The federal email law does not let you sue. State law sometimes does.
This is the single most misunderstood area we deal with, and getting it wrong wastes months. CAN-SPAM sets the rules for commercial email — but it gives you, the recipient, no right to sue anyone. A private claim, where one exists, runs through state law and turns on one thing: falsity.
CAN-SPAM and state email law
CAN-SPAM sets the federal rules for commercial email — accurate headers, honest subject lines, a working unsubscribe honored promptly, and a real postal address.
Critically, CAN-SPAM gives an individual recipient no private right of action. You cannot personally sue under it. Enforcement belongs to the FTC, state attorneys general and internet access providers.
That is why email claims run on state law, which survives federal preemption where it targets falsity or deception. California, for example, provides liquidated damages per offending email for falsified headers or misleading subject lines.
The practical consequence: an annoying but truthful email with a working unsubscribe usually is not a claim. A false sender, forged header or deceptive subject line often is.
So when is spam email actually actionable?
Federal preemption leaves room for state statutes that prohibit falsity or deception in commercial email. That carve-out is the whole ballgame, and it draws a sharp line:
Usually not a claim — an unwanted but honest marketing email, from a real company, with an accurate sender line, a truthful subject and a working unsubscribe link that is honoured.
Often a claim — a forged or falsified header; a sender name or domain that misrepresents who sent it; a domain registered to nobody with an untraceable owner; a subject line engineered to mislead you about what the message is (a fake reply or forward, a fabricated order confirmation, a false claim that you have won or owe something).
Aggravated conduct — address harvesting, dictionary attacks, automated creation of throwaway accounts, and relaying through hijacked machines. These carry heavier consequences and can be criminal.
Preserve the headers, not the email
This is the step almost everyone gets wrong, and it is unrecoverable once it is lost.
Forwarding a spam email destroys the evidence. The routing information that proves where a message actually originated lives in the raw headers, and forwarding replaces them with your own. What you need is the original source.
In most mail clients the option is called something like *Show original*, *View source* or *View message details*. Save that raw text — the full Received chain, the Message-ID, the Return-Path and the authentication results. Without it, a falsity claim usually cannot be proven at all.
The raw headers of every message, saved as text
The message body as displayed and as source, with links preserved and unclicked
What the unsubscribe link did — whether it worked, when you used it, and what arrived afterwards
Roughly when the address started receiving this, and whether you ever gave it to the sender
Volume and cadence over time — the pattern is what drives the number
The honest assessment
We would rather tell you this on a web page than after you have paid us. If the messages are irritating but truthful, from identifiable companies, with unsubscribe links that work, there is usually no private claim — and the right answer is filtering, unsubscribing, and getting the underlying address out of the broker market so the volume drops at the source.
Where the sender is lying about who they are, or the subject lines are engineered to deceive, the picture changes. The difference is decided by the raw headers — which is why we ask for them and keep them in your file.