Compliance: the rules small business marketing has to follow

Small business marketing runs into a few rules: email consent, advertising claims, paid endorsements, honest reviews and the privacy notice. This page covers each one in general terms and names the official source for it. It is written for the owner who is about to send a newsletter, run an advertisement or ask customers for a review. Nothing here is legal advice, and it does not replace reading the rule itself. Where a rule is unclear, the page says so instead of guessing.

Where the rules for your own marketing come from

Most rules for a small business’s own marketing come from federal agencies, state consumer law and the platforms that host reviews. This page covers the US federal rules and New Hampshire’s Consumer Protection Act, which makes unfair or deceptive trade practices unlawful under RSA 358-A:2. It does not cover other states, including Massachusetts, which matter to Boston-area businesses. The rules depend on what you sell, where your customers are and how you collect their details. A business with an unusual setup needs a lawyer to decide its edge cases.

The numbers behind the stakes

$53,088: The most the CAN-SPAM Act allows as a penalty for each separate commercial email that breaks it, per the FTC’s CAN-SPAM compliance guide for business.
October 21, 2024: The date the FTC’s rule on fake and bought reviews and testimonials took effect, as set out in the FTC’s questions and answers on the rule.
4: Subjects covered on this page, each in general terms with its source named.

Four rules to check before the next campaign goes out

Does an email rule reach business-to-business mail?

Yes. The CAN-SPAM Act covers business-to-business email as well as mail to consumers. Every commercial message needs a valid physical postal address and a working opt-out. The opt-out has to be honored within the deadline set in the FTC guide linked in the figures above. Treat honoring opt-outs as routine, not as an occasional favor. Lists bought or borrowed elsewhere deserve a separate check before any message goes to them.

Do paid or sponsored posts need a disclosure?

Recommendations on a site like this one should be open about how they are made, and the FTC expects paid relationships to be disclosed. You can verify that at the FTC’s Endorsement Guides FAQ. A sponsored post, or a video paid for by the business it features, needs the same disclosure. A reader should be able to tell, before acting on the content, that something of value changed hands. A label at the foot of a long page is easy to miss, so keep it beside the content it qualifies.

Can a business ask customers for reviews?

It can ask, but it cannot buy reviews, write them or steer them. Google removes reviews posted because a business offered an incentive, and its contribution policy rules out discouraging negative reviews or asking only for positive ones. The FTC rule in the figures above adds civil penalties for knowing violations. A fair request asks every customer, not only the happy ones. Reviews on a listing are a public record of what people thought, and that record should stay honest.

What does a privacy notice need to say?

If a site or a sign-up form collects names and email addresses, the privacy notice should say what is collected, why, and who sees it. The wording must match what the business actually does, because a notice that describes a different practice is worse than none. Cookies and tracking tools belong in the same notice, with the ones that run on the site named. We do not give a template, since the right wording depends on the business. A lawyer should check the notice when the collection is unusual, such as health or payment details.

Putting these rules to work, in order

Check consent before the send

Before a campaign goes out, confirm that every address agreed to receive it. Each message should carry a valid postal address and a working opt-out. Remove people who ask to leave as their requests come in. Keep a record of opt-outs so a removed address does not come back on the next import. A campaign that passes these checks is far easier to defend.

Write the notice before the form

A sign-up form is where personal details first arrive. Put the privacy notice on the same page, and let the form say what it does with an address before anyone types one. Keep the field list short, so the form asks only for what it uses. Check the notice again whenever a new tool is added to the site. Date each version, so the one a visitor saw can be found later.

Mark what is paid for

If a post, video or recommendation is paid for, or traded for value, say so beside the content. Use the same wording for every piece from the same arrangement, so readers can compare them. Where a free product or service was given in return for coverage, treat it as value and disclose it the same way. Keep a record of each arrangement, so the disclosure can be checked against it. The label has to reach the reader before they act on the content.

What to have in place before anything goes out

A quiet modern office with rows of empty desks and tall daylit windows — A plain office stands in for the back room of any marketing setup. The rules here cover the files and lists kept there, not only the ads people see.

A smiling woman in a plaid shirt with a coffee cup in a sunlit cafe — Stock photograph, used for illustration only. It is not a customer, a reader or a review, and it should not be read as one.

A laptop on a tidy office desk showing a web analytics dashboard — Keep the reports behind any claim you make, so the claim can be shown to be true if anyone asks.