CAN-SPAM Legislation

CAN-SPAM is the 2003 law that governs email marketing. Bruce Clay, Inc. does not give legal advice, but we can present some highlights of the law as we understand it. For openers, it is important to know the difference between "transactional" and "commercial" email. You must also be familiar with some of the key terms used in the law.

Transactional Email

A transactional email facilitates or confirms a commercial transaction initiated by the recipient. It can provide warranty, security or recall information for a product purchased or used by the recipient. It can provide notice of change in terms, status or account information regarding ongoing purchase or use by the recipient of a product or service offered by the sender. It can provide information related to employment relationship or about a benefit plan of which the recipient is a member. It can provide delivery updates or upgrades that are a part of a transaction the recipient earlier agreed to.

Commercial Email

A commercial email is any electronic message that contains an advertisement or promotes a product or service.

Key Terms

Initiator — The initiator originates, transmits or procures the origination or transmission of a message.

Sender — The sender is an initiator whose product, service or website is advertised or promoted by the message.

Affirmative consent — You have affirmative consent when a recipient expresses consent to receive a message either in response to a clear and conspicuous request for such consent, or at the recipient's own initiative.

First, determine three basic facts: Is the email non-commercial? Is it transactional? Do you have affirmative consent?

If you determine that the email is non-commercial, then CAN-SPAM does not apply.

If the email is commercial, then determine if it is transactional. If it is transactional, you must avoid false or misleading headers. You must identify an initiator in the "from" line. You must avoid use of spoofing or other means to disguise origin. If your email is not transactional, you should determine whether or not you have affirmative consent. If you have affirmative consent, in addition to all the above, you must avoid false or misleading subject lines. You must have a clear, conspicuous and functional opt-out mechanism. You must comply with opt-outs within 10 business days. You must ensure that opt-out addresses are not sold or exchanged. You must include the sender's valid physical postal address. You must avoid using email addresses generated randomly or by "scraping."

If you do not have affirmative consent, in addition to all of the above, you must also show clear and conspicuous identification that the message is an advertisement or a solicitation.

CAN-SPAM ToDo List

You must add a physical address to all mailings. While not specified in the law, many experts advise against using a PO Box address.

If your mailing list does not meet the definition of affirmative consent, you must add a notice that your message is an advertisement or solicitation. This notice should be clear and conspicuous.

Review each mailing to ensure your opt-out mechanism is clear and conspicuous. Test to ensure it is functional.

Review your opt-out process to ensure opt-outs are handled within the 10-day limit.

Review your opt-out process to ensure you provide a global out-out that covers email from the entire company.

Watch out if you use a passive opt-in process where a pre-checked box is not conspicuous. The legal requirement is "clear and conspicuous consent."

If you rent or borrow lists, you must notify the list owner of opt-outs in a timely manner.

You must have a documented email governance policy in place. Create a policy and training program to ensure all involved parties know their obligations. This protects the firm if someone is charged with an unintentional violation of the law.