreach. That means a service business running win-back, seasonal reminder, or quote follow-up campaigns owns every compliance failure in the chain — inaccurate headers, deceptive subject lines, missing physical addresses, or opt-out mechanisms that break after 30 days.

• Opt-out requests must be honored within 10 business days and the mechanism must stay functional for at least 30 days after sending
• Opt-outs never expire — they must be honored in perpetuity unless the recipient opts back in
• Every commercial email requires accurate header info, non-deceptive subject lines, clear ad identification, and a valid physical postal address

For businesses reactivating customer lists across HVAC, dental, automotive, and home services, the exposure scales with every send. CallMyCustomers builds compliance into the workflow: lists are reviewed and segmented before outreach, every script and offer is approved by the owner, opt-outs are honored immediately across all channels, and replies route directly into the client's booking process — so the campaign stays useful, not costly.

Beyond Fines: Criminal Charges, Joint Liability, and Hidden Costs

Many business owners focus only on the headline civil penalties when considering CAN-SPAM compliance, unaware of the broader legal and operational risks that can emerge from violations. Beyond fines, aggravated violations can trigger criminal charges including imprisonment, especially when tactics like harvesting email addresses or using false registration information are involved. The FTC has made clear that both civil and criminal penalties are possible under the Act, with enforcement extending to the Department of Justice, state attorneys general, and even ISPs who can take action based on network abuse.

Liability under CAN-SPAM is joint and cannot be outsourced—meaning both the business whose service is promoted and the entity sending the email may be held legally responsible, even when using third-party marketers. This principle was reinforced by the FTC’s record $2.95 million fine against Verkada in August 2024, which underscored that companies cannot contract away responsibility for compliance. For service businesses relying on reactivation campaigns, this means approval and oversight of every message remain critical, regardless of who executes the outreach.

In addition to legal exposure, excessive spam complaints can damage deliverability long after any legal case closes. While not regulated by CAN-SPAM itself, inbox providers like Gmail and Yahoo enforce a 0.3% spam complaint threshold as a reputation benchmark—exceeding this rate can result in emails being filtered to spam or blocked entirely, undermining future marketing efforts. This technical consequence often catches businesses off guard, especially when opt-out requests aren’t honored consistently across systems. Maintaining functional opt-out mechanisms for at least 30 days after sending and honoring requests in perpetuity unless the recipient opts back in is essential to avoid both legal penalties and reputational harm with email providers. CallMyCustomers builds these safeguards into every campaign, ensuring opt-outs are processed immediately and messaging remains permission-based and transparent.

The Seven Rules That Keep Every Campaign Compliant

The Seven Rules That Keep Every Campaign Compliant

Staying compliant with the CAN-SPAM Act isn’t just about avoiding fines — it’s about respecting your customers and protecting your business reputation. The law sets clear, practical standards for every commercial email, and following them builds trust while keeping campaigns effective. For service businesses reactivating past customers, these rules are especially important because outreach relies on existing relationships, not cold lists.

The foundation starts with accurate header information — your “From,” “To,” and routing details must clearly identify who sent the message and where it’s going. Subject lines cannot be deceptive; they must honestly reflect the content inside. Every email must also be clearly identified as an advertisement, even if it feels helpful or personal, so recipients know it’s commercial in nature. A valid physical postal address is required in every message — this could be your business headquarters or a registered service address.

Perhaps most critically, every email must include a functioning opt-out mechanism. Requests must be honored within 10 business days, and the opt-out system must remain operational for at least 30 days after sending. Importantly, opt-out requests do not expire — they must be honored in perpetuity unless the recipient chooses to opt back in. This is where many businesses stumble: suppression lists often aren’t shared across systems, leading to accidental re-contact with unsubscribed customers.

• Use accurate header information that clearly identifies the sender
• Ensure subject lines are not deceptive or misleading
• Clearly label every message as an advertisement
• Include a valid physical postal address in every email
• Provide a functional opt-out mechanism honored within 10 business days

CallMyCustomers builds these requirements into every reactivation campaign, ensuring opt-outs are respected immediately and suppression data is synchronized across outreach channels so no customer receives unwanted messages after opting out. This attention to detail helps service businesses maintain compliance while turning past customers into booked work — the right way.

How CallMyCustomers Keeps Your Reactivation Campaigns Compliant

Here's the uncomfortable truth about CAN-SPAM liability: the FTC is explicit that responsibility for compliance cannot be contracted away, even when you hire a third party to send your emails. Both the company whose product is promoted and the sender can be held legally responsible, according to the FTC's official compliance guidance.

That leaves service business owners in a bind. You want the revenue that comes from reactivating past customers — but with penalties reaching up to $53,088 per violating email and no cap on total fines, you can't afford a vendor who treats compliance casually. The solution isn't avoiding reactivation campaigns. It's structuring them so you stay in control while someone else handles the mechanics.

That's exactly how CallMyCustomers is built. Every campaign runs only from your list of real customers — the people in your CRM, spreadsheet, or point-of-sale system — not scraped or purchased contacts. And before anything goes out, you approve every script, offer, and message. You plan the campaign together, you sign off, then the team runs it.

The compliance safeguards are built into the process itself:

• Opt-outs are honored immediately — well inside the 10-business-day window the law requires — and in perpetuity, as the law demands.
• Suppression is handled consistently across every channel — calls, texts, and emails — so an unsubscribed customer never gets re-introduced through a side door, a common failure point when opt-out data isn't shared across systems.
• Messages go out in your business's name, with accurate headers and non-deceptive subject lines — the core requirements the FTC enforces.
• For dental, med spa, and clinic clients, outreach operates under the required privacy and calling regulations, including BAA/HIPAA, TCPA, and A2P 10DLC in practice.

The owner sign-off step is what solves the "liability can't be outsourced" problem. Because you review and approve every message before it's sent, you always know exactly what's going out in your name — there's no black box, no automated sequence you never saw. Meanwhile, the done-for-you team handles the operational discipline: the suppression lists, the opt-out tracking, the channel-by-channel consistency that's tedious to maintain yourself but expensive to get wrong.

Given that the FTC proposed a record $2.95 million fine against Verkada in August 2024, regulatory attention is clearly intensifying. Compliance isn't a checkbox — it's the foundation a reactivation campaign stands on. When the messages are yours, the list is real, and the opt-outs are airtight, reactivation becomes what it should be: the safest revenue you'll ever generate.

Ready to see what your existing customer list can produce? Get a free list review before you spend a dollar — you'll know your rate, your setup, and what your past customers could be worth.

Your Next Step: A Free List Review Before You Send Anything

The difference between a profitable reactivation campaign and a five-figure FTC penalty usually comes down to what happens before you send a single message. With penalties of up to $53,088 per violating email — and a record $2.95 million fine against Verkada in August 2024 — the safest path starts with knowing exactly what your list can and cannot produce.

That's why the smart first move is a free list review, not a campaign. Before any fee changes hands, your list gets reviewed and segmented by recency and status: customers active in the last 30 days, those quiet for 6 to 12 months, old quotes that never became jobs, and expiring memberships. You see your rate, your setup, and your realistic output before spending a dollar.

Segmentation also protects you legally. Because the FTC holds both the promoting company and the sender responsible for violations — and that liability cannot be contracted away to a third party — you need to know who's on your list and why they're being contacted. A review surfaces exactly that.

Next, choose a reason to reconnect that feels useful, not pushy. The best campaigns lead with genuine value:

• A seasonal need — the HVAC tune-up before summer, the renewal before it lapses
• An old-quote follow-up with a fresh angle, not a "just checking in" nudge
• A post-job thank-you with a review request

Then run the campaign with oversight baked in. Remember that opt-out requests must be honored within 10 business days and maintained in perpetuity, so every message should carry a working opt-out and a suppression process that holds. CallMyCustomers builds this in: the owner approves every script, offer, and message before anything goes out, opt-outs are honored immediately, and replies route directly into your existing booking process — no software to buy or learn.

Your next booked customer already knows your business. New leads matter, but repeat business matters too — and it costs roughly five times less to reactivate a customer than to acquire one. Request your free list review and find out what your list can produce before you send anything.