The CAN-SPAM Act of 2003 D E C E M B E R 2 0 0 3 THE CAN-SPAM ACT - - PDF document

The CAN-SPAM Act of 2003

D E C E M B E R 2 0 0 3 V A L U E A D D E D , V A L U E S D R I V E N.

SM

THE CAN-SPAM ACT OF 2003

Status of Legislation When Congress returns from recess on December 8, 2003, it will finish its work on the CAN-SPAM Act of 2003 (Controlling the Assault of Non-Solicited Pornography and Marketing Act of 2003). The Senate passed its version of the CAN-SPAM Act (S. 877) on October 22, 2003 (Senate Bill). The U.S. House of Representatives passed a modified version of the Act on November 22, 2003 (House Bill). On November 25, 2003, the Senate passed the House-modified version of S. 877 by voice vote; however, the Senate made some “technical changes” to the bill, and the House will need to reconsider and clear the bill when it returns from recess before it can go to the President. While the press has portrayed the legislation primarily as an anti-pornography measure, it goes much farther and will affect all businesses that use email as a means of communicating with their customers and clients. As an interim step, this memorandum summarizes the major House changes that were made to the Senate Bill. Generally, the House modifications provide broader restrictions for senders of commercial email, which are no longer differentiated from senders of “unsolicited” commercial email. The House Bill also directs the Federal Communications Commission (FCC) to regulate commercial messages sent to wireless communications devices, including cell phones. Except for provisions related to the Do-Not-Email registry, the CAN-SPAM Act would take effect on January 1, 2004 and have the effect of preempting all state laws that directly regulate commercial email. The specific changes between the House and Senate Bills are summarized below. Categories of Email Commercial v. Unsolicited Commercial email: The House Bill no longer differentiates between commercial email and unsolicited commercial email.1 Restrictions that applied only to unsolicited commercial email messages in the Senate Bill would now apply to all commercial email messages. Such restrictions include, among others:

• sending email to a consumer more than 10 days after an opt-out request;
• sending email without identifying that the message is an advertisement;
• sending email without notice of an opportunity to opt-out; including the sender’s physical postal address; and
• using “harvesting” or “dictionary attacks” to collect addresses for sending commercial email.

Transactional or Relationship Messages: Although the House version eliminates the distinction between “unsolicited” commercial email and other commercial email, it does modify the definition of “commercial electronic mail message” to exclude transactional or relationship messages. The definition of transactional or relationship message remains the same.

1 The Senate Bill defined “commercial electronic mail message” as one that has the primary purpose of delivering a commercial

advertisement or promotion of a commercial product or service. The House Bill retains that definition. The Senate Bill defined “unsolicited commercial mail message” as any commercial email message that is (a) not a transactional or relationship message; and (b) sent to a recipient without the recipient’s prior affirmative or implied consent.

T H E C A N - S P A M A C T O F 2 0 0 3 D E C E M B E R 2 0 0 3 2 V A L U E A D D E D , V A L U E S D R I V E N.

SM

A transactional or relationship message presupposes an existing relationship between the sender and the recipient and has the primary purpose of communicating membership, subscription, account, or other such information. The Senate Bill did not explain how certain messages that had both transactional or relationship and commercial characteristics should be treated, such as a monthly mileage club statement that contained advertisements for sale airfares. The House Bill orders the Federal Trade Commission (FTC), within 12 months after enactment of CAN-SPAM, to issue regulations defining the criteria that should be used in determining the primary purpose of an electronic mail message. The House Bill also authorizes the FTC to modify the definition of “transactional or relationship message” as needed to accommodate technological changes or marketing practices. Elimination of the “Implied Consent” exception: The House Bill also eliminated the “implied consent” exception that would have allowed marketers to send commercial email when there has been a business transaction between the marketer and the recipient within the 3-year period before receipt of the commercial email. This change could be particularly important for marketers that rely on telemarketing and in-person sales. Affiliates and Separate Lines of Business The House Bill retained a Senate provision allowing the affirmative consent of a recipient to receive messages from a sender to cover messages from the sender’s affiliate, if the recipient was given notice that his or her email address could be transferred to the affiliate for the purpose of sending commercial email. The House Bill clarified the definition of “sender” to specify that if an entity operates through separate lines of business or divisions and holds itself out as a particular line of business or division (rather than as the entity of which the line of business or division is a part), then the line of business or division will be treated as the sender. Section 4: Prohibition Against Predatory and Abusive Commercial Email2 In setting forth acts that would warrant criminal penalties under Title 18 of the United States Code, the House Bill added a “materiality” standard to certain prohibitions. Anyone that “materially” falsifies header information or registers for an email address from which to send commercial email using information that “materially” falsifies the identity of the actual registrant will be subject to the penalties. Header information or registration information is materially misleading if it is altered or concealed in a way that impairs the ability of the recipient, an Internet access service provider, or anyone enforcing the law to determine the identify of the sender. Section 5: Other Protections for User of Commercial Electronic Mail This section deleted any references to “unsolicited commercial electronic mail” and replaced that term with “commercial electronic mail.” The following activities, which the Senate Bill prohibited only for senders of unsolicited commercial email messages, would now be illegal for senders of any commercial email:

• sending email to a consumer more than 10 days after an opt-out request;
• sending email without identification that the message is an advertisement or solicitation;
• sending email without notice of the opportunity to opt-out; including the sender’s physical postal address;
• using “harvesting” or “dictionary attacks” to collect email addresses, and
• failing to include warning labels on messages that include sexually oriented material.

Safe Harbor Elimination: The House Bill has eliminated a Senate Bill safe harbor for certain Section 5 violations. Under the Senate Bill, if an email marketer could prove that it had established and implemented reasonable practices and procedures to prevent certain violations, and a violation occurred despite good faith efforts to comply, then actions against the marketer could not proceed. The violations covered by the safe harbor were: sending deceptive subject headings;

2 The House Bill has re-numbered the Sections. Section 104 in the Senate Bill is Section 4 in the House Bill, etc.

T H E C A N - S P A M A C T O F 2 0 0 3 D E C E M B E R 2 0 0 3 3 V A L U E A D D E D , V A L U E S D R I V E N.

SM

failing to include a functioning return email address; sending email more than 10 days after an opt-out request; and failing to include identification, an opt-out notice, and a physical postal address. Instead, the House Bill allows the marketer’s “good behavior” to be used by the court to reduce a damages award in a civil action brought by a state. Opt Back In: The House Bill allows mail recipients to “opt back in” to receiving commercial email messages after making an opt-out request by providing affirmative consent.3 This provision was not in the Senate Bill. Warning Labels for Adult Material: Under the House Bill, the requirement to place warning labels on commercial mail containing sexually explicit content and requirements for including instructions on how to access that content do not apply if the recipient has given prior affirmative consent. Section 6: Businesses Knowingly Promoted By Electronic Mail With False or Misleading Transmission Information The House Bill contains no substantive modifications to Section 106 of the Senate Bill. This Section is intended to catch businesses that hire “spammers” to send commercial email in violation of the Act. Section 7: Enforcement FTC/FCC Cease and Desist Orders: The House Bill adds a provision stating that neither the FTC nor the FCC would need to allege or prove the state of mind required by certain subsections of Section 5 to obtain a cease and desist order or an injunction. State Actions: Whereas the Senate Bill allowed states to bring actions to enforce Section 105 of the Senate Bill, the House Bill permits states to bring actions to enforce specific subsections of Section 5: the prohibition against false or misleading transmission information; the prohibition against deceptive subject headings; the failure to include a functioning return email address; sending commercial email after an opt-out request; and failing to include identification, an opt-out notice, and a physical address. In a new provision of the House Bill, a state attorney general would not be required to allege or provide state of mind in obtaining injunctive relief. On the other hand, states may not obtain monetary relief sought in a civil action for certain violations of the Act unless the state can establish that the defendant acted with actual knowledge,

• r knowledge fairly implied on the basis of objective circumstances, of the act or omission that constitutes the violation.

Damages: The House Bill raises statutory damages in state actions to $250 per violation. The Senate Bill specified damages as $100 for deceptive subject headings, and $25 for all other Section 105 violations. The House Bill also increased the damages limitation from $1 million to $2 million. Leaving the possibility of treble damages intact, the House Bill makes it possible to incur $6 million in fines for violations of Section 5. Damages may be reduced if the defendant can show that it took steps to void such violations, and the violation occurred despite precautions. Whereas the Senate Bill mandated the award of attorney fees, the House Bill modified the language so that a state “may” be awarded costs and attorney fees. Statutory damages in actions brought by Internet access service providers remain the same as in the Senate Bill: $100 per violation for deceptive subject headings, and $25 for all other violations. Courts may award attorney fees and costs. Section 8: Effect on Other Laws Section 9: Do-Not-Email Registry Section 10: Study of Effects Section 11: Rewards for Information about Violations; Labeling

3 “Affirmative consent” means that the recipient has expressly consented to receive the message, either in response to a consent

request or at the recipient’s own initiative.

T H E C A N - S P A M A C T O F 2 0 0 3 D E C E M B E R 2 0 0 3 4 V A L U E A D D E D , V A L U E S D R I V E N.

SM

There are no substantial differences between the House Bill and the Senate Bill in Sections 8-11. Like the Senate bill, the House Bill preempts state laws that regulate the use of electronic mail to send commercial messages. The House Bill directs the FTC to draft an implementation for a Do-Not-Email registry within six months after enactment. The Do-Not- Email registry cannot go into effect until at least nine months after enactment. Section 12: Restrictions on Other Transmissions Section 12 is new. The House Bill proposes to amend Section 227(b)(1) of the Communications Act so that it reads: “It shall be unlawful for any person within the United States or any person outside the United States if the recipient is within the United States . . .” to conduct certain marketing activities using automated telephone equipment, artificial or prerecorded voice messages, and fax advertisements [new language in italics]. Section 13: Regulations Section 13 has no counterpart in the Senate Bill. This Section authorizes the FTC to issue regulations to implement the CAN-SPAM Act. Section 14: Application to Wireless Section 14, also a House addition, requires the FCC (in consultation with the FTC) to promulgate rules within 270 days after enactment of the CAN-SPAM Act to protect consumers from “wireless spam.” The Act defines “mobile service commercial message” as a commercial electronic mail message that contains text, graphics, or images for visual display that is transmitted directly to a wireless device capable of displaying the message. The House Bill sets up an opt-in system for wireless spam. The FCC’s rules must provide wireless subscribers with the ability to avoid receiving mobile service commercial messages unless the subscriber has provided express prior authorization; however, for providers of commercial mobile wireless services, the FCC can take into consideration the relationship that exists between service providers and their subscribers. If the FCC determines that wireless service providers should not be subject to the opt-in requirement, it must require wireless service providers to allow subscribers to

• pt-out when they subscribe to the service, and in any billing mechanism.

The FCC rules must also allow recipients of any mobile service commercial message to send an opt-out request electronically, presumably through the wireless device to which messages are sent. The FCC must consider the technical aspects of this requirement in its rulemaking. Effective Date The House Bill effective date for all provisions of the CAN-SPAM Act – except for the section pertaining to the Do-Not- Email Registry – is January 1, 2004. As with the Senate Bill, the FTC has six months to submit a plan for establishing the registry, but the registry cannot be implemented for at least nine months after enactment of CAN-SPAM. For further information regarding the CAN-SPAM Act, please contact: Ian D. Volner, Chair, Regulatory Group Heather L. McDowell Ellen E. Traupman (202) 344-4814 idvolner@venable.com (202) 344-4897 hlmcdowell@venable.com (202) 344-4704 eetraupman@venable.com _______________________________________________________________________________________________

This publication is not intended to provide legal advice or opinion. Such advice may only be given when related to specific fact situations.