New Federal Spam Act Governs Commercial Email
By Michael G. Atkins
January 13, 2004
Businesses that communicate with customers or potential customers by email now must comply with the new federal anti-spam act, which became effective on January 1, 2004. Even legitimate, business-related emails can trigger severe penalties under the statute - which you can avoid by following a few simple rules.
In summary, the "Controlling the Assault of Non-Solicited Pornography and Marketing Act of 2003," or "CAN-SPAM Act," outlaws unsolicited, deceptive commercial email. It also requires senders to include a valid return email address, a valid physical postal address, provide an opt-out method, and respect recipients' opt-out requests.
Who must comply?
The Act applies to all "commercial" email (not merely bulk messages or "spam"), which the Act broadly defines as "any electronic mail message the primary purpose of which is commercial advertisement or promotion of a commercial product or service (including content on an Internet Web site operated for a commercial purpose)." Mere mention of a company, or inclusion of a link to the sender's web site, however, does not bring an otherwise non-commercial email message within the Act's scope.
The Act also prohibits marketers from harvesting email addresses from the Internet or randomly generating email addresses by computer.
How can email messages comply?
To comply with the Act, commercial email messages now must contain:
- The sender's accurate return email address;
- The sender's physical postal address (a post office box may be insufficient);
- A non-misleading subject heading;
- Identification that the message is an advertisement or solicitation (though not necessarily in the subject line or with "ADV" as an identifier); and
- A statement explaining how the recipient can opt out of future messages.
Additional requirements
Aside from regulating content, the CAN-SPAM Act requires senders of commercial email to stop sending messages within 10 business days to email accounts of persons indicating that they wish to opt out of such messages.
The Act also requires senders to keep the email account used to transmit commercial messages functional for at least 30 days to enable them to process opt-out requests. A temporary and unexpected failure of the sender's email account, however, will not subject the sender to liability if it was beyond the sender's control and the sender corrects the failure within a reasonable amount of time. The Act allows for alternative opt-out methods, such as through the sender's web site.
Finally, the Act prohibits the sender from selling, leasing, or otherwise transferring email addresses of opt-out recipients without the recipient's affirmative consent.
Exemptions for existing relationships
"Transactional" and "relationship" messages are distinguished from commercial messages and largely are excepted from the Act. These messages include those primarily intended to:
- Facilitate, complete, or confirm a commercial transaction to which the sender and recipient have previously agreed;
- Provide warranty, product recall, safety, or security information about a product or service that the recipient has already purchased;
- Notify of a change in a subscription, membership, account, loan, or ongoing commercial relationship between the sender and recipient;
- Provide information about a current employment relationship or benefit plan in which the recipient currently participates; or
- Deliver goods or services, including product upgrades, to which the sender and recipient have already agreed.
It is not clear whether these exceptions apply to past relationships, and the Act does not define when a current commercial relationship ends. At this early stage, senders should consider a conservative approach.
Penalties
Penalties can be severe, with violators liable for statutory damages of up to $2 million. The CAN-SPAM Act is enforced by the Federal Trade Commission and other federal regulators, state attorneys general, and affected Internet service providers.
Criminal violations
Aside from civil liability, the Act imposes criminal liability for acts akin to trespass or fraud. These acts include:
- Using a computer without authorization to send commercial email;
- Falsifying header information in sending commercial email; and
- Registering email accounts with false identifying information, and using those accounts to send commercial email.
Preemption of state laws
The CAN-SPAM Act supersedes state and local laws that regulate the use of commercial email, except to the extent that such laws prohibit false and deceptive acts or business communications. Though untested, this provision likely will leave Washington's ban on misleading commercial email intact. By contrast, an implicit purpose of the Act was to preempt California's strict "opt-in" spam statute before it went into effect, and that law is now dead. The Act does not affect state laws that do not specifically regulate commercial email, such as the laws of trespass, fraud, contract, and computer crime.
Future developments
The CAN-SPAM Act calls for creation of a national "Do-Not-Email" registry, like the recently-created "Do-Not-Call" database, and the study of commercial email with an eye for additional restrictions. The Act also calls for the Federal Communications Commission to promulgate rules regulating commercial messages sent to wireless devices. Such rules must be written by October.
For more information, or to obtain a copy of the CAN-SPAM Act, contact Michael G. Atkins (206.340.9614 or matkins@grahamdunn.com).
