Affiliate Links in Email: The Rules That Keep You From Getting Banned

Affiliate links in email rules: the short answer

The affiliate links in email rules that matter are two-layered: CAN-SPAM covers the mechanics of every commercial email, and your affiliate program's terms decide whether that specific link can be in an email at all. To send compliantly, you need both sets of rules.

CAN-SPAM sets the requirements a commercial email must meet: an honest header and subject line, a working opt-out you honor within 10 business days, and your valid physical postal address ^[2]. The second rulebook is your affiliate program's own terms, which decide whether that link may appear in an email at all ^[3].

The affiliate links in email rules that actually apply to you come from two places, and they are not the same thing. One is federal law: the CAN-SPAM Act, implemented by the FTC's rule at 16 CFR Part 316 ^[1][2]. The other is the contract between you and the merchant — the operating policies you accepted when you joined the program ^[3].

You can satisfy one perfectly and still breach the other. A message can be entirely CAN-SPAM compliant and still violate a program whose terms require links to be displayed on and accessed from your Site ^[3]. So the useful question is not "are affiliate links in email allowed?" It is "allowed by whom, for this link, sent to this person?" Everything below answers that in order: the law first, the program terms second, deliverability third, and then a pattern you can copy.

One expectation to set now: this is general education, not legal advice. Program terms and sender guidelines change, so treat every source we point to as a page to open and check the date on — including the ones linked from here.

Two rulebooks, one email: how the law and program terms differ

Plain-English summary: The law says what every commercial email must include; the program says whether your affiliate link may be in an email at all. Neither document gives you permission to ignore the other.

Beginners usually read one article about email compliance and assume everything is covered. It isn't. Here is the split, in a form you can keep beside your drafts.

Neither document is frozen. The eCFR shows when Title 16 was last amended ^[1], and Amazon says it may send notices to your account email and you are deemed to have received them ^[3] — so re-read the policies page yourself before you build a template.

What CAN-SPAM requires in a promotional email

Plain-English summary: Every commercial email needs a truthful header and subject, a clear ad label (unless the recipient consented), a working opt-out you honor within 10 business days, and your valid physical postal address. Here is the checklist.

Here is the law as a checklist, drawn from 15 U.S.C. § 7704 ^[2]. Run every promotional send against all seven points.

1. Truthful header information. It is unlawful to send a commercial email whose header information is materially false or materially misleading ^[2].
2. A subject line that matches the message. A subject heading likely to mislead a reasonable recipient about a material fact is unlawful ^[2]. Borrowing urgency from a shipping notice or an account warning fails this test.
3. A clear statement that it is an ad. A commercial email must clearly and conspicuously identify itself as an advertisement or solicitation — unless the recipient gave prior affirmative consent to receive it ^[2].
4. A working opt-out. You must provide a functioning reply address or other internet-based mechanism, clearly and conspicuously displayed, that a recipient can use to ask you to stop ^[2].
5. It has to keep working. That mechanism must remain able to receive requests for no less than 30 days after you send the original message ^[2].
6. Honor it within 10 business days. Once someone asks, it is unlawful to send another commercial message within the scope of that request more than 10 business days later ^[2].
7. A valid physical postal address. The message must include a valid physical postal address of the sender ^[2]. Confirm what qualifies for your situation before you publish an address.

Three more rules sit underneath those. You may not sell, lease, exchange or otherwise release the email address of someone who has asked you to stop ^[2]. You may not charge a fee or impose other requirements on recipients who want to opt out — 16 CFR 316.5 prohibits that ^[1]. And you may not send to addresses harvested automatically from a site that said it would not share them, or generated by combining names and numbers, where you knew or should have known ^[2]. Using a purchased list can violate the statute if it contains addresses obtained in those ways and you had actual knowledge, or knowledge fairly implied on the basis of objective circumstances, of how they were obtained ^[2].

The disclosure half of the job — telling readers you earn a commission — is covered in more depth in our guide to FTC affiliate disclosure with clear examples for blogs, email and video. Amazon's terms, for instance, make you responsible for complying with the FTC's Guides Concerning the Use of Endorsement and Testimonials in Advertising ^[3].

When does a newsletter count as "commercial"? The primary purpose question

Plain-English summary: If the commercial block is front-loaded or dominates the message, the email is commercial. Put useful content first, and you're on safer ground.

The FTC's rule defines the "primary purpose" of an email, and the factors are more practical than most people expect ^[1].

The rule lists factors including the placement of the commercial promotion — in whole or substantial part at the beginning of the body — the proportion of the message dedicated to that content, and how color, graphics, type size and style are used to highlight it ^[1].

Read those three as a design brief rather than a trap. A newsletter that opens with two paragraphs of your own notes, then offers one recommendation, looks different from one whose first screen is a banner and five buy buttons. The rule doesn't ban either; it tells the reader — and a regulator — which one is advertising.

Why transactional emails are a separate case

The rule deems a message transactional or relationship when it consists exclusively of that kind of content ^[1]. Add a promotional block to a receipt or a password reset and that deeming no longer applies, which also puts pressure on the subject-line rule ^[2]. The practical habit: keep the emails people need and the emails that sell in separate messages.

Which affiliate programs allow links in email?

Plain-English summary: There is no universal answer. Check your program's policies page, and when in doubt, ask support in writing. If the terms say "displayed on your Site" or "accessed directly from your Site," email may not qualify — so send readers to your website instead.

There is no universal answer, and any post that gives you one is guessing on your behalf. Program terms differ, and they are revised; Amazon says it may send notices to your account email and you are deemed to have received them ^[3].

Amazon is the one everyone asks about, partly because the advice online contradicts itself. The Associates Program Policies page is the only thing that settles it for your account. The live version says you must not post any Special Links on Amazon ^[3]. The same page also says you are permitted to display Special Links on your Site and requires that all Special Links be accessed directly from your Site ^[3]. That is a permission to display, not a requirement that you display them only there — but the access requirement is a requirement. Read those two clauses together, and the email inference is yours to draw. If you are unsure, do not put the link in an email; send readers to a page on your own site instead.

A decision table for the terms you'll actually read

Two consequences are worth internalising. First, tracking is not permission: Amazon, for example, will not pay Special Commission Income where a Bonus Event or Bounty Event has been disqualified due to a violation or other abuse, such as a Bonus Event or Bounty Event that does not result from Special Links on your Site ^[3]. Second, silence is not consent from the merchant either. Ask, in writing, and save the answer.

Our walkthrough of 12 clauses to read in an affiliate program's terms before you join covers the rest of the contract, and Amazon Associates rules beginners break most often goes deeper on that program specifically.

Gmail's sender rules sit on top of the law

Plain-English summary: Even a perfectly compliant email can land in spam if you don't set up authentication and keep spam rates low. Gmail's rules apply to all senders, not just bulk senders, and they sit on top of CAN-SPAM.

CAN-SPAM is about legality. Deliverability is about whether the message arrives at all, and that is governed by the mailbox providers. Google's sender guidelines apply to anyone sending to personal Gmail accounts, and starting 1 February 2024 all senders must meet the requirements in that article ^[4].

For every sender, that means setting up SPF or DKIM for your sending domains, keeping valid forward and reverse DNS records, using a TLS connection, keeping spam rates in Postmaster Tools below 0.3%, formatting messages to RFC 5322, and not impersonating Gmail From: headers ^[4]. If you send more than 5,000 messages a day to Gmail accounts, you also need SPF, DKIM and DMARC, a From: domain aligned with either SPF or DKIM, and one-click unsubscribe with a clearly visible unsubscribe link in the message body ^[4].

Google addresses affiliate marketing directly, in guidance aimed at brands that run programs: if your brand is associated with marketing spam, other messages you send might be marked as spam, so it recommends monitoring affiliates regularly and removing any that send spam ^[4]. Read from the other direction, that is a description of how affiliate email gets punished.

None of this replaces CAN-SPAM, and meeting CAN-SPAM does not make you deliverable. The two lists overlap in spirit — be honest, be easy to leave — but you have to satisfy both. Our email deliverability guide for small senders walks through the authentication setup step by step.

A CAN-SPAM-safe newsletter pattern you can copy

Plain-English summary: Here is a first-affiliate-email template that puts useful content first, uses one affiliate link, includes disclosure and postal address, and keeps the opt-out working. Fill in the brackets and send only to people who asked.

This is the pattern we would use for a first affiliate newsletter. It assumes the people on your list asked to be there. Check whether your program requires solicited communications; Amazon's page, for example, is the contract that controls your account ^[3].

Subject: [specific promise the body actually delivers] Preheader: [one line, same promise, no hype] Hi [first name], [Two sentences: the problem this email is about.] [Your recommendation in two or three sentences. Name one trade-off.] → [Link text naming the product] YOUR-AFFILIATE-URL Disclosure: If you buy through the link above, I may earn a commission at no extra cost to you. [Something useful that stands alone: a tip, a checklist step, a number to check.] [Sign-off] [Your name] [Business name] [Street address, city, state ZIP] — valid physical postal address [2] This message is an advertisement or solicitation [unless prior consent covers it] [2] Unsubscribe: UNSUBSCRIBE-URL — one click where supported, working for at least 30 days [2][4]

A completed example email you can copy

Subject: One hosting pick for your first affiliate site Preheader: Only if you're still comparing — and it's not for everyone.

Hi there,

You're trying to get a site live without wasting money on the wrong tool.

Sample copy: For this example, we'll use a made-up host called LaunchHost — swap in the host you are actually comparing. LaunchHost is one option to compare for a first affiliate site if you need beginner-friendly setup and a low starting price. Check the current pricing and features yourself before deciding, and consider whether a basic plan fits your traffic plans and budget. The trade-off: renewal prices are higher than the introductory rate, so check that number before you commit.

→ Check LaunchHost's current pricing (affiliate link)

Disclosure: If you buy through the link above, I may earn a commission at no extra cost to you.

If you're comparing hosts, one question to answer for yourself is: what is the renewal price for whatever host you pick?

One thing to skip this month: any paid funnel builder. You don't need it yet.

— [Your Name] [Business Name] [Your Street Address, City, State ZIP]

This message is an advertisement or solicitation.

Unsubscribe: [one-click unsubscribe link — must work for at least 30 days]

Five habits that make the pattern hold

• One affiliate link, one decision. Everything else in the email supports that choice rather than competing with it.
• Useful content first, commercial block after. Placement and proportion are exactly what the primary-purpose factors look at ^[1].
• Show your postal address in every commercial send ^[2].
• Process opt-outs within 10 business days, and write down who does it so it survives a busy week ^[2].
• Only mail people who asked. If the program's terms require solicited communications, read those terms before you mail anyone who did not ask to hear from you.

Illustrative example: the arithmetic of one send

Illustrative example. A list of 500 people. 40% open the email: 500 × 0.40 = 200 opens. 10% of those openers click the affiliate link: 200 × 0.10 = 20 clicks. 5% of clicks result in a sale: 20 × 0.05 = 1 sale. At a $12 commission, that send produces $12. Repeat it monthly for a year: 12 × $12 = $144.

Now halve the click rate, because real numbers wobble. 200 opens × 0.05 = 10 clicks; 10 × 0.05 = 0.5 sales per send; 12 sends × 0.5 = 6 sales × $12 = $72. That is arithmetic, not a forecast or a typical result — the open rate, click rate, conversion rate and commission here are invented numbers chosen to make the multiplication readable. Many sends produce nothing at all. The point of working the sum is to see which variable you can actually influence: usually the offer's relevance to your list, not the number of links.

The welcome sequence is where this pattern earns its keep, because a new subscriber is warmest in the first week. Our welcome email sequence for affiliate newsletters writes out five emails you can adapt. If you want the broader build, our email marketing for affiliates guide covers list setup, consent and sending cadence.

Pre-send checklist and the mistakes that get beginners removed

Plain-English summary: Tick these twelve boxes before you hit send. Common ways affiliates get into trouble include skipping the program check ^[3], using a harvested or generated list ^[2], hiding the ad label ^[2], or letting opt-outs sit past the 10-business-day deadline ^[2].

Copy this into your drafts folder and tick it before every promotional send.

• Permission: every recipient asked to be on this list, and you can point to when.
• Program: you re-read this program's terms today and email is either permitted or confirmed in writing ^[3].
• Channel: the link you are using is allowed in email for this program ^[3].
• Header: the From name and reply address are real and yours ^[2].
• Subject: it says what is inside ^[2].
• Ad identification: labelled as an advertisement or solicitation where required, unless prior affirmative consent covers the recipients ^[2].
• Placement: the commercial block is not the entire first screen ^[1].
• Disclosure: state the commission relationship in plain words. Amazon's terms require you to comply with the U.S. FTC Guides Concerning the Use of Endorsement and Testimonials in Advertising ^[3].
• Postal address: a valid physical address is in the footer ^[2].
• Opt-out: it works, it stays live for at least 30 days, and you have one-click support in place if you are a bulk sender ^[2][4].
• Ten-day process: someone is named to action opt-outs within 10 business days ^[2].
• Authentication: SPF or DKIM is set up, with DMARC if you are over 5,000 Gmail messages a day ^[4].

The mistakes that recur

1. Confusing legal with permitted. A compliant message can still breach program terms ^[3].
2. Buying or scraping a list. Harvested and generated addresses are addressed directly in the statute ^[2].
3. Hiding the ad label. The identification has to be clear and conspicuous ^[2].
4. Opting someone out "later this month". The deadline is 10 business days ^[2].
5. Omitting a postal address. It is one of the required elements ^[2].
6. Sending from an unauthenticated domain. Gmail may reject or spam it ^[4].

On the trust question you may be carrying: this site earns commissions when readers buy through some links. The standard we try to hold is the one we would want applied to us — show the cost, name the trade-off, and tell you what to skip. You do not need paid email software to start; the free tier of a reputable provider is enough while your list is small, and the money matters more once you know what your list actually opens. Before you spend anything this month, run the numbers on paper first.

Your next step: Copy the pre-send checklist above into your drafts folder, then open the email marketing for affiliates guide and go straight to the section on choosing email software safely. Use the dated comparison there before you spend a dollar on any tool.

This guide is general education, not legal, tax or financial advice. Rules and program terms change; check the linked official pages for the current version and ask a qualified professional about your situation. How we write: editorial policy. This page has no affiliate links.