The Controlling the Assault of Non-Solicited Pornography and Marketing Act
of 2003, also called the CAN-SPAM Act of 2003 (the Act), a federal law
regulating the transmission of unsolicited commercial e-mail (i.e., spam),
went into effect on January 1, 2004. The Act preempts all existing state
statutes on the regulation of spam. It is designed to target deceptive
messages sent by large-volume spammers, who often hide their identities, use
misleading subject lines and header information, and refuse to honor opt-out
requests from spam recipients.
An
Opt-Out Approach – Compliance Guidelines
The Act is an
opt-out approach to spam. It does not ban unsolicited commercial e-mails,
but rather creates a set of standards that must be followed with respect to
any such e-mails.
Specifically, the Act:
-
Prohibits
senders from falsifying or disguising their true identity.
-
Prohibits fraudulent or deceptive subject
lines, header information and return addresses.
-
Prohibits the harvesting of e-mail addresses
by either (1) automatic means from an Internet website or proprietary
online service maintained by a third party that bans this practice; or (2)
an automated system that generates possible electronic addresses by
combining names, letters and numbers in numerous permutations.
-
Prohibits businesses from knowingly promoting
themselves through false or misleading e-mails.
-
Requires the inclusion of a legitimate return
e-mail and physical postal address for the sender.
-
Requires the inclusion of a functioning
opt-out mechanism, clear and conspicuous notice of the opportunity to
opt-out, and requires senders to honor any such opt-out request.
-
Requires clear and conspicuous notice that the
message is an advertisement or solicitation.
-
Requires
messages with sexually oriented material to be clearly identified.
Application
The Act
applies to essentially all businesses in the U.S. that use e-mail. It
applies to any “commercial electronic mail messages,” which are defined as
any e-mail messages “the primary purpose of which is the commercial
advertisement or promotion of a commercial product or service (including
content or an Internet website operated for a commercial purpose).”
Transactional or relationship messages (such as e-mail messages that have as
their primary purpose facilitating, completing, or confirming a commercial
transaction that the recipient has previously agreed to enter into with the
sender, providing warranty, recall or safety or security information with
respect to a product or service purchased by the recipient, providing
account-related information, or delivering goods or services, including
product updates or upgrades, under the terms of an agreed upon transaction),
are excluded from the definition. The Act implicates not only the spammers
(those actually distributing the spam e-mails), but also extends to
companies who procure their services. In fact, if a company knowingly
permits a third-party spammer to act on its behalf, (e.g., distributing spam
e-mail promoting its products and/or services) it is subject to prosecution
under the Act. Businesses cannot avoid compliance with the Act by simply
outsourcing spamming.
Enforcement and Penalties
Violators of
the Act can be subjected to criminal penalties, which include fines and up
to five years in prison. The
Act also authorizes the FTC and the Attorney General of each state to
enforce its provisions. An state’s Attorney General may bring a civil action
to obtain damages on behalf of state residents in an amount equal to the
greater of (i) the actual monetary loss suffered by such residents, or (ii)
the statutory damages allowed under the Act (which damages
can amount to as much as
$250 per spam e-mail with a cap of $2 million that can be tripled for
aggravated violations). In addition, the Act permits
Internet
access service providers (“ISP”) to institute a civil action against
violators to recover damages in an amount equal to the greater of (i) actual
monetary loss incurred by the ISP, or (ii) the statutory damages allowed
under the Act (which damages
can amount to as much as $100 per violation with a cap of $1
million that can be tripled for aggravated violations). The caps on damages
do not apply to e-mails using false or deceptive headers.
In
the case of a successful action by either the state or and ISP, the court
may award the costs of the action and reasonable attorneys’ fees.
[Contact
Author]
