California Anti-Spam Law: Prohibitions, Damages, and Defenses

California’s anti-spam law, found at Business and Professions Code sections 17529 through 17529.9, targets deception in commercial email rather than banning unsolicited marketing outright. Sending a commercial email from or to a California address with forged headers, an unauthorized third-party domain, or a misleading subject line can cost up to $1,000 per message, capped at $1 million per incident, and the same conduct is a misdemeanor punishable by up to six months in county jail. The state rules sit on top of the federal CAN-SPAM Act, so a single bad campaign can trigger liability under both.

What California Actually Prohibits

Section 17529.5 is the provision that drives enforcement. It makes advertising in a commercial email sent from or to California unlawful when the message does any of the following:

Uses a third party’s domain name or address without that party’s consent.
Contains falsified or forged header information that disguises the real sender or routing.
Carries a subject line likely to mislead a reasonable recipient about the message’s contents.

These three triggers are the basis for both the civil damages and the criminal charges the statute allows.¹ The statute also prohibits automated address harvesting and dictionary attacks, where senders generate random addresses hoping to hit valid inboxes.²

Section 17529.2 goes further and prohibits any unsolicited commercial email sent from California or to a California address.³ On its face that is one of the broadest bans in any state, but several federal courts have found it preempted by CAN-SPAM because it reaches beyond deception. The realistic enforcement risk for a California sender comes from 17529.5, not 17529.2.

One frequent misreading: California does not require an unsubscribe link. That obligation comes from federal law. You still need the link, but the statutory source matters when you are assessing what claim could be brought against you.

How CAN-SPAM Interacts

The federal CAN-SPAM Act preempts most state regulation of commercial email but preserves state laws prohibiting “falsity or deception in any portion of a commercial electronic mail message.”⁴ That carve-out is why 17529.5 survives: it targets forged headers and misleading subject lines rather than unsolicited mail generally. California appellate courts have upheld it on exactly that ground.

CAN-SPAM imposes its own requirements on every commercial email, and those apply regardless of what state law says:

Header information cannot be materially false or misleading.⁵
Subject lines cannot mislead a reasonable person about the content.
Every commercial email must offer a clear opt-out mechanism that stays functional for at least 30 days after sending.²
Opt-out requests must be honored within 10 business days, and you cannot charge a fee, demand personal information, or require more than a reply or a single webpage visit.²

Each violating email can draw a federal penalty of up to $53,088 under the most recently published inflation-adjusted maximum.² That exposure runs alongside California’s own damages.

Civil Damages

Any recipient of an email that violates Section 17529.5 can sue for liquidated damages of $1,000 per message, with a $1 million cap per incident. Email service providers and the Attorney General have the same right to sue. The prevailing plaintiff recovers reasonable attorney’s fees and costs on top of damages, and may pursue actual damages instead of the liquidated amount when actual losses are higher.⁶

The per-email structure makes exposure grow quickly. A blast of 10,000 messages with falsified headers can reach the full $1 million cap in a single case before fees.

The Compliance Program Reduction

If the court finds the sender established and implemented practices reasonably designed to prevent violations, the maximum drops to $100 per email with a $100,000 cap per incident.⁶ That is a 90% cut. Written email marketing policies, documented staff training, automated header checks, and a complaint-investigation process all help carry that burden. The statute requires “due care,” so the program has to actually run, not just exist on paper.

Criminal Exposure

A violation of Section 17529.5 is also a misdemeanor. The penalty is a fine of up to $1,000, up to six months in county jail, or both.¹ Prosecutors reserve criminal charges for clear deception, such as systematic header forgery or phishing operations, rather than technical compliance failures.

Defenses

Because the statute targets deception, truthful email is the strongest defense. If your headers accurately identify you and your subject lines honestly describe the contents, you have not violated Section 17529.5 regardless of whether the recipient consented to receive the message. The California Supreme Court applied that reasoning to a marketer who sent from multiple domains to evade spam filters: no violation, because the domains were real and traceable to the sender. Forging someone else’s identity is illegal; using your own domains creatively is not.

The law also reaches only “commercial e-mail advertisements,” meaning messages whose primary purpose is promoting a product or service. Purchase confirmations, account updates, requested receipts, and communications about an existing business relationship are transactional, not commercial, and sit outside the statute entirely.

A documented compliance program will not defeat liability, but as noted above it can cut damages by 90%, which often matters more than any technical defense once a case is filed.

Who Enforces It

The California Attorney General’s Cybercrime Section investigates and prosecutes deceptive practices carried out through electronic communications, including commercial email fraud.⁷ Private enforcement is just as significant. The statute expressly gives individual recipients and email service providers the right to sue.⁶ In practice, service providers have been among the most active plaintiffs, because they absorb the infrastructure cost of filtering spam.

Text Messages Are Governed by a Different Law

California’s anti-spam statute covers email. Marketing texts fall under the federal Telephone Consumer Protection Act instead, which requires prior express written consent before sending to a mobile phone and sets damages at $500 per unauthorized message, tripled to $1,500 for willful violations.⁸ Compliance with the email rules does not satisfy the TCPA, and vice versa.

1
California Legislative Information. California Business and Professions Code 17529.5
2
Federal Trade Commission. CAN-SPAM Act: A Compliance Guide for Business
3
California Legislative Information. California Business and Professions Code 17529.2
4
Federal Trade Commission. Text of the CAN-SPAM Act
5
Office of the Law Revision Counsel. 15 U.S.C. 7704 – Other Protections for Users of Commercial Electronic Mail
6
Justia. California Business and Professions Code 17529-17529.9
7
State of California Department of Justice. Cybercrime Section
8
Federal Communications Commission. Stop Unwanted Robocalls and Texts