CAN-SPAM, TCPA and state privacy laws: a guide to AI marketing automation in the US

By Reckona AIUpdated 26 October 20265 min read

Fast, automated follow-up converts US leads. It also creates legal exposure if it ignores the rules on email, texts and personal data. Here is the practical version.

Key takeaway: In the US, automated marketing is shaped by CAN-SPAM for commercial email, the TCPA for marketing calls and texts, and a growing set of state privacy laws led by California. Email needs an honest header, a physical address and a working opt-out; marketing texts and automated calls generally need prior express written consent. Text-message rules carry significant statutory damages, so get consent right before you automate.

Email: CAN-SPAM

Accurate header and subject lines, and clear identification as an advertisement where required.
Your valid physical postal address in every message.
A clear way to opt out, honoured within 10 business days.
You remain responsible if a vendor sends on your behalf.

The FTC enforces CAN-SPAM. It does not require opt-in for email, but many state laws and good deliverability practice point that way.

Texts and calls: the TCPA

Marketing calls and texts made with an autodialer or artificial or prerecorded voice generally require the recipient’s prior express written consent. The rules also cover the National Do Not Call Registry, calling hours and opt-out handling, and the FCC has treated AI-generated voices as “artificial” voices under the TCPA. Consent requirements have been the subject of recent FCC rule changes and litigation, so confirm the current position. Statutory damages make this the highest-risk area in US marketing automation.

State privacy laws

California’s CCPA, as amended by the CPRA, gives consumers rights to know, delete, correct and opt out of the sale or sharing of personal information, and a growing number of other states have comprehensive privacy laws with their own thresholds. Health data, children’s data and biometric data carry extra rules in several states.

AI tools and vendors

Know which tools process personal information and whether they use it for training.
Put service-provider or processor terms in place that match the state laws that apply to you.
Keep protected health information out of marketing tools where HIPAA applies.
Update your privacy notice to describe automated tools.

A compliant set-up

Capture SMS consent with clear disclosure language, and store the record.
Honor STOP and other opt-out replies automatically across every tool.
Scrub call and text lists against the Do Not Call Registry where required.
Include address and opt-out in every marketing email.
Keep records of consent and messages sent.

This article is general information, not legal advice. Rules change; check current guidance from the relevant regulator.

How we approach it

Reckona AI scopes US automation around CAN-SPAM, the TCPA and the state laws that apply to you before any workflow goes live. See GEO services in the USA.

Frequently asked questions

Do I need consent to send marketing texts in the US?

Generally yes. Under the TCPA, marketing texts sent with an autodialer generally require prior express written consent, and recipients must be able to opt out easily.

Does CAN-SPAM require opt-in for email?

No, but it requires honest headers and subject lines, a physical postal address and an opt-out honoured within 10 business days. Some state laws and deliverability best practice favour opt-in.

Do AI voice calls fall under the TCPA?

The FCC has treated AI-generated voices as artificial voices under the TCPA, so the consent rules for artificial or prerecorded voice calls apply.

Which state privacy laws apply to my business?

It depends on where your customers are and on each law’s thresholds. California’s CCPA/CPRA is the most widely applicable; check the others with counsel.

Want this done for your brand?

Start with a free audit: a written scope and a baseline of how AI assistants describe your brand today.

Get my free audit →