Complying with recent federal spam legislation.

In response to the enormous proliferation of unsolicited commercial e-mail ("UCE" or "spam") in recent years--spam currently makes up over half of all e-mail traffic--the federal government and most states have enacted legislation aimed at controlling unwanted electronic e-mail. If you or your business transmits commercial e-mail, it may be time to review your practices and policies concerning (1) collection of e-mail addresses, (2) the content included in your commercial e-mails and (3) the method by which you transmit commercial e-mail.

As of today, at least 36 states have enacted laws governing the transmission of spare, each of which could govern the transmission of your Company's commercial e-mail if any recipient of the commercial e-mail is located in those states. In addition, effective as of January, 1, 2004, the federal government passed a comprehensive anti-spam law called "Controlling the Assault of Non-Solicited Pornography and Marketing Act of 2003", known as "CAN-SPAM." While CAN-SPAM is considerably narrower than many state spam laws, by its terms, CAN-SPAM replaces and preempts state and other laws, regulations and rules that "expressly regulate commercial e-mail, except to the extent any such statute, regulation, or rule prohibits falsity or deception in any portion of a commercial electronic mail message or information attached thereto." Thus, it is important to note that while CAN-SPAM preempts significant portions of existing state spam legislation, certain aspects of existing state and other laws and regulations dealing with spam continue to apply.

What is Covered by CAN-SPAM

CAN-SPAM applies to any electronic mail message whose primary purpose is "the commercial advertisement or promotion of a commercial product or service." However, the statute provides that "commercial e-mail" excludes e-mail messages that have a "transaction or relationship message," meaning e-mails with a primary purpose of relaying information concerning a specific transaction between the sender and the recipient.

CAN-SPAM does not ban all unsolicited commercial e-mail. Generally speaking, CANSPAM permits the sending of UCE that (1) does not contain deceptive, false or misleading information including, but not limited to, the header, the originating domain name, the e-mail address and other routing information and subject heading; (2) enables a person to identify, locate and respond to the sender; (3) unless there has been prior "affirmative consent" to receiving the e-mail, contains a "clear and conspicuous" identification of the nature of the message (i.e., that it is an advertisement or solicitation or, if applicable, a warning that it contains sexually oriented content); (4) provides a "clear and conspicuous notice" of the opportunity for the recipient to "opt-out" of receiving further messages (which the sender must honor by removing the recipient's e-mail address from sender's list within 10 days of any request to op-out); (5) contains sender's physical address and a return e-mail address that is functional for at least 30 days from the day the message is sent.

For the purpose of CAN-SPAM, "affirmative consent" means that the recipient expressly consented to receive the message at the recipient's own initiative or in response to a clear and conspicuous request for the consent, including, if applicable, a clear and conspicuous notice that the recipient's e-mail address could be given to a third-party for sending commercial e-mail. This requirement puts the common practice of the "opt-out" or "negative opt-in" (not unchecking the box that says you want spam) in question.

General Guidelines for Sending Spare CAN-SPAM is still new and it is difficult to determine what, if any, state spare law provisions continue to apply that are not already encompassed by CAN-SPAM. In addition, the parameters of the law and how it will be interpreted remain quite uncertain. For example, with respect to the requirement of "affirmative consent," CAN-SPAM does not provide guidance on what constitutes "express" consent, what requirements are sufficient for a request for such consent to be deemed "clear and conspicuous" or how long such affirmative consent remains valid. Over the next two years, the Federal Trade Commission is charged with clarifying some of the law's key terms.

In light of this uncertainty, we recommend taking the following precautions to help your Company comply with CAN-SPAM and other spare laws when transmitting commercial e-mails:

* Collecting E-mails

Practices concerning transmission of commercial e-mail should comply with your Privacy Policy or any other policy or notice posted on your Website For example, do not use e-mail addresses that you collect from your Website for sending spare if your Website posts a policy that it will not use your e-mail address for the purpose of sending spare.

* If you collect e-mails from users as part of a registration process on your Website, include very, clear "affirmative consent" language permitting e-mail marketing of your Company (and, if applicable, from your partners). We strongly recommend that the "affirmative consent" language requires the user/registrant to "opt-in" (affirmatively checks a box) to receiving such e-mails.

* Do not provide your e-mail address list to a third-party without (a) giving notice to (and preferably getting consent from) the (e-mail address holders and (ii) affording the e-mail address holders with an opportunity to opt-out.

* If you acquire e-mail address lists from third-parties, confirm that they were obtained in compliance with CAN SPAM.

Transmission of UCE

* Do not engage in automated creation of multiple e-mail accounts, such as by use of scripts, from which to send spam.

* Do not knowingly transmit through unauthorized access of computers or networks commercial e-mail that violates any of CAN-SPAM's requirements.

Content of UCE

* The commercial e-mails should include a simple opt-out procedure (with clear instructions).

* Maintain a procedure for your employees to comply with opt-out requests within 10 days of such request.

* If you share your list with a third-party or if a third-party markets your products for you via commercial e-mail, make sure that they comply with CAN-SPAM.

* Your commercial e-mail should clearly identify your Company as the sender of the email.

* Your commercial e-mail should have an accurate subject heading. Although not required by CAN-SPAM, we recommend using the "ADV" label to identify it as an advertisement.

* Include your Company address in the email message.

CAN-SPAM covers a number of different types of activities, some of which are not covered in this article. The purpose of this article is not to provide a comprehensive legal analysis of CAN-SPAM, but rather to provide a general outline for you to consult to help your business comply with CAN-SPAM. For a comprehensive analysis of CAN-SPAM and aspects of state spam laws that may be applicable to your business you should consult legal counsel.

By Mark Dancsecs, an attorney in our Intellectual Property and Technology Department. The firm is Greenberg Glusker. Learn more at www.ggfirm.com.