CAN-SPAM requires commercial email to use accurate From/subject information, include a valid physical postal address, provide a clear and working unsubscribe mechanism, and honor opt-out requests within 10 business days without charging a fee or requiring more than an email address to process it.
Unlike GDPR-style regimes, CAN-SPAM does not require opt-in consent before the first commercial email; it's an opt-out framework. It applies based on the commercial nature of the message and its connection to the US, not the recipient's location alone.
CAN-SPAM sets a compliance floor, not a deliverability strategy; a fully CAN-SPAM-compliant sender with poor list hygiene and high complaint rates will still land in spam even though no law is being broken.