What's the Maximum Fine Per Violation Under the CAN-SPAM Act in 2026?

The maximum civil penalty for a CAN-SPAM Act violation is $53,088 per violating email in 2026. That figure comes from the FTC's inflation-adjusted civil penalty schedule, published in the Federal Register and effective January 17, 2025, and it still applies through 2026.

Where the Number Comes From

CAN-SPAM penalties are assessed under the same statutory authority as other FTC Act trade regulation rule violations — specifically the penalty provisions tied to Section 5(m)(1)(A) of the FTC Act. The FTC adjusts these maximums annually for inflation. The prior ceiling was $51,744, effective for penalties assessed before January 17, 2025; the current $53,088 figure applies to any penalty assessed on or after that date, even for conduct that happened earlier, since the adjustment is tied to when the penalty is assessed rather than when the email was sent.

It's Per Email, Not Per Campaign

The statute treats each individual commercial email that violates the Act as a separate violation. In theory, a single campaign sent to a large list without proper opt-out handling or accurate header information could rack up violations in the thousands or millions, each carrying its own penalty exposure. In practice, courts rarely assess the full statutory maximum per message — penalties get negotiated down based on the violation's scope, intent, and the business's compliance history, so the theoretical ceiling and the realistic settlement range can differ by orders of magnitude.

What Actually Triggers a Violation

Common CAN-SPAM violations include using deceptive subject lines or sender information, failing to include a working unsubscribe mechanism, not honoring an opt-out request within the required window, and failing to identify a message as an advertisement when required. Any one of these, applied across a list, is what multiplies a single compliance gap into a large theoretical exposure, which is why list hygiene and header accuracy matter more than any individual email's content.

Real Enforcement Looks Different From the Statutory Max

The largest CAN-SPAM-adjacent civil penalty reported in recent years was $2.95 million against Verkada in August 2024 — large, but far below what multiplying $53,088 by even a modest list size would produce. The FTC and Department of Justice have historically negotiated settlements well under the theoretical ceiling, reserving the full statutory weight for egregious, repeat, or willful violations rather than isolated technical lapses.

How It Stacks Up Against Other Marketing Penalties

CAN-SPAM's per-email maximum dwarfs the TCPA's $500-$1,500 per-call-or-text penalty range, reflecting how much more automatable and scalable email violations can be compared to phone-based outreach, where sending volume is naturally throttled by dialing capacity.

Bottom Line

Treat $53,088 as the ceiling that makes list hygiene and unsubscribe compliance non-negotiable, not as a realistic per-incident estimate — audit your unsubscribe handling now rather than finding out what a regulator decides a violation is worth, especially before scaling send volume on an unverified list.

Sources: Federal Register inflation-adjustment notice effective January 17, 2025 (16 CFR 1.98); FTC press release on 2025 inflation-adjusted civil penalty amounts; Orrick InfoBytes coverage of FTC/DOJ CAN-SPAM enforcement.