California´s New Aggressive Anti-Spam Law - A Trap For Corporate Marketing Departments?

California adopted one of the nation’s most aggressive anti-spam laws in the fall of 2003. Although intended to halt the proliferation of spam, the broad sweep of the legislation will add increased operational burdens to the direct marketing efforts of legitimate companies and advertisers. The new law, Senate Bill No. 186 ("SB 186"), eliminates California’s existing anti-spam provisions and replaces them with a general prohibition on the sending of unsolicited commercial e-mail advertisements from California or to a California e-mail address. SB 186 mandates an "opt-in" requirement and adoption of mechanisms for consumers to "opt out" of receiving advertisements, and it imposes significant statutory penalties and civil damages for violations. Any company’s direct marketing efforts involving consumer e-mail should be evaluated for compliance to avoid exposure to liability.

California’s anti-spam statute addresses the growing concern over the dramatic increase of spam and its associated costs. Unsolicited commercial e-mail affects individuals and organizations due to the time and effort required to filter out spam, work interruptions required to process unwanted e-mail, and the strain it imposes on computer systems, networks, and servers. The California Legislature found that spam currently comprises roughly 40 percent of all e-mail traffic in the United States. A national technology research firm has estimated that spam will cost American businesses more than $10 billion in 2003. California’s share of this cost is estimated at well over $1.2 billion.

Existing California law enacted in 1998 requires "opt-out" disclosures and specific labeling of commercial e-mail advertisements. The 1998 law prohibits unsolicited e-mail unless it contains either a toll-free number or a return e-mail address that the recipient can use to notify the sender to stop sending spam. The law also requires unsolicited e-mail advertisements to contain a heading of "ADV:" or "ADV:ADLT," identifying the e-mail as advertising.

SB 186, set to take effect January 1, 2004, eliminates these provisions and provides for an "opt-in" system. Under the new law, it is illegal to initiate or advertise in an unsolicited commercial e-mail originating from California or to a California e-mail address unless the e-mail recipient has given the advertiser express consent to receive advertisements or has a "preexisting or current business relationship" with the advertiser.

Codified as California Business and Professions Code § 17529, et seq., the statute has been touted as the nation’s toughest anti-spam statute because it sets forth the "opt-in" requirement and contains strong enforcement provisions. Delaware is the only other state that provides an opt-in requirement, which is enforced by the Delaware Attorney General. SB 186 is particularly aggressive because it not only provides the California Attorney General with enforcement powers but gives individuals and e-mail service providers a right of action and provides heavy fines and penalties for violations.

The statute provides a strong incentive for companies to adopt comprehensive policies regarding e-mail marketing. A violation of SB 186 authorizes a recipient, an e-mail service provider, or the Attorney General to bring an action to recover actual damages, and/or liquidated damages of $1,000 per unsolicited commercial e-mail, for a total of up to $1 million per incident. The statute also provides for an award of reasonable attorney's fees and costs to a prevailing plaintiff.

Companies may decrease their exposure to liability by implementing policies designed to prevent unsolicited commercial e-mail advertisements. The statute provides that if a court finds that a defendant establishes and implements, with due care, procedures and practices reasonably designed to effectively prevent unsolicited commercial e-mail advertisements, a court shall reduce the liquidated damages to a maximum of $100 for each unsolicited advertisement, or a maximum of $100,000 per incident.

SB 186 defines "unsolicited commercial e-mail advertisement" as a commercial e-mail advertisement sent to a recipient who has not provided direct consent to receive the commercial e-mail advertisement and who does not have a preexisting or current business relationship with the advertiser promoting the lease, sale, rental, gift offer, or other disposition of any property, goods, services, or extension of credit.

"Commercial e-mail advertisement" is defined as any electronic mail message initiated for the purpose of advertising or promoting the lease, sale, rental, gift offer, or other disposition of any property, goods, services, or extension of credit.

The statute defines "preexisting or current business relationship" to mean that the recipient has made an inquiry and has provided his or her e-mail address, or has made an application, purchase, or transaction, with or without consideration, regarding products or services offered by the advertiser.

Accurate Record-Keeping. Given the broad scope of the law and its strong enforcement provisions, companies should review their e-mail advertising policies and marketing campaigns for compliance. To start, companies should inventory customer e-mail addresses and keep accurate and complete records of customer inquiries, applications, purchases, or transactions. Although SB 186 does not provide a time requirement regarding customer transactions or a requirement that a record be kept of transactions, such records will help establish the existence of a preexisting business relationship.

Opt-Out Requirements for E-Mails Sent Pursuant to a Preexisting Business Relationship. E-mail advertisements sent to customers under the preexisting business relationship exemption must comply with specific opt-out rules. Such e-mails must provide the recipient with the ability to opt out from receiving further commercial e-mail ads by calling a toll-free telephone number or by sending an "unsubscribe" e-mail to the advertiser offering the products or services. This opt-out provision does not apply to recipients who are receiving free e-mail service with regard to commercial e-mail advertisements sent by the provider of the e-mail service.

Clear, Unambiguous Opt-In Requests. Businesses should seek to provide customers with clear, unambiguous opt-in requests because the statute defines direct consent to mean that the recipient has expressly consented to receive e-mail advertisements from the advertiser either in response to a clear and conspicuous request for the consent or at the recipient’s own initiative.

Deceptive Advertising Provisions. The new law also contains prohibitions against deceptive advertising. Companies should take preventative measures to ensure that commercial e-mail advertisements do not: 1) contain or accompany a third party’s domain name without the permission of the third party; 2) contain or accompany falsified, misrepresented, obscured, or forged header information; or 3) have subject line headers that will likely mislead a recipient about a material fact regarding the contents or the subject matter of the message.

Collection of E-Mail Addresses for Advertising Purposes is Prohibited. SB 186 contains provisions that prohibit the collection of e-mail addresses for advertising purposes. Specifically, the statute: 1) prohibits any person or entity from collecting e-mail addresses on the Internet for the purpose of using the addresses to initiate or advertise in unsolicited commercial e-mail; 2) prohibits any person or entity from using an e-mail address obtained by automated means based on a combination of names, letters, or numbers, in order to initiate or advertise in unsolicited commercial e-mail; and 3) prohibits any person from using scripts or other automated means to register for multiple e-mail accounts in order to initiate or advertise in unsolicited commercial e-mail.

Comprehensive E-Mail Advertising Policy. Another preventative measure companies may take to decrease their exposure to liability is to implement practices and procedures designed to effectively prevent unsolicited commercial e-mail advertisements. A comprehensive e-mail advertising policy will not insulate a business from liability under the statute, but it may result in a reduction in penalties for violations.

No Double Recovery for E-Mail Service Providers. In addition to changing existing law regarding unsolicited commercial e-mail, SB 186 amends California Business and Professions Code § 17538.45. § 17538.45 authorizes an e-mail service provider whose policy with regard to unsolicited e-mail advertisements is violated to bring a civil action to recover specified damages. SB 186 amends § 17538.45 to prohibit an e-mail service provider from seeking a cumulative remedy under both § 17529 and § 17538.45.

There is no anti-spamming legislation at the federal level. Congress is considering a number of bills to address spam, but they offer far less protection than what is provided under the new California law. The bills include opt-out safeguards for consumers, labeling requirements, and weaker enforcement provisions, and they would block states from enacting tougher laws. While federal preemption is a possibility, the fate of such legislation is unclear. For the time being, companies doing business in California or with California residents should undertake to comply with the requirements of SB 186 by January 1, 2004.

It is unlikely that the new law will have an impact on the vast bulk of true spam, which comes from places and companies that California cannot reach or control. The most likely result is that SB 186 will impose costs on legitimate businesses that are within the jurisdictional reach of California and will potentially reduce electronic marketing by the same businesses. Given the potential legal risks, companies should review and revise their policies regarding e-mail marketing. Compliance with the new law will ensure that national and global companies transacting business in California or with California residents may continue to do so without fear of exposure to liability.