O signed into law the Controlling the Sending messages from - - PDF document

The Tech Group Alert

January 2004

The CAN-SPAM Act: Federal Government Regulates Unsolicited Commercial E-mail

By David Leit, Esq.

O

n December 16, 2003, President Bush signed into law the “Controlling the Assault of Non-Solicited Pornography and Marketing Act of 2003.” The Act became effective on January 1, 2004. The “CAN-SPAM” Act represents the federal government’s first effort to address the rapid growth in the volume of unsolicited commercial electronic mail. It may not be the last such effort, as the Act specifically contemplates review of the effectiveness of the Act within the next two years. The Act focuses mainly on stopping deceptive practices often used by senders of bulk commercial e- mail, and on providing recipients with a method to

• pt out from receiving future communications from

any particular sender. The Act does not prohibit the sending of unsolicited commercial e-mail that complies with the requirements of the Act.

What the Law Prohibits

The CAN-SPAM Act prohibits:

·

Accessing someone else’s computer, without their authorization, and using it to transmit multiple commercial e-mail messages;

·

Using someone else’s computer to relay or retransmit e-mail so that it appears to come from them, rather than the actual sender;

·

Falsifying header information;

·

Sending messages from e-mail accounts or domain names that are registered under names which falsely identify the registrant;

·

Using deceptive subject headings;

·

Sending an e-mail that does not contain a functioning reply mechanism or other comparable means which allows the recipient to opt out of future mailings;

·

Sending e-mail to anyone who has opted out;

·

Sending commercial e-mail without a “clear and conspicuous” identification of the message as an advertisement or solicitation;

·

Sending commercial e-mail without clear and conspicuous notice of an opt-out option;

·

Sending commercial e-mail without including a physical postal address of the sender;

·

“Harvesting” of e-mail addresses from web sites;

·

Use of automated routines that generate possible e-mail addresses by combining names, letters, or numbers into numerous permutations (“dictionary attacks”);

·

Sending sexually oriented material without including notice that such material is included in the subject heading;

G

This document is published by Lowenstein Sandler PC to keep clients and friends informed about current issues. It is intended to provide general information only. 65 Livingston Avenue www.lowenstein.com

L

Roseland, New Jersey 07068-1791 Telephone 973.597.2500 Fax 973.597.2400

·

Sending sexually oriented material in any way that presents the material to the recipient immediately upon opening, rather than providing the required notices and further instructions on how to access the sexually

• riented material; or

·

Knowingly allowing one’s business to be promoted by a third party who sends commercial e-mail in violation of the Act.

Fleshing out the Details

The CAN-SPAM Act leaves a number of details to be sorted out at a later date. Most significantly, the law directs the FTC to issue a report within the next 6 months regarding recommendations for implementing a national Do-Not-E-mail registry, akin to the new Do-Not-Call registry. The FTC is pre-authorized to implement its plan at any time after nine months from the date of the enactment. Thus, we can reasonably expect to see a Do-Not- E-mail registry some time after September 16, 2004. The FTC is also charged with issuing regulatory guidance on how certain aspects of the Act will be

• implemented. For example, the Act specifically

directs the FTC to prescribe clearly identifiable marks or notices to be included in or associated with commercial e-mail that contains sexually

• riented material, both for the purposes of

informing the recipient and to aid in e-mail filtering

• schemes. These regulations are due by April 2004.

It is also reasonable to expect that the FTC will issue further guidance on such issues as what constitutes “clear and conspicuous” identification

• f messages as advertisements, and what it

considers a sufficient means for exercising an opt-

• ut right.

Finally, the new law directs the FTC, in consultation with the Department of Justice, to issue a report by the end of 2005 analyzing the effectiveness and enforcement of the CAN-SPAM Act, and making recommendations to Congress for any amendments to the Act.

Affirmative Consent

Senders can avoid some of the restrictions of the CAN-SPAM Act by obtaining affirmative consent before sending e-mail to any particular recipient. If a recipient expressly consents to receive e-mail messages, the sender of the e-mail is no longer

• bliged to identify messages as an advertisement or

solicitation, nor is a sender of sexually explicit materials obligated to label them as such. In addition, a sender of sexually explicit materials may send those materials directly in an e-mail if the recipient has already given affirmative consent. Affirmative consent does not affect the requirements that e-mails contain an opt-out provision or a valid postal address, nor does it alter any of the provisions regarding false and misleading headers, routing information, etc.

Preemption of State Laws

The CAN-SPAM Act supersedes all State and local laws that expressly regulate the use of e-mail to send commercial messages. Thus, the Act nullifies

• ther statutes that have been recently passed, many
• f which are more restrictive than the CAN-SPAM
• Act. For example, California had recently passed a

statute which prohibited all commercial e-mail from California or to California e-mail addresses except with affirmative consent. This law has now been preempted by the CAN-SPAM Act.

G

Enforcement

The CAN-SPAM Act does not provide for a private cause of action; that is, an individual who believes he or she received e-mail in violation of the Act cannot sue the sender directly. The FTC has the principal authority to enforce the civil aspects of the law, although other federal agencies have authority to enforce the law against entities falling within their regulatory purview. The Department of Justice will enforce the criminal aspects of the Act. The Attorneys General of the States have authority to enforce certain portions of the Act, provided that they notify the FTC or

• ther appropriate federal regulatory agency before

taking action. In addition, if a federal agency has brought an action for violation of the Act, the States are prohibited from taking action while that action is pending. The sole exception to the rule preventing private causes of action is a limited authority granted to Internet service providers to bring suit for certain violations of the Act, if the ISP is adversely affected by such violations. In addition, it is important to note that the CAN- SPAM Act does not prevent ISPs from adopting their own spam policies, which may be more restrictive than the requirements of the CAN- SPAM Act.

Conclusion

While the CAN-SPAM Act certainly requires senders of commercial e-mail to be more careful about their practices, it should not present an insurmountable hurdle for most legitimate

• businesses. Now is a good time for senders of

commercial e-mail to review and update their mailing practices and privacy policies. Clients having questions regarding the CAN-SPAM Act are urged to contact the Lowenstein Sandler attorneys with whom they work. In addition, questions can be directed to David Leit at (973) 597-2340 or dleit@ lowenstein.com.

G