FTC FACTSfor Business

BUSINESS

1-877-FTC-HELP

FEDERAL TRADE COMMISSION FOR THE CONSUMER

www.ftc.gov

The CAN-SPAM Act:

Requirements for equirements for equirements for

Commercial Emailers Commercial Emailers Commercial Emailers

he CAN-SPAM Act of 2003 (Controlling the Assault of NonSolicited Pornography and Marketing Act) establishes requirements for those who send commercial email, spells out penalties

for spammers and companies whose products are advertised in spam if they

violate the law, and gives consumers the right to ask emailers to stop

spamming them.

The law, which became effective January 1, 2004, covers email whose primary

purpose is advertising or promoting a commercial product or service, including

content on a Web site. A “transactional or relationship message” — email that

facilitates an agreed-upon transaction or updates a customer in an existing business relationship — may not contain false or misleading routing information, but

otherwise is exempt from most provisions of the CAN-SPAM Act.

T
Facts for Business

The Federal Trade Commission (FTC), the

nation’s consumer protection agency, is authorized to enforce the CAN-SPAM Act. CANSPAM also gives the Department of Justice

(DOJ) the authority to enforce its criminal

sanctions. Other federal and state agencies can

enforce the law against organizations under

their jurisdiction, and companies that provide

Internet access may sue violators, as well.

What the Law Requires

 Here’s a rundown of the law’s main

provisions:

• It bans false or misleading header information. Your email’s “From,” “To,” and

routing information – including the originating domain name and email address – must

be accurate and identify the person who

initiated the email.

• It prohibits deceptive subject lines. The

subject line cannot mislead the recipient

about the contents or subject matter of the

message.

• It requires that your email give recipients

an opt-out method. You must provide a

return email address or another Internetbased response mechanism that allows a

recipient to ask you not to send future email

messages to that email address, and you must

honor the requests. You may create a

“menu” of choices to allow a recipient to opt

out of certain types of messages, but you

must include the option to end any commercial messages from the sender.

Any opt-out mechanism you offer must be

able to process opt-out requests for at least

30 days after you send your commercial

email. When you receive an opt-out request,

the law gives you 10 business days to stop

sending email to the requestor’s email

address. You cannot help another entity send

email to that address, or have another entity

send email on your behalf to that address.

Finally, it’s illegal for you to sell or transfer

the email addresses of people who choose

not to receive your email, even in the form of

a mailing list, unless you transfer the addresses so another entity can comply with the

law.

• It requires that commercial email be

identified as an advertisement and include

the sender’s valid physical postal address.

Your message must contain clear and conspicuous notice that the message is an

advertisement or solicitation and that the

recipient can opt out of receiving more

commercial email from you. It also must

include your valid physical postal address.

Penalties

Each violation of the above provisions is

subject to fines of up to $11,000. Deceptive

commercial email also is subject to laws banning false or misleading advertising.

Additional fines are provided for commercial emailers who not only violate the rules

described above, but also:

• “harvest” email addresses from Web sites or

Web services that have published a notice

prohibiting the transfer of email addresses

for the purpose of sending email

• generate email addresses using a “dictionary

attack” — combining names, letters, or

numbers into multiple permutations

• use scripts or other automated ways to

register for multiple email or user accounts

to send commercial email

• relay emails through a computer or network

without permission — for example, by

taking advantage of open relays or open

proxies without authorization.
Facts for Business

The law allows the DOJ to seek criminal

penalties, including imprisonment, for

commercial emailers who do — or

conspire to:

• use another computer without authorization

and send commercial email from or

through it

• use a computer to relay or retransmit multiple commercial email messages to deceive

or mislead recipients or an Internet access

service about the origin of the message

• falsify header information in multiple email

messages and initiate the transmission of

such messages

• register for multiple email accounts or

domain names using information that falsifies the identity of the actual registrant

• falsely represent themselves as owners of

multiple Internet Protocol addresses that are

used to send commercial email messages.

Additional Rules

The FTC will issue additional rules under

the CAN-SPAM Act involving the required

labeling of sexually explicit commercial email

and the criteria for determining “the primary

purpose” of a commercial email. Look for the

rule covering the labeling of sexually explicit

material in April 2004; “the primary purpose”

rulemaking will be complete by the end of

2004. The Act also instructs the FTC to report

to Congress in summer 2004 on a National Do

Not E-Mail Registry, and issue reports in the

next two years on the labeling of all commercial email, the creation of a “bounty system” to

promote enforcement of the law, and the

effectiveness and enforcement of the CANSPAM Act.

See the FTC Web site at www.ftc.gov/spam

for updates on implementation of the CANSPAM Act.

The FTC maintains a consumer complaint

database of violations of the laws that the FTC

enforces. Consumers can submit complaints

online at www.ftc.gov and forward unwanted

commercial email to the FTC at spam@uce.gov.

Your Opportunity to Comment

The National Small Business Ombudsman

and 10 Regional Fairness Boards collect comments from small businesses about federal

compliance and enforcement activities. Each

year, the Ombudsman evaluates the conduct of

these activities and rates each agency’s responsiveness to small businesses. Small businesses

can comment to the Ombudsman without fear

of reprisal. To comment, call toll-free

1-888-REG-FAIR (1-888-734-3247) or go to

www.sba.gov/ombudsman.

For More Information

The FTC works for the consumer to prevent

fraudulent, deceptive, and unfair business

practices in the marketplace and to provide

information to help consumers spot, stop, and

avoid them. To file a complaint or to get free

information on consumer issues, visit

www.ftc.gov or call toll-free, 1-877-FTCHELP (1-877-382-4357); TTY: 1-866-653-

4261. The FTC enters Internet, telemarketing,

identity theft, and other fraud-related complaints into Consumer Sentinel, a secure online

database available to hundreds of civil and

criminal law enforcement agencies in the U.S.

and abroad.
Facts for Business

Federal Trade Commission

Bureau of Consumer Protection

Office of Consumer and Business Education

April 2004

www.ftc.gov

Federal Trade Commission

1-877-FTC-HELP

For The Consumer