I have not built an email list for any of the businesses I am connected to, so this is not a how-I-did-it post. It is a how-it-is-done post, put together from the Federal Trade Commission’s compliance guide for commercial email and from guides published by email software companies, each linked where it is used. A list that starts from zero has no history to defend, which makes it the cheapest moment to get the rules right.

Email List Building Basics: How to Build Your List From Scratch, OptinMonster on YouTube

The law comes first, because it is short

In the United States the rule that governs commercial email is the CAN-SPAM Act, and the FTC publishes a plain-language compliance guide for business. It applies to commercial messages, defined as email whose primary purpose is advertising or promoting a product, service or website. The guide says there is no exception for business-to-business email, so a note to a former customer about a new product counts.

The guide lists eight requirements. Here they are in the FTC’s own short phrasing, with the sense of each:

  • Don’t use false or misleading header information. The “from” and routing details have to identify who actually sent the message.
  • Don’t use deceptive subject lines. The subject has to match what is inside.
  • Identify the message as an ad, clearly and conspicuously.
  • Tell recipients where you are located, with a valid postal address.
  • Tell recipients how to opt out of future marketing email, in a way that is easy to recognize and use.
  • Remember that subscribers and members can opt out too. Being on your list does not remove the right to leave it.
  • Honor opt-out requests promptly. The guide gives 10 business days, and says the opt-out mechanism must keep working for at least 30 days after you send.
  • Monitor what others are doing on your behalf. Hiring a company to send for you does not move the legal responsibility off you.

The guide also says each separate email that violates the rules can carry a penalty, and that more than one party can be liable, such as both the company whose product is promoted and the company that sent it. The page gives a dollar figure for the penalty, and the FTC adjusts that figure over time. I am leaving the number out, because I cannot show what the page said on the date this post carries. The structure is the part to remember: the penalty is counted per email.

This is legal-adjacent material. I am not a lawyer, and nothing here replaces one. If the list is going to matter to the business, an attorney who handles advertising or privacy law should read the actual statute and your actual signup form.

Permission is the cheap part

Hand pulling a blank card from a wooden card file box

A list built from zero has one huge advantage over a list that was bought. Mailchimp’s guide to building a list from scratch, dated July 29, 2026, puts the principle this way: every person on a self-built list made an active decision to hear from you. The same guide discourages purchased or rented lists, because the recipients do not know the sender, and that makes spam complaints more likely.

CAN-SPAM, as the FTC describes it, is largely about what happens after you send, namely the header, the subject, the address and the opt-out. Email software companies lean harder on getting permission before the first send. Mailchimp’s help page says that senders are required to get permission from their contacts before they can send promotional emails, names CAN-SPAM in the United States and CASL in Canada as examples, and says the requirements for opt-in consent vary by country.

That is worth reading twice. The FTC guide and a software vendor’s help page are not describing exactly the same obligation, and they are written for different readers. If anyone on your list lives outside the United States, the rules that apply to those people may not be the ones above. That is a question for the attorney.

One signup form

The simplest list starts with one form that asks for as little as possible. Mailchimp’s guide says to keep it short, usually just a name and an email address, and says a two-field form will generally convert better than one with extra questions. It also says to lead with the specific benefit and to state what subscribers should expect.

That second part does the heavy lifting. A box that says “Subscribe to our newsletter” gives a stranger no reason. A box that says what you will send and how often gives a stranger something to agree to, and gives you something to point back to if anyone ever asks why they were getting your mail.

Put the form where people already are. The Mailchimp guide lists website pop-ups, blog posts, email signatures, social media bios and ecommerce checkout. For a store, it says an opt-in checkbox at checkout can increase signups. Pop-ups, it adds, should be used sparingly, with a focused message and an easy way to dismiss them.

I would add something the guide does not say, and I am labelling it as a thought of my own and not a sourced fact: a small shop usually has one place where strangers become customers, and the form belongs at that place. Everything else is decoration.

Single opt-in and double opt-in

Mailbox with its flag raised at a quiet curb in the morning

Mailchimp defines the two methods on a help page. With single opt-in, a person is added to your audience immediately after they submit your signup form. With double opt-in, a person must click a link in a confirmation email to join. The page says the extra step helps reduce spam signups and confirms that addresses are valid.

Mailchimp’s list-building guide recommends double opt-in as part of protecting your sender reputation, along with avoiding purchased lists and removing inactive addresses. The cost of the extra step is that some real people will never click the confirmation, and your list will be smaller than it would otherwise be. That is a trade that nobody can make for you: a smaller list that wants your mail against a faster list that includes typos and strangers.

The FTC guide does not require double opt-in. It is a practice the software companies recommend. Keeping those two things separate in your head is half the battle.

Landing pages and referrals

Mailchimp’s guide suggests building a landing page for each place people come from and matching the tone to the source, with the headline and the form visible without scrolling. It also suggests a referral program: give subscribers an easy way to share a link, plus a small incentive. The incentive applies to sharing, and the guide does not say anything about rewards for signing up, so check any reward idea against the law and the platform’s terms before using it.

For a first list of a few dozen people, a referral program and separate landing pages are more machinery than the job needs. They are in the guide, so they are in this post, but a single form on a page people already visit will do for a start.

The welcome email and the first month

Once someone joins, the guide says to send a welcome email or short series. It should thank new subscribers, confirm what they signed up for, offer a quick-start resource, and carry one clear call to action. Setting expectations about how often and about what, at signup and again in the welcome message, reduces the number of people who unsubscribe because they did not understand what they joined.

Every one of those sends is also a place where the legal items show up. The ad disclosure, the postal address and the opt-out link belong in the footer of anything that is promotional, and the FTC guide is clear that hiring someone else to send for you does not transfer the responsibility. Check what actually goes out, not just what the dashboard says it sends.

What to measure, and when to prune

Laptop on a counter showing a blurred sign-up form

Mailchimp’s guide finishes with measurement. It suggests tracking signup, open, click and unsubscribe rates, testing one variable at a time, and auditing the list quarterly, removing inactive addresses as part of that. Those are a software company’s suggestions and the numbers are yours to interpret.

An unsubscribe request is the one signal that is not a matter of interpretation. The FTC guide says a request must be honored promptly, and that no fee or personal information beyond an email address can be required to process it. A list that makes leaving easy is a list that stays legal and, I would guess, stays friendlier. That last part is a guess.

What I have not tested

I have not built a list, so I cannot tell you what a good signup rate looks like, how often to send, or which form wording works. The sources above do not give numbers for those either, and I will not invent them. If you are starting from zero, begin with the least you can legally and honestly send, keep the permission record clean, and let the first few subscribers tell you what to do next.

For informational purposes only. This post summarizes published guidance and is not legal advice. Consult a licensed attorney before sending commercial email, especially to recipients outside the United States.

Sources