Client Alert Privacy and Data Protection Practice Update on Anti-Spam Legislation: Has CAN-SPAM Really Canned Spam? January 26, 2004 Introduction The flow of unsolicited and unwelcome commercial e-mail, or “spam,” to e-mail boxes has grown exponentially over the past few years, resulting in the passage of a number of anti-spam laws at both state and federal levels. For example, in September 2003, California passed S.B. 186, which prohibits unsolicited commercial e-mail messages from being sent to California e-mail addresses or from being initiated from California and requires an “opt-in” consent for receipt of commercial e-mails (“California Spam Law”). Approximately thirty-six other states have some form of antispam legislation on their books. We addressed the California Spam Law and the general nature of these other states’ spam laws in a previous Client Alert dated November 13, 2003. Since then, in large part due to the extreme nature of the California Spam Law and the difficulty of complying with differing states’ laws, Congress passed a comprehensive anti-spam law called “Controlling the Assault of Non-Solicited Pornography and Marketing Act of 2003,” more commonly known as “CAN-SPAM” (the “Act”), which was signed into law by President Bush on December 16, 2003. The Act, which took effect on January 1, 2004, does not ban all unsolicited commercial e-mail but rather creates an opt out right, as well as a federal framework for regulating fraudulent and deceptive practices with respect to commercial e-mail messages. The Act preempts portions of states’ antispam legislation, including the California Spam Law, that expressly regulate the use of electronic mail to send commercial messages, but does not preempt state anti-spam laws to the extent dealing with fraud, deception, or computer crime, nor does it preempt other state laws not specific to electronic mail, as further described below. While this Client Alert summarizes the major elements of the Act, the Act is complex and fraught with ambiguities, not only because of the partial preemption issue but also because the Act leaves several important matters for further guidance by the Federal Trade Commission (“FTC”). It is important to note at the outset, however, that the Act is far broader than thought by many legitimate businesses that use e-mail for commercial purposes, and because of that, these businesses may unwittingly violate the Act. What is Covered by the Act The Act applies to commercial electronic mail messages (“Commercial e-Mails”), defined as “any electronic mail message the primary purpose of which is the commercial advertisement or promotion of a commercial product or service.” Merely providing a link to the website of, or a reference by name to, a commercial entity does not per se qualify the message as Commercial e-Mail under the Century City * Houston * London * Los Angeles * New York * Northern Virginia * Orange County * Sacramento San Diego * San Diego – North County * San Francisco * Silicon Valley * Stamford * Sydney * Tokyo * Washington, DC www.pillsburywinthrop.com PILLSBURY WINTHROP LLP Client Alert January 26, 2004 Act. However, it is not clear from this definition what other commercial elements are sufficient for a message, link or reference to be deemed to be a “Commercial e-Mail.” The Act does provide that Commercial e-Mails specifically exclude “transactional or relationship” messages. However, to fall within the exclusion, the primary purpose of the message must be to facilitate, complete, confirm or provide information regarding a transaction previously agreed to by the recipient with the sender (such as delivery of goods or services, sending warranty information on a product purchased by the recipient, or providing account information on a subscription), or to provide information regarding a current employment relationship or benefit plan. The term “transactional or relationship message” contemplates a current relationship between the recipient and the sender but, importantly, it is not so broad that it would cover any and all e-mail messages between them. Thus, Commercial e-Mails to current customers that do not fall within the scope of the definition of “transactional or relationship messages” are subject to the Act, and as noted below, even transactional or relationship messages must meet certain requirements under the Act. The FTC is expected to issue additional guidance on the scope of the coverage (including what qualifies as a “transactional or relationship message”) and will be issuing implementing regulations. Who is Covered by the Act The Act applies to both the persons or entities who transmit any type of Commercial e-Mail (the “spammers” themselves) as well as those persons or entities who pay third parties to send Commercial e-Mails on their products or services (defined as the “sender” under the Act). This includes any person or entity that in any way sends out e-mail messages that come within the definition of a Commercial e-Mail. As suggested in the “Tips” attached as the end of this bulletin, businesses should carefully review their practices with respect to commercial e-mails to determine whether they are covered under the Act. Because of the broad scope of the Act, most companies will be covered by the Act, even those that normally would not think of themselves as “commercial e-mailers” or those who historically have been outside the scope of spam laws since they send messages only to “current” customers or applicants. The Act does have some limitations and exceptions to the scope of its coverage. For example, the Act does not impose liability on a party who is merely involved in “routine conveyance,” or automated transmission, of e-mail messages. Thus, Internet service providers (“ISPs”) that use automated processes to handle e-mail messages of their users should not, for the most part, have liability under the Act for those user messages that do not comply with the requirements of the Act. However, the Act does provide that a party who merely provides goods or services to someone who violates the prohibition on misleading or false transmission information may also be found liable for violating the Act if (a) the party has a 50% or more ownership or economic interest in the violator; or (b) the party actually knows that goods or services are promoted in the e-mail message and receives or expects to receive an economic benefit from the promotion. Century City * Houston * London * Los Angeles * New York * Northern Virginia * Orange County * Sacramento San Diego * San Diego – North County * San Francisco * Silicon Valley * Stamford * Sydney * Tokyo * Washington, DC www.pillsburywinthrop.com PILLSBURY WINTHROP LLP Client Alert January 26, 2004 Another limitation on the scope of the Act is with respect to affiliated entities. If an entity that is a sender operates separate lines of business or divisions and holds itself out to recipients of the Commercial e-Mail as that particular business or division, then under certain circumstances, the entity considered to be the “sender” may be limited to that business or division, rather than its parent or affiliated entities. This is important for purposes of the opt-out requirements, described below, which apply to the “sender.” In addition, the Act imposes liability on any entity, whether or not an initiator or sender, whose business is promoted in a Commercial e-Mail that uses misleading or false transmission information if such entity knows or should have known of the promotion in such Commercial e-Mail, benefits economically from the promotion, and fails to prevent the transmission or report it to the FTC. The “should have known” test will be analyzed in a hindsight capacity, which can make it particularly difficult to defend. Accordingly, businesses will need to be exceptionally careful to oversee the marketing efforts of others involving their products and services, and should make sure that they have the right to pre-approve any such messages. What are the Requirements for Compliance The Act permits the sending of Commercial e-Mails so long as the messages comply with specific requirements designed to protect recipients against fraudulent practices and provide recipients with a right to opt-out of receiving future Commercial E-Mails. The following requirements apply regardless of whether a message is sent to one or multiple recipients, and regardless of whether the recipient of the message is a current customer: 1. Commercial e-Mails as well as transactional or relationship messages must not contain materially false or materially misleading transmission information - the header information (which is the information that identifies the originating domain name and e-mail address and other routing information of each e-mail message) must be sufficient to allow an ISP processing the message, a person alleging violation of this requirement, or a law enforcement agency to “identify, locate, or respond to” the person who initiated the message. Also, at a minimum, the “from” line must accurately identify the initiator of the message. Of all the requirements of the Act, this requirement has the broadest application since it applies to both Commercial e-Mails and to transactional or relationship messages. 2. Commercial e-Mails must not have a deceptive subject heading. A subject heading is deceptive if the initiator knows or should reasonably know based on the circumstances, that a recipient, acting reasonably under the circumstances, would likely be misled by the subject heading with respect to a material fact regarding the content or subject matter of the message. 3. Commercial e-Mails must provide recipients with a clear and conspicuous notice of the opportunity to opt-out of receiving further communications from the sender, and must provide a functioning return e-mail address or other Internet mechanism that is “clearly and conspicuously displayed” that may be utilized for such an opt-out. The return e-mail address must remain functional for at least thirty days after the e-mail is sent. Alternatively, the e-mail advertisers may comply with this requirement by providing the recipient with a list or menu from which the recipient may choose the specific types of Commercial e-Mails that the recipient wishes or does not wish to receive from the sender, provided that this list or menu Century City * Houston * London * Los Angeles * New York * Northern Virginia * Orange County * Sacramento San Diego * San Diego – North County * San Francisco * Silicon Valley * Stamford * Sydney * Tokyo * Washington, DC www.pillsburywinthrop.com PILLSBURY WINTHROP LLP Client Alert January 26, 2004 also includes an option under which the recipient may choose not to receive any Commercial e-Mail from the sender. 4. Senders (and persons acting on the senders’ behalf with actual or constructive knowledge of the request) must honor requests by recipients to opt out of receiving further Commercial e-Mails (or certain types of Commercial e-Mails), within ten business days. The sender (or any other person who knows that the recipient has made an opt-out request) may not thereafter include that recipient’s e-mail address on its address list that it provides to others. This does not apply if, subsequent to the opt-out request, the recipient gives affirmative consent to receiving Commercial e-Mails. This ten business day grace period is an exceptionally short period of time in which to comply, especially for any large company that needs to notify a number of divisions/marketing areas or for any company that does not have a centralized mechanism overseeing all Commercial e-Mails. In most cases, opt-out provided to one portion of a business will apply to the entire business. It is expected that compliance with this portion of the Act may be the most difficult for many businesses, which is perhaps why the Act directs the FTC to review and modify the length of this period if a different period would be more reasonable when considering the purposes of the requirement, the interests of Commercial e-Mail recipients and the burdens on senders. 5. Commercial e-Mails must contain a clear and conspicuous identification of the nature of the message (i.e., that it is an advertisement or solicitation), unless the recipient has given prior affirmative consent to receiving the message. 6. Commercial e-Mails must contain the sender’s valid physical postal address. 7. Commercial e-Mails containing sexually oriented materials must, in the absence of prior affirmative consent from the recipient, include in the subject heading specific warning labels (to be prescribed by the FTC no later than 120 days after the date of enactment) and must only include certain information as being initially viewable by the recipient (that is, the sexually-oriented materials should not be initially viewable upon opening the Commercial e-Mail). The term “sexually oriented material” means any material depicting sexually explicit conduct that is not a small and insignificant part of the whole. A knowing violation of this requirement is subject to a fine under U.S. Code Title 18 and/or up to five years in prison. Affirmative Consent As noted above, the term “affirmative consent” is used in the Act in several places. The Act defines that term to mean that the recipient expressly consented to receive the message at the recipient’s own initiative or in response to a “clear and conspicuous” request for that consent, including “clear and conspicuous” notice that the recipient’s e-mail address could be given to a third party for sending Commercial e-Mail. The Act does not provide guidance on what constitutes “express” consent, what requirements are sufficient for a request for that consent to be deemed “clear and conspicuous,” or how long such affirmative consent remains valid. Century City * Houston * London * Los Angeles * New York * Northern Virginia * Orange County * Sacramento San Diego * San Diego – North County * San Francisco * Silicon Valley * Stamford * Sydney * Tokyo * Washington, DC www.pillsburywinthrop.com PILLSBURY WINTHROP LLP Client Alert January 26, 2004 Obtaining a recipient’s affirmative consent has some advantages under the Act, though these are not as broad as one might assume. Persons or entities who obtain affirmative consent from e-mail recipients may, of course, send Commercial e-Mails to those recipients (even if the recipient previously opted-out if the affirmative consent is later given), and the sender or marketer is not required to identify those Commercial e-Mails as advertisements or solicitations. In addition, the Requirements with respect to sexually explicit materials do not apply to Commercial e-Mails sent to recipients who affirmatively consented to receiving those materials. However, even if affirmative consent has been obtained, the other requirements listed in this bulletin, including providing the recipient with an ability to opt-out of receiving future messages, continue to apply. Certain Egregious Acts The Act provides that certain egregious practices in connection with a violation of the requirements described above give rise to an “aggravated violation” subject to stiffer penalties, including (a) harvesting of e-mail addresses using automated means or from a web site or online service that includes a notice that the operator of the site or service does not give out their e-mail addresses for the purpose of sending spam, (b) the automated creation of multiple e-mail accounts, such as by use of scripts, from which to send spam, or (c) the knowing relay or transmission through unauthorized access of computers or networks of a Commercial e-Mail which violates any of the Act’s requirement. The Act also prohibits fraud and related activity (including, but not limited to, unauthorized access to computers to transmit Commercial e-Mails, knowingly relaying Commercial e-Mail with intent to deceive and falsely representing to be the registrant to internet protocol addresses) in connection with the transmission of “multiple” messages (i.e., more than (a) 100 electronic messages during a 24-hour period, (b) 1,000 electronic messages during a 30-day period, or (c) 10,000 electronic mail messages during a 1-year period). Penalties for a violation of these prohibitions range from a fine and/or one year imprisonment to a fine and/or up to five year imprisonment if the offense is committed in furtherance of a felony or in the case of repeat offenders, along with the forfeiture of all property obtained from the offense and equipment used in the commission of the offense. Enforcement and Remedies The FTC, other federal agencies, and state attorney generals are given authority under the Act to enforce violations of the bill. Individual actions (other than actions brought by ISPs) are not allowed under the Act. However, since state laws not specific to electronic mail (such as trespass, contract or tort law as well as fraud and computer crime), are not preempted by the Act, it is expected that lawsuits (including class actions) will be filed by individuals affected by spam. Under the Act, the FTC, the Federal Communications Commission (“FCC”) or States may seek cease and desist orders and injunctive relief in any action to enforce compliance with certain provisions of the Act without the requirement to allege or prove the state of mind that may be required to establish a violation of such provision. Penalties for violations of the Act include Century City * Houston * London * Los Angeles * New York * Northern Virginia * Orange County * Sacramento San Diego * San Diego – North County * San Francisco * Silicon Valley * Stamford * Sydney * Tokyo * Washington, DC www.pillsburywinthrop.com PILLSBURY WINTHROP LLP Client Alert January 26, 2004 damages (in an amount equal to the greater of the actual loss suffered and statutory damages) and even imprisonment for violations involving fraud in connection with multiple messages or sexually oriented materials. In all actions, the Act gives courts authority to multiply the amount of damages by up to three times for willful violations of the Act or if the violation includes any “aggravated violation.” As a mitigating factor in assessing damages, courts may consider whether the defendant established and implemented commercially reasonable practices and procedures to prevent violations of the requirements or whether the violation occurred despite commercially reasonable efforts to maintain compliance with such commercially reasonable practices and procedures. Effect on Other Laws The Act only preempts portions of state anti-spam legislation that expressly regulate the use of electronic mail to send commercial messages, except to the extent these laws prohibit falsity or deception in any portion of a commercial electronic mail message or information attached to the message. The Act does not preempt any state laws that “are not specific to electronic mail” nor any other states laws (even those specific to electronic mail) that relate to acts of fraud or computer crime. Although the Act creates a national framework for commercial electronic mail messages, the scope of preemption of state law is limited and unclear. Any company that sends e-mail advertisements or solicitations will need to take care to comply with both the Act and applicable state laws, especially since the state laws may impose higher standards than under the Act. Therefore, the passage of the Act does not mean that e-mail advertisers will not need to be aware of and observe state laws as they apply to commercial e-mails since businesses that send commercial e-mail messages in violation of state laws that are still in effect may be subject to civil or even criminal liability. Effect on California Spam Law The Act preempts the California Spam Law’s strict opt-in regime - the prohibition against sending unsolicited commercial e-mail messages unless the recipient expressly consented to receiving such message. However, provisions of the California Spam Law prohibiting false or deceptive commercial electronic mail messages remain in effect, although it is not yet clear which provisions this may mean. The California Spam Law prohibits any person or entity from advertising using any commercial e-mail advertisement, whether unsolicited or not, from California or sent to a California e-mail address, if the e-mail (a) contains a third-party’s domain name without authorization; (b) uses false, misrepresented, obscured or forged header information; or (c) has a misleading subject line. While these prohibited practices would seem to fall within “false or deceptive” acts and therefore are not preempted, the Act also covers the use of misleading header information and subject lines. Thus, the exact scope of preemption of the California Spam Law by the Act is murky and is likely to be the subject of hotly contested lawsuits. If this provision of the California Spam Law is not preempted by the Act, then the California Attorney General or an e-mail service provider may bring an action under the California Spam Law for violation of this prohibition. It is not clear whether an individual recipient of a false or deceptive Century City * Houston * London * Los Angeles * New York * Northern Virginia * Orange County * Sacramento San Diego * San Diego – North County * San Francisco * Silicon Valley * Stamford * Sydney * Tokyo * Washington, DC www.pillsburywinthrop.com PILLSBURY WINTHROP LLP Client Alert January 26, 2004 message would be able to sue under the California Spam Law. The California Spam Law provides for individual suits by recipients of unsolicited commercial e-mail advertisement (i.e., messages transmitted in violation of the opt-in regime). One interpretation of this provision is that, because of the Act’s preemption of the opt-in regime, individuals are not allowed to sue under the California Spam Law for receiving “unsolicited” messages, regardless of whether such messages are also false or deceptive. However, another interpretation of this language could be that suits by individual recipients of unsolicited commercial e-mail messages are allowed if the messages are false or deceptive. Again, since the Act and the California Spam Law are both so new, there is scant guidance on interpreting the interaction between these laws. Practically, however, the incentive to sue under the California Spam Law may be reduced since that law, as it stands currently, provides for recovery of statutory damages only for violations of the prohibition against unsolicited email, which is preempted by the Act. Nevertheless, successful plaintiffs may recover actual damages for spam as well as attorneys’ fees and costs. And, of course, as noted above, other causes of action (such as an unfair business practice action under California Business and Professions Code Section 17200) may be available to recipients of spam. Do-Not-E-mail Registry The Act requires the FTC, within 6 months after the date of enactment of the Act, to develop a report on establishing a nationwide Do-Not-E-mail Registry which may but is not required to be implemented no sooner than 9 months after the date of enactment of the Act. This registry would allow individuals or businesses to put their names on the national registry to indicate their preference with respect to receiving commercial e-mail messages. Conclusion While the new CAN-SPAM Act creates a federal regime for regulating commercial e-mail messages and thus provides fundamental principles that should be used in any e-mail marketing campaigns, it leaves open a number of key aspects, including modifications of definitions and other requirements by the FTC, and the scope of preemption of state laws. Any business that ever sends any e-mail containing an advertisement or solicitation will need to take appropriate actions to comply with the Act, as well as applicable state laws. Included below are “Tips for Complying with CAN-SPAM and other Spam Laws.” These tips apply generally and may need modification for use in particular situations. Thus, businesses that use e-mail for advertising are well advised to consult with legal counsel in attempting to comply with the Act. Please contact Pillsbury Winthrop for more information and assistance. Century City * Houston * London * Los Angeles * New York * Northern Virginia * Orange County * Sacramento San Diego * San Diego – North County * San Francisco * Silicon Valley * Stamford * Sydney * Tokyo * Washington, DC www.pillsburywinthrop.com PILLSBURY WINTHROP LLP Client Alert January 26, 2004 TIPS FOR COMPLYING WITH CAN-SPAM AND OTHER SPAM LAWS1 While the Act is still new and implementing regulations and other follow-up actions by the FTC are still forthcoming that may clarify many elements of the Act, several steps can be taken to enhance compliance with the Act and other spam laws: 1. First and foremost, perform a self-assessment of your company’s practices with respect to emails, including, but not limited to, assessing who within your company sends emails, to whom these emails are sent, what information or content do these emails generally contain, who oversees these emails’ content, and whether there is a mechanism for pre-approval of that content. Obviously, this is not an easy undertaking. However, it is the most effective way to ensure that the remaining tips are actually implemented and followed. 2. Include an easy and obvious opt-out mechanism for the e-mail recipient. This mechanism can be simply by replying to the e-mail, by clicking on a link included in the message or some other electronic means, as well as by toll-free telephone call. 3. Maintain records of opt-out requests. 4. Comply with opt-out requests within 10 business days. Establish and follow procedures for removing e-mail addresses from your mailing list once the request is received. Notify anyone else to whom you have provided your e-mail address lists on a prompt and regular basis of opt-out requests received. It is recommended that this process be overseen by a centralized area in order to help ensure the company complies with the opt-out request within the short 10-day grace period allowed by the Act. 5. Take appropriate actions to make sure that any third parties that market your products are aware of and also comply with the Act. You may want to have contractual rights to preapprove any e-mail advertisement in which you or your products are specifically identified, and also have the right to terminate such relationship if the other party violates the Act. 6. If appropriate for your company, include affirmative consent language, in a clear and conspicuous manner on your website (such as where users register and provide e-mail addresses) permitting e-mail marketing by your company (and your affiliated and partner companies, if you choose). Note that the “negative opt-in” method for obtaining a user’s permission (consisting of a pre-checked box that the user needs to uncheck if he or she does not wish to receive emails from your company) may not be deemed “affirmative consent” under the Act. A preferable method may be to require users to affirmatively check a box that is clearly and conspicuously displayed on your website page indicating the user’s consent to receiving emails from your company, and if applicable, your affiliated and partner companies. 7. Your e-mail message should clearly identify your company as the sender of the message. Consider whether the division or entity identified in the e-mail message is appropriately tailored. Use your company e-mail address as the return address, make sure it is working on Century City * Houston * London * Los Angeles * New York * Northern Virginia * Orange County * Sacramento San Diego * San Diego – North County * San Francisco * Silicon Valley * Stamford * Sydney * Tokyo * Washington, DC www.pillsburywinthrop.com PILLSBURY WINTHROP LLP Client Alert January 26, 2004 an ongoing basis and that someone is responsible for monitoring it. Never use misleading (or false) message header information or identifiers of the origin of the e-mail. 8. Be clear about the nature of your message - use accurate subject headings and use the “ADV” (or for sexually explicit content “ADV:ADLT”) label on the subject line of the message. 9. Do not provide your e-mail address list to third parties (including an affiliated entity if its line of business is not similar to yours) without at least giving notice to (and preferably getting the consent of) the e-mail address holders and the opportunity to opt-out, and confirming that the sharing of such information is legally allowed and in compliance with your privacy statements. 10. Include in the e-mail message your company’s physical address. 11. Include in the e-mail message a link to your company’s privacy policy.2 12. If you obtained e-mail addresses by renting a list from someone else, find out how the e-mail addresses were obtained. Confirm that they were not obtained through automated means, such as harvesting or dictionary attacks, or otherwise surreptitiously or deceptively, and were obtained in compliance with the Act. Also require that the provider have appropriate procedures in place for dealing with opt-out requests and has complied with all such requests. 13. If you have another entity perform e-mail marketing campaigns for you, require their compliance with these guidelines. Conduct diligence regarding their procedures before signing them up and if you do engage them, audit their procedures from time to time. Include appropriate indemnification terms in your agreement with these marketers and the ability to terminate and other remedies for violations. 14. For unsolicited e-mail (especially bulk e-mail), it is advisable to review the policies of ISPs whose users you will be sending unsolicited e-mail to. 15. Establish and enforce policies and procedures for compliance with the above suggestions. Century City * Houston * London * Los Angeles * New York * Northern Virginia * Orange County * Sacramento San Diego * San Diego – North County * San Francisco * Silicon Valley * Stamford * Sydney * Tokyo * Washington, DC www.pillsburywinthrop.com PILLSBURY WINTHROP LLP Client Alert January 26, 2004 Finally, if you have international marketing campaigns, consider obtaining affirmative consent to receiving e-mail messages from your recipient whenever you can, and maintain records of that consent. Although the United States has adopted the opt-out regime with CAN-SPAM, the trend internationally is to require opt-in. Even in the U.S., implementation of a “Do-Not-Spam” registry, if it happens, may make records of consent a good idea in the event of a dispute over whether consent was given or not. 1 Many of these are also found in the guidelines issued on October 14, 2003, by the largest U.S. advertising and marketing trade groups, including the Direct Marketing Association (DMA). 2 California has also just passed a new law, called the Online Privacy Protection Act of 2003 (A.B. 68), codified at Cal. Bus. & Prof. Code § 22575 et. seq.) requiring commercial web site operators that collect personal information online from residents of California to post and comply with a privacy policy. This law becomes effective July 1, 2004. For more information about this issue, please contact: Debbie Thoren-Peden at 213-552-7320 ([email protected]); Marla Hoehn at 650 233 4500 ([email protected]); Delphine Guerre-Larrouilh at 650-233-4634 ([email protected]); Carolyn Burger at 213-552-7198 ([email protected]). Century City * Houston * London * Los Angeles * New York * Northern Virginia * Orange County * Sacramento San Diego * San Diego – North County * San Francisco * Silicon Valley * Stamford * Sydney * Tokyo * Washington, DC www.pillsburywinthrop.com PILLSBURY WINTHROP LLP Client Alert January 26, 2004 This publication is issued periodically to keep PILLSBURY WINTHROP LLP clients and other interested parties informed of current legal developments that may affect or otherwise be of special interest to them. The comments contained herein do not constitute legal opinion and should not be regarded as a substitute for legal advice. Century City * Houston * London * Los Angeles * New York * Northern Virginia * Orange County * Sacramento San Diego * San Diego – North County * San Francisco * Silicon Valley * Stamford * Sydney * Tokyo * Washington, DC www.pillsburywinthrop.com
© Copyright 2026 Paperzz