United States: A New Weapon in The Fight Against Spam

The legal landscape of electronic advertising is changing with amazing speed. Up until now, businesses faced with a growing tidal wave of unsolicited email or "spam" have seemingly had little legal recourse, and the parties responsible for the spam have not been subject to the serious threat of civil liability. Both of these assumptions are about to change.

The federal CAN-SPAM Act, which took effect on January 1, 2004¹, has not yet successfully reduced spam or increased compliance with the Act’s requirements that spammers identify themselves and provide a viable opt-out mechanism for customers who do not want to be contacted. The Act has largely gone unenforced, in part because observers believed it did not include a private cause of action — individuals may not sue under the Act. But a new interpretation of who may sue under the Act may permit businesses to sue and recover the costs of incurring unwanted spam.

This opportunity, however, carries a substantial risk for certain businesses. Businesses engaged in electronic advertising through email must also worry about becoming the target of anti-spam enforcement or an antispam lawsuit. Businesses should be aware of whether and how they can use commercial email to communicate with customers, and what they should do to avoid liability. Compliance with the law is an absolute imperative now more than ever, because so much business-to-business communication takes place in the form of email. With the possibility of suing annoying spammers comes the possibility that a business will be the target of a suit from one of its business contacts. This article therefore first discusses the growing problem of spam, next discusses the CAN-SPAM Act and its effect on the legal landscape, and finally discusses the opportunities and hazards that the current state of the law presents to businesses.

Estimates vary, but spam clearly accounts for a significant amount of e-mail, and figures indicate it is on the rise. The spam problem is especially severe in the United States, both the greatest worldwide producer and consumer of spam.² Approximately fifteen billion pieces of spam are sent every day.³ And the spam problem continues to grow: spam represented just seven percent of all e-mail in 2001, while experts expect it to grow to between seventy and eighty percent of all e-mail this year.⁴ In fact, some sources estimate spam already constitutes up to ninety percent of e-mail.⁵

The cost of dealing with all this spam quickly adds up for businesses that must devote time, resources, and money to the problem. American corporate anti-spam measures consumed $10 billion last year in lost productivity and spamfighting equipment and personnel.⁶ One source estimates combating spam costs the average business more than $2.5 million a year.⁷

Spam threatens to hamper legitimate e-mail advertisers as well. According to the Direct Marketing Associate, 45.8 million adult Americans purchase $7.1 billion worth of goods and services yearly from so-called "legitimate" e-mail advertisements.⁸ But these "legitimate" emails have to battle for market space with far less welcome ones, including ones containing viruses or committing outright consumer fraud. Because so many e-mail users are getting fed up with unwanted spam, many have reduced their use of e-mail, and over half are now less trusting of all e-mail in general.⁹

The federal CAN-SPAM Act took effect this year to combat this problem. Although the Act doesn’t ban spam itself, it prohibits deceptive or misleading commercial e-mail and imposes requirements on senders of commercial e-mail. CAN-SPAM’s restrictions regarding commercial messages (defined as e-mails with the primary purpose of commercial advertisement or promotion of a product or service) are most relevant for businesses.¹⁰

CAN-SPAM prohibits a sender of commercial e-mail from using false information and deceptive subject lines. Senders must include a "From" line that accurately identifies the sender of the email and a valid physical postal address in each e-mail. Moreover, they may not use another person’s e-mail or computer account to send commercial e-mail. Senders must also clearly and conspicuously identify unsolicited commercial email as advertisements or solicitations, and must include a warning label on unsolicited commercial e-mail containing sexually oriented material. Each commercial e-mail must also contain a clear and conspicuous notice to recipients of their opportunity to unsubscribe from future mailings using a method which will remain operational for thirty days after the e-mail is sent. The sender must stop sending e-mails to recipients within ten business days after receiving an opt-out request. Finally, senders are prohibited from using automated means to harvest e-mail addresses from Web sites or online service providers that have policies of not sharing e-mail addresses, and cannot use automated means to register for multiple e-mail accounts to be used to send spam.

CAN-SPAM preempted the patchwork of existing state laws, replacing them with a national standard governing commercial e-mail. The CANSPAM Act permits enforcement only by certain federal agencies, states attorneys general, and providers of Internet access services, commonly called ISPs like AOL, Yahoo!, and Microsoft. However, the Act’s broad definition of an ISP may have opened the door to a new enforcement mechanism.¹¹ As one staff attorney for the FTC recently remarked, businesses providing Internet services to employees may qualify as ISPs under the Act and therefore have the right to sue spammers impinging upon those Internet services.¹²

This interpretation puts new teeth into the CAN-SPAM Act. Until now, CAN-SPAM’s influence on most businesses was thought to be limited to specifying requirements for commercial e-mail. This new interpretation means that any business providing Internet or e-mail access to its employees has a right to bring suit to enforce CAN-SPAM, collect damage awards, and seek injunctive relief. Instead of waiting for the government or a traditional ISP to sue, businesses may now be able to fight back and stem the tide of spam with their own lawsuits. This conclusion is also a cautionary tale for massmarketers. Businesses are no longer safe targets for spam, and mass marketers must redouble their efforts to comply with federal law.

Part of the motivation behind passing CANSPAM was to preempt California’s harsh antispam law, which would have allowed individuals to sue senders of commercial e-mail.¹³ And until now, everyone seemed to agree that CAN-SPAM did not contain a private right of action. Instead, only certain federal agencies, states, and ISPs could bring suit under the Act. However, recent comments by FTC staff attorney Michael Goodman suggest this might not be the case: the Act’s definition of ISPs could encompass any employer that provides Internet access and e-mail to its employees.¹⁴

The implications of this new interpretation are enormous. Most importantly, it creates a way for a host of businesses to sue to combat their spam problems. As it does so, however, it may also put senders of commercial e-mail at risk for liability from suits from any business qualifying as a provider of Internet access services under the Act.

The relevant portion of CAN-SPAM authorizes lawsuits by providers of Internet access services.¹⁵ Plaintiffs can sue both the senders of the e-mail as well as any business advertising in the offending messages. When sued under this provision, senders can be liable for each noncomplying e-mail sent to the tune of up to one hundred dollars per e-mail: an amount that can add up quickly if one piece of spam is sent to the entire employee directory or the spammer is a repeat offender. Although damages are generally capped at one million dollars, a court can increase that limit by up to three times if it decides the sender knowingly or willfully violated CAN-SPAM or engaged in certain aggravating activities. Additionally, a court may award reasonable attorneys’ fees to a prevailing plaintiff.

FTC staff attorney Michael Goodman explained that an employer providing e-mail and other Internet capabilities to its employees could qualify to sue under CAN-SPAM.¹⁶ The Act allows providers of "Internet access service adversely affected by a violation" of the Act to bring a civil action against the sender. "Internet Access Service" is defined to mean "a service that enables users to access content, information, electronic mail, or other services offered over the Internet, and may also include access to proprietary content, information, and other services as part of a package of services offered to consumers." As Goodman noted, this definition arguably encompasses activities of most employers that provide their employees with Internet access and e-mail services, meaning the right to bring a suit extends to them as well as the traditional ISPs like AOL, Microsoft, etc.

However, the Act is not all good news for businesses, even with this new interpretation of who can sue. If businesses enjoy expanded rights of action under CAN-SPAM, the other side of the coin is that senders of commercial e-mail may be at risk for millions of dollars in damages. The same businesses who were once thought to be safe targets for spam, may now be equipped to fight back. A single email sent to each employee of a 10,000 person firm could trigger a million dollar lawsuit from the internet-providing firm now inundated with spam (10,000 emails x $100/violation = $1,000,000).

A single mass marketing campaign in violation of the Act could literally bankrupt a business. A good example of this effect can been seen with another federal law governing mass marketing. The Telephone Consumer Protect Act, or TPCA, contains a provision barring unsolicited fax advertisements, commonly called "junk faxes."¹⁷ This provision attracted little attention at first, but recently, the law has spawned multi-million dollar damage awards.¹⁸ Courts allowing plaintiffs to bring class action lawsuits against advertisers and damages multiplied by each fax sent quickly multiply the verdicts to the point of forcing some business to declare bankruptcy.¹⁹ Indeed, a plaintiff recently sued to recover an astonishing 2.2 trillion dollars against a single fax marketer!²⁰ Like the junk fax law, CAN-SPAM provides damages for each infringing e-mail. The damages are capped at one million dollars, but with the number of potential plaintiffs expanded to cover most businesses, a number of lawsuits by different plaintiffs, or a class action by a group of ISPs, could threaten to take down even a large corporation.

Fortunately, there are three fundamental steps businesses can take to better ensure compliance with CAN-SPAM and avoid liability.²¹ First, businesses should develop a company-wide email marketing policy and put it in writing. This best-practices manual should be formally provided to both employees as well as all vendors that send e-mail on the company’s behalf. A company is liable for acts of those outside vendors if it knows they are using spam to promote the company, if those vendors are getting paid for doing so and, if despite its knowledge, the company does not takes reasonable steps to prevent the spam or report it to the FTC.

Second, businesses should database all their opt-outs. Companies should require employees and outside vendors to maintain a list of consumers who have unsubscribed, and understand that both the business and outside vendors are responsible for honoring each other’s opt-out lists. Therefore, companies should adopt appropriate contract provisions to ensure that both parties do just that.

Third, businesses should obtain guarantees when purchasing or renting mailing lists. CANSPAM’s prohibition on harvesting e-mail addresses has led to confusion about e-mail lists from third parties. The Act doesn’t prohibit the commonplace buying and selling of lists to expand target recipients, but all the Act’s other requirements (and penalties) will still apply to commercial e-mail sent from such lists. In other words, if you’ve bought it, you’re responsible for it. As a result, businesses should seek guarantees and warranties from the list providers, with their full assurance that they’re in compliance — and indemnifying the company if they are not. List providers should formally stipulate their lists weren’t created by means that violate the Act, that all recipients have been given clear and conspicuous notice that their e-mail addresses can be shared, and that none of the recipients has opted out. Although even with these guarantees, companies can still be liable for CANSPAM Act violations, the guarantees provides some measure of recourse and shows good faith on the part of the business to comply with CANSPAM.

Spam is a fact of life for the modern business, but the CAN-SPAM Act may provide companies with a method to stem the tide of junk e-mail, and recover some compensation for their spamfighting efforts in the process. With these new rights to bring suit comes an additional need for business to protect themselves from expanded liability by carefully complying with the law’s regulations and reviewing their marketing practices.

Jon Stock is an attorney with Jones Day who has substantial experience with mass-marketing litigation under the Telephone Consumer Protection Act, 47 U.S.C. § 227, including several class action defenses and appearances before the United States Supreme Court and the United States Court of Appeals for the Eighth Circuit. Jon would like to give special thanks to Joshua A.T. Fairfield of Columbia University and Erin Gallagher of Notre Dame for their substantial contributions and insights that enabled this article to come to fruition.

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.