United States: New Regulations For Unsolicited E-Mail Is Your Company's E-Marketing In Compliance?

A business that advertises through unsolicited commercial e-mail faces two challenges, however. Not only must the business contend with the bad reputation that early users earned for the medium, expressed in the term "spamming," but it must also comply with new laws enacted by several states. These new laws apply to all businesses that send unsolicited commercial e-mail to residents of those states where the sender does not have a prior business relationship with the resident, and where the resident did not affirmatively request the information. Therefore, if you use, or plan to use UCE, you must take proactive measures to comply with the new state laws.

The indiscriminate use of UCE by marginal vendors of "get rich" and "get thin" schemes, and purveyors of pornography provoked widespread complaints. Unlike direct mail, a vendor’s marginal cost for sending additional e-mail is almost nothing, so little effort has been made to target the recipients. Rather, e-mails have been sent "to the world." Reaction to the contents of the e-mails ranges from annoyance to outrage. Some e-mail users find that UCE messages far outnumber other legitimate e-mail messages and make the latter harder to find in the mail box. Likewise, some subscribers to internet service providers ("ISPs") may incur incremental time charges to access, read and delete the unwanted messages.

Detractors of UCE argue that the increasing number of mass e-mails (and subsequent angry return messages) processed by ISPs such as America Online and the Microsoft Network place a tremendous burden on their computer resources, driving up costs and degrading the quality of service. Aggravation and network traffic is also increased by the use of false return addresses by dishonest vendors, who choose this strategy to increase the likelihood that their messages will by-pass filters designed to block them and be opened by recipients.

Sending UCE remains legal, but 19 states have adopted laws that regulate UCE and there are currently four bills pending in Congress that were submitted to prohibit abuse of the medium.

Since 1997, California, Colorado, Connecticut, Delaware, Idaho, Illinois, Iowa, Louisiana, Maryland, Missouri, Nevada, North Carolina, Oklahoma, Pennsylvania, Rhode Island, Tennessee, Virginia, Washington and West Virginia have all passed laws that regulate UCE (14 of these 19 states enacted their legislation last year alone). Like the proposed federal legislation, the state laws look to empower the UCE recipient, as well as the ISP, to "opt-out" of or block UCE, and most strictly prohibit the use of false originating addresses or headers. For example, Virginia makes it a crime of computer trespass to falsify or forge UCE message transmission information, and Washington allows residents and ISPs to recover damages for UCE that contains false or misleading information as to its point of origin. Washington's law gives an ISP full discretion to block the receipt or transmission through its service of any UCE that it reasonably believes is in violation of the law. As long as the ISP is acting in good faith when it censors the suspect messages, it will not be held liable to anyone for blocking the transmissions under Washington's statute.

California requires that UCE senders provide for individual opt-outs by providing a toll-free number or a valid return address, and the state also requires that each e-mail advertisement contain "ADV:" or "ADV:ADLT" at the beginning of its subject line. California law also permits an ISP to sue those who send unsolicited commercial messages in violation of its published UCE policy. The ISP may recover damages of $50 per message up to a maximum of $25,000 per day plus reasonable attorneys' fees under the statute. Likewise, Nevada's statute requires that the sender provide accurate identification and opt-out instructions for the recipient, and the UCE message itself must be readily identifiable as promotional in nature. Injured recipients under the statute may recover the greater of actual damages or $10 per message, plus attorneys' fees and costs.

The four federal bills vary in substance, but have some common characteristics. Each bill requires that a sender of UCE include valid sender contact information and prohibits forgery of UCE return addresses or headers. Three of the four bills would require that the sender provide the recipient with an opt-out option by which the recipient can decline to receive further messages, and one bill, HR 113, proposes to amend the Communications Act of 1934 to make it unlawful for any person to transmit unsolicited advertisements over wireless telephone messaging systems. The bills propose both civil and criminal damages for ongoing violations of the regulations and permit both an ISP and an individual recipient to bring private actions. As of April 17, 2001, each of the bills were still mired in the committee process, although one of the more prominent bills, HR 718, has passed the House Committee on Energy and Commerce, and was sent to the House Judiciary Committee.

Although a business that sends UCE via the Internet may be physically located outside one of the states that regulate UCE, it probably can be sued successfully in a regulating state for violating that state's law. In other words, a resident of California who received a UCE from an Ohio merchant might successfully bring suit against the merchant in a California court under California law if the UCE violated California's anti-spam statute.

A state court's ability to exercise personal jurisdiction over an out-of-state defendant turns on whether the defendant has sufficient intentional contacts with the state that having to defend itself in that state's courts does not offend constitutional principles of fairness and due process. Soliciting business through sales personnel, publications, mail or telephone calls to a given state has long been recognized as the sort of deliberate contacts that can support personal jurisdiction of an out-of-state defendant, at least where the alleged offense arises from the solicitation or contract. This precedent, and recent case law finding jurisdiction of defendants as a result of Internet communications, strongly suggests that businesses sending UCE will be subject to the regulation of any state that its messages reach. Because of this potential liability, businesses must monitor, understand and proactively comply with the recent state legislation.

Based on this review of the existing statutes and pending legislation, we believe a business sending e-mail advertising should institute a policy that includes the following minimum guidelines:

• Make certain that the UCE is originating from a valid and authentic e-mail, domain or Web address associated with the business. Using forged, falsified or "hijacked" addresses are illegal.
• Do not use false or misleading subject lines in the message. (For example, if your business sells computer manuals, the subject line should relate to the offering of the manuals and not to anything else).
• Clearly label the UCE as an advertisement or as promotional in nature by inserting "ADV:" (or, if the product or service is appropriate only for adults, "ADV:ADLT" at the beginning of its subject line).
• Provide a valid return address and/or a toll-free telephone number in the text of the ad.
• Include explicit opt-out instructions that the recipient may follow to have his or her name dropped from the mailing list. These instructions should be reasonable (such as a return e-mail) and the business should comply promptly with any such instructions.
• Follow the rules for e-mail advertising in any service agreement between the business and its ISP.

E-commerce and its related marketing and advertising efforts are here to stay. Taking the time to implement clear guidelines for e-mail advertising, and keeping abreast of new state laws (at websites such as www.spamlaws.com) will help to ensure that your business’ e-marketing activities are within the bounds of the law.