United States: What Does it Mean For You?

The federal government enacted a new law to regulate spam - defined as unwanted commercial email messages – called "Controlling the Assault of Non-Solicited Pornography and Marketing Act of 2003" ("CANSPAM"). In its findings, Congress said "[t]he convenience and efficiency of electronic mail are threatened by the extremely rapid growth in the volume of unsolicited commercial electronic mail. Unsolicited commercial electronic mail is currently estimated to account for over half of all electronic mail traffic, up from an estimated 7 percent in 2001, and the volume continues to rise. Most of these messages are fraudulent and deceptive in one or more respects."

Because the definition of "commercial electronic mail," includes both solicited and unsolicited email, the new regulations apply to all commercial email. Under such definition, a commercial electronic mail message's "primary purpose" is for the commercial advertisement or promotion of a commercial product or service (including content on an Internet website operated for a commercial purpose)." Many companies that send out email solicitations for legitimate product or service offerings will fall within the definition if they use internally created databases, purchased databases, or other large collections of potential customer email addresses.

Any email knowingly sent to "multiple" recipients promoting the sale of a product or service is punishable as a felony, where the sender is engaging in fraudulent activities (i.e., using false headers or subject lines to deceive recipients as to the origin of the messages, or uses false information in the registration of the URLs associated with the sender's email address). "Multiple" is defined as more than 100 emails in 24 hour period, or 1000 emails during a 30 day period, or 10,000 emails during a one year period.

CAN-SPAM does allow commercial email senders to send unsolicited emails to a recipient if it does not meet the "knowing use of false information" sent to "multiple recipients" as defined above, so it is not as strict as the former, preempted California law would have been. Under the preempted state law, a single unsolicited email would have violated such law, so an inadvertent commercial email sent to recipients below these limits are not prohibited until the recipient advises the sender that they want to "opt-out" of receipt of additional emails. In an opt-out program, the burden is placed on the email recipient to notify the sender that the recipient no longer wants to receive any more commercial emails from the sender. The requirements for an opt-out program are discussed in detail below. Because the California law would have required an "opt-in" by a recipient to give advance permission to a commercial email sender, it was much stricter than the new federal law, which only requires that the "opt-out" system to be adopted by commercial email senders.

Under CAN-SPAM, the Federal Trade Commission ("FTC") is charged with fine-tuning and defining what criteria will be used in determining the "primary purpose" of emails are considered covered under the legislation (i.e. are communications from non-profit organizations to contribute to specific causes exempt as "noncommercial?"). If the term "commercial" is construed broadly, then email furthering a non-profit organization's purposes may be covered, even if the email was only intended to request a solicitation from potential contributors.

The law specifically states that the term "commercial electronic mail message" does not include a "transactional or relationship message" further defined as having the primary purpose of:

1. facilitating, completing or confirming a prior business transaction;
2. providing warranty, product recall, safety or security information about a product or service used or purchased by the email recipient;
3. providing notification of changes to an ongoing commercial relationship, such as:

4. providing information directly relating to an employment relationship or related benefit plan in which the recipient is currently participating;
5. delivering goods or services, including product updates or upgrades that the recipient is entitled to receive from a previously approved transaction.

Collectively, these exceptions will exempt from the law most commercial email concerning an ongoing or prior business relationship. However, commercial email constituting advertising, marketing or promotional communications will be required to comply with all of the following:

1. Prominent labeling that the communication is advertising for a product or service (i.e., inclusion of ADV in the subject header);
2. Prominent notice of the recipient's ability to opt out of receipt of future emails; and
3. A valid physical postal address of the sender.

In setting up an opt-out program that complies with this law, a company should meet the following requirements:

1. The opt-out program must include a clearly and conspicuously displayed, functioning, return email address or other Internet-based mechanism that the recipient can use to send a reply email or other Internet-based communication requesting not to receive future emails from the company. The optout mechanism must remain operable for at least 30 days after any company sends out a commercial email.
2. An opt-out program may also comply with these requirements by giving more detailed options such as providing a list from which the recipient may choose specific categories or types of email messages to reject or receive, so long as the list contains an option that the recipient does not want to receive any emails from the company.
3. Once the recipient advises the company that it no longer wants to receive any emails (or some categories of emails), then the company must maintain a mechanism that complies with such request within 10 days after receipt by the company.
4. Once advised that the recipient does not want further emails (or types of emails), the company cannot sell or otherwise transfer the email address of the recipient, such as in mailing lists.
5. If the recipient later revokes the opt-out, it is lawful for the company to resume sending commercial emails until a subsequent opt-out message is received again.
6. There is no need for an opt-out disclosure for any recipients who have given their prior affirmative consent to receipt of commercial emails. This means that if an Internet user has given prior online or contractual consent (i.e., opting-in on postal mail solicitations, use of negative opt-out forms where the user did not "uncheck" a checked box that allows the sending of commercial emails, whether online or on paper, or similar prior approvals), then commercial email may be sent until or unless an "opt-out" is later received.

As indicated above, additional specific provisions in CAN-SPAM are directed to stopping deceptive email practices (which are not relevant for most companies sending legitimate commercial email) such as prohibiting the use of false or misleading subject matter descriptions of emails (like "v1agraa" or the subject "travel tips" for a pornographic site, or the use of computer-generated email sender addresses (such as 12db77clkadfj@1- 103849302.com). Additionally, any pornographic or sexually explicit emails are to be identified as containing pornography or sexually explicit materials in the subject matter heading.

Violations of the CAN-SPAM law include both civil and criminal penalties, notably a fine of $250 per violation (calculated on a per-email basis) up to a maximum of $2 million dollars (tripled where the violation is deemed willful), and can carry jail sentences of up to 5 years in prison. Notably, the ability to bring suit under the CAN-SPAM act is limited to the State's attorney generals, the FTC and other specified government agencies, and Internet service providers such as AOL and Earthlink. This limitation is important, as California's law would have allowed the right of private suit, thereby inviting consumer suits by individuals or consumer attorneys.

The effectiveness of this law to actually stop illegitimate spam remains to be seen, but given the requirements set forth above applicable to all commercial email senders and the penalties associated with violations, it would be wise for all commercial establishments that use email as a means to advertise and promote its products and services to comply with CAN-SPAM.

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.