Anti-Spam Law in the United States

Anti-spam laws and regulations in the U.S. are intended to the public unwanted spam emails. Any person or company that sends emails in connection with their business must be sure to comply with these laws. In the United States, both federal and state law can apply to any given human activity, but for the most part, email marketing is regulated in the U.S. by an exclusive federal regulatory framework.

In general, the thrust of the relevant federal regulations are as follows: (1) promotional emails must be clearly marked as advertisements, (2) recipients must be able to unsubscribe from the email list, and (3) the content of the emails, including headers and subject lines must be accurate and must not be deceptive.

Federal Law – the CAN-SPAM Act

The Federal Trade Commission regulates and enforces the CAN-SPAM Act. In contrast to European regulations, the Act implements an “opt-out” regime (rather than one under which email recipients must opt-in. Accordingly, companies promoting goods or services by email are not required to receive consent prior to sending commercial messages.

The law doesn’t apply to just bulk emails—despite the reference to “spam” in its title. Rather, it applies to all “commercial” messages, which the Act defines as “any electronic mail message the primary purpose of which is the commercial advertisement or promotion of a commercial product or service.”

There is no exception for B2B promotional emails. That said, regulatory enforcers are probably more likely to focus on non-compliant practices the greater impact they have on consumers at large.  Each violation—meaning each individual non-compliant email—is subject to a penalty of up to $51,744.

As noted above, the Act’s requirements apply to “commercial” messages, but not to “transactional or relationship content,” which is content that facilitates an already agreed-upon transaction or updates a customer about an ongoing transaction. If an email contains mixed commercial and transaction or relationship (or other) content, the primary purpose of the message is the deciding factor in determining whether the Act’s requirements apply.

The FTC’s website describes the Act’s key requirements as follows (summarized):

1. Routing information and original domain and email addresses must be accurate and identify the initiating business or person.
2. Subject lines must not be deceptive and should accurately describe the email’s content.
3. “Commercial” messages must be identified as ads. There is leeway on how to do this but your message should clearly disclose that it is an advertisement.
4. Messages must include your valid physical postal address, whether a street address, a post office box, or a registered private mailbox.
5. Clear and notable opt-out, or “unsubscribe” instructions must be included, allowing recipients to write an email stopping marketing messages or by an automated methodology.
6. The right to opt-out applies to “commercial” messages sent to subscribers and recipients in membership programs, but not to “transactional or relationship” messages.
7. Opt-out requests must be processed gratuitously, via a simple process, within 10 days of their receipt and opt-out mechanisms must remain valid for at least 30 days after transmission of the message. Honoring opt-out requests means you can’t sell or transfer their email addresses, even in the form of a mailing list (except transfers for compliance purposes).
8. Senders of commercial messages cannot offload public liability by way of contract. Both the company promoting the product and any third-party marketer can be held liable.

The FTC has published a useful compliance guide here: CAN-SPAM Act: A Compliance Guide for Business | Federal Trade Commission (ftc.gov)

The CAN-SPAM Act & State Laws

Several states have laws on the books that regulate commercial emails, and many of them contain similar requirements to the CAN-SPAM. At least some of those laws contain requirements that are more restrictive than the CAN-SPAM Act.  For instance, Chapter 321 of the Texas Business & Commerce Code requires unsolicited commercial electronic mail messages to include the letters “ADV” first in the subject line. Further, the Texas statute requires opt-out requests to be honored not later than the third day after a request for removal.

Fortunately for firms that use email marketing, complying with a web of diverse state laws that might be more restrictive than federal law is not a concern: the CAN-SPAM Act preempts inconsistent state laws that address the same subject matter. However, the CAN-SPAM Act does not apply to all state laws that apply to marketing emails. For example, state laws that prohibit deceptive or fraudulent email messages are not preempted and laws that apply to other types of activity but also apply to commercial email messages may not be preempted.

As a specific example of a state law that can apply to a company’s email marketing activity, we can look to the California Consumer Privacy Act (as amended by the CPRA, the “CCPA”). For instance, the CCPA requires that companies subject to the CCPA disclose in an online privacy policy all of the purposes for which they collect information from California residents. If one of those reasons is to send marketing emails to residents from whom “personal information” is collected, a company’s privacy policy should disclose that fact.

Companies should take note that several U.S. states are implementing statutes modeled on California’s CCPA. Previously, I wrote about the CCPA and the growing body of related state laws here: A Wave of New Data Privacy Laws: Should You Update your Privacy Policies and Practices? – Freeman Law.