Definitions, Implementation, and Reporting Requirements Under the CAN-SPAM Act

Federal RegisterMay 12, 2005

Ask Donna

What actually matters in this document.

Text

FEDERAL TRADE COMMISSION

16 CFR Part 316

[Project No. R411008]

RIN 3084-AA96

Definitions, Implementation, and Reporting Requirements Under the CAN-SPAM Act

AGENCY:

Federal Trade Commission (FTC).

ACTION:

Notice of Proposed Rulemaking; request for public comment.

SUMMARY:

In this document, the Federal Trade Commission (“Commission” or “FTC”) proposes rules pursuant to several distinct provisions of the Controlling the Assault of Non-Solicited Pornography and Marketing Act of 2003 (“CAN-SPAM” or “the Act”). Specifically, section 7702(17)(B) grants the FTC discretionary authority to prescribe rules modifying the Act's definition of “transactional or relationship message.” Section 7704(c)(1) authorizes the Commission to adopt a rule modifying the ten-business-day period senders (and those acting on their behalf) have under the Act to process recipients' “opt-out” requests with respect to “commercial electronic mail messages.” Section 7704(c)(2) authorizes the Commission to adopt a rule specifying activities or practices that would be considered “aggravated violations” by section 7704(b) of the Act, in addition to the aggravated violations already specified in the statute. Finally, section 7711(a) gives the FTC discretionary authority to “issue regulations to implement the provisions of [the] Act.”

This document invites written comments on issues raised by the proposed Rule and seeks answers to the specific questions set forth in Part VII of this NPRM.

DATES:

Written comments must be received by June 27, 2005.

ADDRESSES:

Interested parties are invited to submit written comments. Comments should refer to “CAN-SPAM Act Rulemaking, Project No. R411008” to facilitate the organization of comments. A comment filed in paper form should include this reference both in the text and on the envelope, and should be mailed to the following address: Federal Trade Commission, CAN-SPAM Act, Post Office Box 1030, Merrifield, VA 22116-1030. Please note that courier and overnight deliveries cannot be accepted at this address. Courier and overnight deliveries should be delivered to the following address: Federal Trade Commission/Office of the Secretary, Room H-159, 600 Pennsylvania Avenue, NW., Washington, DC 20580. Comments containing confidential material must be filed in paper form, must be clearly labeled “Confidential,” and must comply with Commission Rule 4.9(c), 16 CFR 4.9(c) (2005).

The comment must be accompanied by an explicit request for confidential treatment, including the factual and legal basis for the request, and must identify the specific portions of the comment to be withheld from the public record. The request will be granted or denied by the Commission's General Counsel, consistent with applicable law and the public interest.

See

Commission Rule 4.9(c), 16 CFR 4.9(c).

Comments filed in electronic form should be submitted by clicking on the following Weblink:

https://secure.commentworks.com/ftc-canspam/

and following the instructions on the Web-based form. To ensure that the Commission considers an electronic comment, you must file it on the Web-based form at

https://secure.commentworks.com/ftc-canspam/

Weblink. You may also visit

http://www.regulations.gov

to read this proposed Rule, and may file an electronic comment through that Web site. The Commission will consider all comments that regulations.gov forwards to it.

The FTC Act and other laws the Commission administers permit the collection of public comments to consider and use in this proceeding as appropriate. All timely and responsive public comments, whether filed in paper or electronic form, will be considered by the Commission, and will be available to the public on the FTC Web site, to the extent practicable, at

http://www.ftc.gov.

As a matter of discretion, the FTC makes every effort to remove home contact information for individuals from the public comments it receives before placing those comments on the FTC Web site. More information, including routine uses permitted by the Privacy Act, may be found in the FTC's privacy policy, at

http://www.ftc.gov/ftc/privacy.htm.

FOR FURTHER INFORMATION CONTACT:

Sana Coleman, Staff Attorney, (202) 326-2249; or Catherine Harrington-McBride, Staff Attorney, (202) 326-2452; Division of Marketing Practices, Bureau of Consumer Protection, Federal Trade Commission, 600 Pennsylvania Avenue, NW., Washington, DC 20580.

SUPPLEMENTARY INFORMATION:

I. Background

A. CAN-SPAM Act of 2003

On December 16, 2003, the President signed the CAN-SPAM Act into law.

The Act, which took effect on January 1, 2004, imposes a series of new requirements on the use of commercial electronic mail (“e-mail”) messages. In addition, the Act gives Federal civil and criminal enforcement authorities new tools to combat unsolicited commercial e-mail (“UCE” or “spam”). Moreover, the Act allows State attorneys general to enforce its civil provisions, and creates a private right of action for providers of Internet access services.

15 U.S.C. 7701-7713.

The Act also provides for FTC rulemaking on a number of topics. The Commission has already published final Rule provisions: (1) Governing the labeling of commercial e-mail containing sexually-oriented material,

and (2) establishing criteria for determining when the primary purpose of an e-mail message is commercial.

The current Notice addresses the Act's grant of discretionary authority for the Commission to issue regulations concerning certain of the Act's other definitions and provisions,

specifically, to:

69 FR 21024 (Apr. 19, 2004).

70 FR 3110 (Jan. 19, 2005).

The Act authorizes the Commission to use notice and comment rulemaking pursuant to the Administrative Procedures Act, 5 U.S.C. 553. 15 U.S.C. 7711.

• Expand or contract the definition of the term “transactional or relationship message” under the Act “to the extent that such modification is necessary to accommodate changes in electronic mail technology or practices and accomplish the purposes of [the] Act”

15 U.S.C. 7702(17)(B).

• Modify the ten-business-day period prescribed in the Act for honoring a recipient's opt-out request;

15 U.S.C. 7704(c)(1).

• Specify activities or practices as aggravated violations (in addition to those set forth as such in section 7704(b) of CAN-SPAM) “if the Commission determines that those activities or practices are contributing substantially to the proliferation of commercial electronic mail messages that are unlawful under subsection [7704(a) of the Act]'';

and

15 U.S.C. 7704(c)(2).

• “issue regulations to implement the provisions of this Act.”

15 U.S.C. 7711(a). This provision excludes from the scope of its general grant of rulemaking authority section 7703 of the Act (relating to criminal offenses) and section 7712 of the Act (expanding the scope of the Communications Act of 1934). In addition, section 7711(b) limits the general grant of rulemaking authority in section 7711(a) by specifying that the Commijssion may not use that authority to establish “a requirement pursuant to Section 7704(a)(5)(A) to include any specific words, characters, marks, or labels in a commercial electronic mail message, or to include the identification required by Section 7704(a)(5)(A)

* * * in any particular part of such a mail message (such as the subject line or body).”

B. Advance Notice of Proposed Rulemaking

On March 11, 2004, the Commission published an Advance Notice of Proposed Rulemaking (“ANPR”) which solicited comments on a number of issues raised by the CAN-SPAM Act, most importantly, the interpretation of “primary purpose.” In addition, the ANPR requested comment on the modification of the definition of “transactional or relationship message,” on the appropriateness of the ten-business-day opt-out period that had been set by the Act, on additional aggravated violations that might be appropriate, and on implementation of the Act's provisions generally.

The ANPR set a date of April 12, 2004, by which to submit comments. In response to petitions from several trade associations, the Commission announced on April 7 that it would extend the comment period to April 20, 2004.

69 FR 11776 (Mar. 11, 2004). The ANPR also solicited comment on questions related to four Commission reports required to be submitted to Congress: a report on establishing a “Do Not E-mail” Registry, submitted on June 15, 2004; a report on establishing a system for rewarding those who supply information about CAN-SPAM violations, submitted on September 16, 2004; a report setting forth a plan for requiring commercial e-mail to be identifiable from its subject line, to be submitted by June 16, 2005; and a report on the effectiveness of CAN-SPAM, to be submitted by December 16, 2005. The comments related to the “Do Not E-mail” Registry are discussed in the Commission's June 15, 2004, Report, and comments related to the informant reward system are discussed in the September 16, 2004, Report. The Commission will consider the relevant comments received in response to the ANPR in preparing the remaining reports.

69 FR 18851 (Apr. 9, 2004). The associations seeking additional time were the Direct Marketing Association, the American Association of Advertising Agencies, the Association of National Advertisers, the Consumer Bankers Association, and the Magazine Publishers of America. The associations indicated that an extension was necessary because of the religious holidays and the need to consult more fully with their memberships to prepare complete responses.

In response to the ANPR, the Commission received approximately 13,517 comments from representatives of a broad spectrum of the online commerce industry, trade associations, individual consumers, and consumer and privacy advocates.

Commenters generally applauded CAN-SPAM as an effort to stem the flood of unsolicited and deceptive commercial e-mail that has threatened the convenience and efficiency of online commerce. Commenters also offered several suggestions for the Commission's consideration in drafting regulations to implement the Act.

This figure includes comments received on the “Do Not E-mail” Registry, which had a comment period that ended March 31, 2004. Appendix A is a list of commenters who submitted a comment in response to the ANPR cited in this NPRM. Appendix A also provides the acronyms used to identify each commente in this NPRM. A full list of commenters, as well as a complete record of this proceeding, may be found on the Commissioner's Web site:

http://www.ftc.gov/os/comments/conspan/index.htm.

C. Notice of Proposed Rulemaking on CAN-SPAM Issues Other Than the “Primary Purpose” of an E-mail Message

Based on the comments received in response to the ANPR, as well as the Commission's law enforcement experience, in this NPRM the Commission proposes rule provisions on five broad topics: (1) Defining the term “person” (in Part II.A.1.); (2) limiting the definition of “sender” to address scenarios where a single e-mail message contains advertisements from multiple entities (in Part II A. 2.); (3) clarifying that Post Office boxes and private mailboxes established pursuant to United States Postal Service regulations are “valid physical postal addresses” (in Part II.A.4.); (4) shortening the time a sender has to honor a recipient's opt-out request (in Part II. B.); and (5) clarifying that a recipient may not be required to pay a fee, provide information other than his or her e-mail address and opt-out preferences, or take any steps other than sending a reply e-mail message or visiting a single Internet Web page to submit a valid opt-out request (in Part II. C.).

In Part II of this NPRM, each of these proposed provisions is discussed, section by section. Other topics are also discussed, in response to issues raised in comments responding to the ANPR, regarding CAN-SPAM's definition of “transactional or relationship message” (in Part II.A.3.), and the Commission's views on how CAN-SPAM applies to certain e-mail marketing practices, including “forward-to-a-friend” e-mail marketing campaigns (in Part II.A.5.), even though the Commission does not propose rule provisions addressing those practices. Finally, in Part II.D., the Commission discusses its determination not to designate additional “aggravated violations” under section 7704(c)(2).

In addition to proposing several new Rule provisions, this NPRM proposes to renumber certain Rule provisions that were previously adopted. 69 FR 21024 (Apr. 19, 2004); 70 FR 3110 (Jan. 19, 2005). The Commission proposes no other substantive changes to the previously-adopted Rule provisions. The Sexually Explicit Labeling Rule provisions, which were found at 316.4 in the January 19, 2005,

Federal Register

Notice's final Rule, are at 316.6 in the proposed Rule presented in this NPRM. The severability provision, which was 316.5, is now 316.7. The new 316.4 proposes a modification to the amount of time senders (and those acting on their behalf) have to process recipients' opt-out requests. The new 316.5 proposes to regulate how opt-out mechanisms in commercial e-mail messages may work. Sections 316.1, 316.2, and 316.3 (regarding scope, definitions, and “primary purpose” criteria respectively) retain their numbering from the January 19, 2005,

Federal Register

Notice.

The Commission invites written comment on the questions in Part VII to assist the Commission in determining whether the proposed Rule provisions strike an appropriate balance, maximizing protections for e-mail recipients while avoiding the imposition of unnecessary compliance burdens on law-abiding industry members.

The August 13, 2004, NPRM was limited to the Commission's proposal for criteria to facilitate the determination of the primary purpose of an electronic mail message, 69 FR 50091. These criteria were finalized in a January 19, 2005,

Federal Register

Notice, and have been adopted as 16 CFR 316.3.

See

70 FR 3110. Nevertheless, many comments submitted in response to that NPRM addressed issues other than “primary purpose” that were not raised in the August 13, 2004, NPRM, but are addressed in the instant NPRM. The Commission will consider comments relevant to discretionary rulemaking issues that were submitted in response to the August 13, 2004, NPRM. Commenters are advised, however, that the instant NPRM proposes rule provisions and seeks comment relevant to the discretionary rulemaking topics. Commenters wishing to respond to this NPRM's proposals and requests for comment should take advantage of this current public comment opportunity.

II. Analysis of Comments and Discussion of the Proposed Rule

A. Section 316.2—Definitions

Section 316.2—one of the Rule provisions previously adopted under CAN-SPAM—defines thirteen terms by reference to the corresponding sections of the Act that define those terms.

This NPRM does

not

reopen the rulemaking process for twelve of these definitions. This NPRM, however, does propose adding a proviso to the previously-adopted definition of “sender.” This NPRM also proposes adding definitions of “person” and “valid physical postal address.” These proposed definitional provisions were not part of the earlier rulemaking proceedings, but are discussed and explained in the sections that follow. (Parts II.A.1, 2 and 4.) This discussion of definitions also covers, in Part II.A.3 and 5, why the Commission is not proposing any change to the Act's definition of “transactional or relationship message” and how CAN-SPAM applies to “forward-to-a-friend” e-mail campaigns.

See

16 CFR 316.2; 69 FR 2104 (Apr. 19, 2004); 70 FR 3110 (Jan. 19, 2005).

1. Section 316.2(h)—Definition of “Person''

The term “person” appears throughout CAN-SPAM,

and is also used in a number of Rule provisions. The Commission proposes to add a definition of this term under authority granted in section 7711 of the Act, which empowers the Commission to “issue regulations to implement the provisions of this Act.” The Commission believes that making it clear that the term “person” is broadly construed, and is not limited solely to a natural person, will advance the implementation of the Act. The proposed definition tracks the definition of the term included in the Telemarketing Sales Rule, 16 CFR 310.2(v): “an individual, group, unincorporated association, limited or general partnership, corporation, or other business entity.”

See, e.g.,

15 U.S.C. 7702(8), (12), (15), (16); 7704(a)(1), (2) and (3).

2. Section 316.2(m)—Definition of “Sender”

Section 7702(16)(A) of the Act defines “sender” as “a person who initiates [a commercial electronic mail] message and whose product, service, or Internet Web site is advertised or promoted by the message.”

The definitional provisions that the Commission has already adopted under CAN-SPAM

incorporate by reference the Act's definition of “sender.” Many commenters urged that this definition be modified to provide that when more than one person's products or services are advertised or promoted in a single e-mail message there would be only one sender of a message for purposes of the Act.

In response to these comments, the Commission proposes in 316.2(m) to set out the criteria for identifying the “sender” in that situation. The Commission proposes this clarification pursuant to its discretionary rulemaking authority to “issue regulations to implement the provisions of this Act.”

Implementation of the Act requires clarity with respect to who is the “sender” of a commercial e-mail message because the “sender” is obligated under the Act to honor any opt-out requests. Moreover, the sender, as the initiator of a commercial e-mail message, is also obligated to provide a functioning return e-mail address or other Internet-based opt-out mechanism and provide a valid physical postal address of the sender.

Therefore, the proposed definition is:

15 U.S.C. 7702(16)(A).

16 CFR 316.2(m).

The ANPR asked whether it would be helpful to clarify the obligations of the parties when more than one seller's products or services are advertised in a message. The responders to the ANPR's web-based questionnaire overwhelmingly supported clarifying the obligations of multiple senders—seventy-seven percent of responders favored clarifying the obligations and eighty-two percent supported having the Commission issue regulations clarifying who meets the definition of “sender.” Commenters who submitted written comments also strongly supported clarification.

See

e.g.

, ABA; IAC; Moerlien; PMA; USTOA; and Visa. Nevertheless, some commenters opined that e-mail messages may have multiple senders and that each should comply with the opt-out requirements.

See

e.g.

, ABM at 6-7 (“[E]ach business whose products are advertised should be considered a sender of the e-mail * * * provided that they are truly ‘initiators’ and that a reasonable recipient would perceive each of the businesses equally as a sender of the mail.”) ABM proposed a drop-down menu from which recipients could choose whether to opt-out from future commercial e-mail from all, one, or several senders.

See also

ERA; Time Warner (joint marketing effort where two or more companies send out joint e-mail messages).

15 U.S.C. 7711(a).

15 U.S.C. 7704(a)(3), (a)(4), and (a)(5).

The definition of the term “sender” is the same as the definition of that term in the CAN-SPAM Act, 15 U.S.C. 7702(16),

provided that

, when more than one person's products or services are advertised or promoted in a single electronic mail message, each such person who is within the Act's definition will be deemed to be a “sender,”

except that

, if only one such person both is within the Act's definition and meets one or more of the criteria set forth below, only that person will be deemed to be the “sender” of that message:

(i) The person controls the content of such message;

(ii) The person determines the electronic mail addresses to which such message is sent; or

(iii) The person is identified in the “from” line as the sender of the message.

Under this proposal, only one of several persons whose products or services are advertised or promoted in an e-mail message would be the “sender” if the person initiated the message

and

was the only person who controlled the content of the message, determined the e-mail addresses to which it would be sent, or was identified in the “from” line as the sender.

If no one person who meets the Act's definition of “sender” satisfies the latter part of this proposed definition (

i.e.

, if no one person controls the content of the message, determines the e-mail addresses to which the message would be sent, or is identified in the “from” line as the sender), then all persons who satisfy the definition will be considered senders for purposes of CAN-SPAM compliance obligations.

This proposed definition does not eliminate the possibility that a message may have more than one “sender.” However, advertisers can use the criteria set forth in the proposed definition to establish a single sender and avoid a multiple-sender situation. If advertisers fail to structure the message to avoid multiple senders under the proposed definition, then each sender is obligated to comply with CAN-SPAM requirements, notably, to provide an Internet-based opt-out mechanism and a valid physical postal address, and to honor any opt-out requests.

A hypothetical example can illustrate this proposal. If X, Y, and Z are sellers who satisfy the Act's “sender” definition, and they designate X to be the single “sender” under the Commission's proposal,

among the three sellers

, only X may control the message's content, control its recipient list, or appear in its “from” line. X need

not

satisfy

all three

of these criteria, but

no other seller

may satisfy

any

of them. The sellers may use third parties to be responsible for any criteria not satisfied by X. For example, if X appears in the “from” line, the sellers may use third parties—but

not

Y or Z—to control the message's content and recipient list.

a. Comments on the Definition of “Sender”

The Act's definition is clear with respect to a scenario where a person tries to hide his identity or escape responsibility by having someone else send commercial e-mail on his behalf. Indeed, the legislative history indicates an intent that the definition of “sender” reach any entity that either sends its own e-mail messages or contracts with one or more third parties

to transmit messages on its behalf.

The Senate Report states:

This would include arrangements where numerous so-called “affiliates” are induced to send commercial e-mail messages on behalf of a seller to drive traffic to the seller's Web site, and the affiliates are paid based on the number of individuals who ultimately purchase the seller's product or service, or visit the operator's Web site through referral from the affiliate.

See

e.g.

, Bankers; IAC; Microsoft.

Thus, if one company hires another to coordinate an e-mail marketing campaign on its behalf, only the first company is the sender, because the second company's product is not advertised by the message. If the second company in this example, however, originates or transmits e-mail on behalf of the first company, then * * * both companies would be considered to have “initiated” the e-mail, even though only the first company is considered to be the “sender.”

S. Rep. No. 108-102, at 16 (2003).

However, commenters argued strongly that the Act's definition is unclear when applied to more complex marketing arrangements involving multiple advertisers and e-mail service providers.

Several commenters claimed to find support in the Act and its legislative

history for the theory that CAN-SPAM provides for only one sender. For example, IAC, MBNA, and Microsoft pointed out that the statute, throughout, refers to a singular entity: “the sender” or “that sender.”

By comparison, CAN-SPAM's definition of “initiate” expressly provides that more than one person may

initiate

a message.

These commenters also noted that the Senate Report cited immediately above refers exclusively to messages with one sender.

The Commission is not persuaded by these arguments. The Act's definitions of “initiate” and “sender” are intertwined and must be read together. Every “sender” must also satisfy the “initiate” definition, so the Act's provision for multiple initiators can apply to multiple senders as well. Moreover, based on the Senate Report excerpt cited above, the Commission believes that CAN-SPAM's drafters apparently had only one scenario in mind—a single seller hiring a third party to transmit messages on its behalf. It is not uncommon, however, for a particular commercial e-mail message to include promotions or advertisements from more than one seller. Under the Act's definition of “sender,” each advertiser in an e-mail message may be a “sender” of the message because each: (1) “Initiates” the message

(

i.e.

, has “procured” the initiation of the message by paying, providing consideration to, or inducing another person to initiate the message on its behalf);

and (2) has products or services that are promoted or advertised in the message.

See

e.g.

, 15 U.S.C. 7704(a)(3), 7704(a)(5), 7702(17)(a).

See

15 U.S.C. 7702(9).

IAC; MBNA; Microsoft.

See

S. Rep. No. 108-102.

15 U.S.C. 7702(9).

15 U.S.C. 7702(12).

15 U.S.C. 7702(16)(A).

Responding to the possibility that multiple senders in a single message may have to comply independently with CAN-SPAM, commenters claimed that implementation of the Act may be impeded in single message/multiple advertiser scenarios because of four significant problems the commenters identified regarding a regime that holds more than one party responsible for being the sender of a single e-mail: the difficulty of providing multiple opt-out mechanisms and valid physical postal addresses in a single message; the burden of maintaining multiple suppression lists; the possible violation of privacy policies and statutes; and frustration of consumer expectations. Each of these problems is discussed below.

First, commenters argued that if the law holds more than one party responsible for being “senders” of a single e-mail message, the message would have to contain a welter of opt-out mechanisms and physical postal addresses, likely resulting in consumer confusion.

See

e.g.

, Bankers; DMA; ERA; IAC; MPAA; Microsoft; PMA; Time Warner.

Second, commenters argued that treating each advertiser in an e-mail as a “sender” would require multiple suppression lists—

i.e.

, when a list owner advertises its products in an e-mail, along with advertisements of other companies, the list owner and each advertiser would have to add each person that opts out to their “suppression” lists and check each list against those of each of the others before sending additional messages.

Commenters argued that this result would add unnecessary administrative costs and complexity for legitimate e-mail marketers.

A list owner would have to develop a mechanism for receiving suppression lists from every advertiser with which it deals, and for comparing its own mailing list against multiple suppression lists for each message it sends.

In addition, a list owner would have to develop a mechanism for managing multiple opt-outs,

i.e.

, ensuring that the consumer can opt out from each advertiser and that all opt-outs sent to the list owner are forwarded to the advertisers from whom the consumer no longer wishes to receive commercial e-mail.

Commenters therefore argued that multiple suppression lists would increase costs and time delays.

Commenters also noted that, in the case of online newsletters or similar publications, the need for multiple suppression lists could endanger the existence of such newsletters because it would be impossible to create a different newsletter tailored for each recipient, containing only advertisements for companies to which that recipient had not sent an opt-out request.

In this regard, some commenters indicated that requiring multiple suppression lists also would threaten the type of joint marketing arrangements that are common in industry and chill electronic commerce.

Id.

See, E.g.,

Bankers; ASTA; DMA; MPAA; Microsoft; SBA pointed out that this would be particularly injurious to small businesses.

See, e.g.,

DMA; ERA; Microsoft; PMA.

See, e.g.,

Microsoft.

See, e.g.,

Bankers; DMA; ERA; MPAA; Microsoft.

See, e.g.,

NAA; OPA; Time Warner.

See, e.g.,

NAA; Time Warner.

Third, commenters contended that the need for multiple suppression lists leads to another problem with treating each advertiser as a “sender”: Multiple suppression lists could force a business to divulge customer names to list owners and other advertisers, even when the business has promised to protect that information under its privacy policy.

In addition to contravening privacy policies, a requirement to check names against multiple lists would necessitate passing lists back and forth among several parties, increasing the risk that consumers' private information may be shared with inappropriate entities, or subjected to greater vulnerability from hackers.

See, e.g.,

Bankers; ASTA; ACB; DMA; IAC; MPA; Microsoft; Time Warner. Of course, to the extent permitted by law, an advertiser could change its privacy policy to reflect the need to share opt-out information with other advertisers. Such a change, however, would not necessarily be in the bets interests of consumers who do not want their e-mail addresses shared among third parties.

See, e.g.,

DMA; IAC; MPAA; Microsoft; Time Warner.

Fourth, some commenters stated that, in some situations at least, a requirement that each separate advertiser in a single e-mail message be treated as a separate sender would run counter to consumer expectations.

Commenters noted that, when consumers have subscribed to an online newsletter or similar service, they would expect to submit an opt-out request to that newsletter publisher, not to each advertiser in the newsletter.

In other words, consumers would expect to send an opt-out request to the party with whom they have previously done business, and to whom they have provided affirmative consent to receive e-mails, not to advertisers that may be included in that party's message.

ABM; DMA; Time Warner.

AMB; Microsoft; Midway; Time Warner.

See, e.g.,

Time Warner. Arguments regarding consumers' opt-out expectations are complicated by the fact that, in some situations, the party to whom consumers would expect to submit an opt-out request would not be a “sender” under the Act. For example, commenters raised the case of an e-mail address list owner who sends commercial messages on behalf of others but does not advertise any products or services of its own.

See, e.g.,

IAC; Microsoft (also arguing that the Act's regulation of this arrangement decreases consumer choice and control). If consumers have asked the list owner to send them commercial messages, they may expect to be able to opt out of that party's messages. This party would not be a “sender” under the Act and thus would not have to honor opt-out requests if its own products or services are not advertised in the message. List owners who send messages on a seller's behalf, however, may satisfy the Act's “initiate” definition. 15 U.S.C. 7702(9). Persons

who “initiate” commercial e-mail must comply with the Act.

See, e.g.,

15 U.S.C. 7704(a) and (b).

b. Proposal To Modify Definition of “Sender”

Based on the arguments discussed above, the Commission believes there is merit in the argument that an interpretation of “sender” that would not allow multiple advertisers in a single message to designate one as the “sender” could impede implementation of CAN-SPAM by placing undue compliance burdens on businesses and endangering the privacy of consumers' personal information. Therefore, the Commission believes that to implement CAN-SPAM, the definition of “sender” should be modified so that in situations when more than one person's products or services are promoted or advertised in a single e-mail message, those sellers may structure the sending of the e-mail message so that there will be only one sender of the message for purposes of the Act.

If there is only one sender, the question remains how to determine who is the sender in messages with multiple advertisers. Commenters proposed a variety of criteria for designating a single “sender” of such e-mail messages. Most commenters focused on two principal indicia for determining the identity of the sender: (1) Control of the message and (2) recipient expectations.

Nevertheless, a small group of commenters recommended that the Commission use a “but for” test.

See, e.g.,

Bankers; ASTA; DMA; Discover; IAC; MPAA; Microsoft; Time Warner. Under such a test, if an e-mail message would have been sent regardless of whether a particular advertisement was included, then the advertiser would not be a sender. The Commission does not believe that such a test is workable from the perspective of law enforcement because it relies on gauging the intent of the sender, an approach that is contrary to the Commission's traditional analysis of advertising or marketing claims. In its final primary purpose criteria, the Commission similarly declined to adopt a “but for” test for determining a message's “primary purpose,” instead opting to look at the message from the recipient's perspective. 70 FR at 3118. The Commission noted that its decision to use the recipient's perspective is based on the analytical approach the Commission traditionally has taken with advertising, where claims are judged from the consumer's perspective not the marketer's.

Id.

Therefore, the Commission declines to adopt a “but for” test, or any other approach that focuses on a sender's intent, in determining the identity of the “sender.”

(

)

Control of the Message

Commenters cited several factors evidencing control that would be useful in determining the sender's identity, including:

• Which entity holds itself out as the sender? Who is in the “from” line?

Bankers; DMA; ERA; Experian; Go Daddy; MPAA.

• Who originates or transmits the e-mail? Who sends it or causes it to be sent?

See, e.g.,

ABM; AeA; ACB; ERA; Experian; Go Daddy; IPPC; MMS; NAR; Coalition; Time Warner; USTOA.

• Who collects the recipients' e-mail addresses? Who is the list owner?

See, e.g.,

DMA; Experian; ERA; IAC; IPPC; Microsoft; Moerlien; Time Warner. IAC and Microsoft also recommended that the list owner or broker be required to identify itself and the role it plays in sending the e-mail.

• Who provides the list of recipients' e-mail addresses? Who controls the recipient list?

See, e.g.,

Bankers; AeA; DMA; ERA; MPAA; IAC; IPPC; MPAA.

• Who provides the content? Who controls the development of the message content?

See, e.g.,

AeA; DMA; ERA; Go Daddy; NAR.

• Who, if anyone, has an existing relationship with the recipient? Who, if anyone, received affirmative consent to e-mail the recipient? Who controls the relationship with the recipient?

See, e.g.

, AeA; Experian; IAC; Coalition.

• Who is the recipient directed to contact if he or she wants more information or to purchase the product or service advertised?

See, e.g.

, Coalition (suggesting one test would be who derives the primary value from the message); USTOA.

(2) Recipient Expectations

Other commenters urged the Commission to use a “net impression” test, in which the “sender” would be determined in a way that would be consistent with the recipient's reasonable expectations,

i.e.

, the entity that a reasonable recipient would expect to be the “sender.”

Commenters suggested that, under such an approach, the Commission would evaluate a message using a variety of factors, like those listed above, that may evidence control.

See, e.g.

, ABM; IAC; Microsoft; NAR; Coalition; USTOA.

The Commission believes that the factors highlighted by commenters are relevant to the issue of who should be considered the “sender.” These factors can be distilled to three elements, any one or more of which may be the deciding factor as to who is the sender in situations when more than one person's products or services are advertised or promoted in a single e-mail message. The proposed Rule provides that in such situations, the sellers may structure the sending of the e-mail message so that there is but one “sender”—a person who not only meets the Act's definition, but who also controls the content of the message, determines the e-mail addresses to which such message is sent, or is identified in the “from” line as the sender of the message.

This proposal would ameliorate what some commenters argued was an overwhelming obstacle to multiple-advertiser messages while preserving e-mail recipients' rights under CAN-SPAM. Sellers who do not avail themselves of this opportunity, in effect, to designate one “sender” will each be considered a sender of an e-mail message advertising products or services offered by multiple sellers.

See “from” line discussion in this NPRM, below, for explication of the requirements of CAN-SPAM and section 5 of the FTC Act with respect to the “from” line.

c. “Sender” Definition Issues Other Than Single Message/Multiple Senders

Commenters raised additional issues that relate to the definition of “sender.” These comments fall into three broad topics: (1) An entity's “sender” obligations under CAN-SPAM when its separate lines of business or divisions transmit e-mail messages; (2) an entity's “sender” obligations under CAN-SPAM for e-mails transmitted by its affiliates or other similar parties; and (3) content of the “from” line as it relates to the identity of the “sender.” Comments on each of these topics are discussed in the sections immediately below.

(1) Separate Lines of Business or Divisions

Proposed 316.2(m) incorporates by reference the Act's language regarding obligations under CAN-SPAM when an entity's separate lines of business or divisions transmit e-mail messages.

Thus, when a separate line of business or division initiates a message in which it holds itself out to be that line of business or division rather than the entity of which it is a part, the “sender” of the message will be considered to be the line of business or division.

15 U.S.C. 7702(16)(B).

Some commenters asked the Commission to provide further clarification of the Act's language with regard to separate lines of business or divisions.

The Commission believes, however, that the elements of the definition of “sender” adequately clarify obligations in such situations and no additional Rule provision is needed.

See, e.g.

, DSA; IFA; Go Daddy (suggesting that “sender” should not include affiliates unless companies are so closely intertwined that a reasonable person would conclude they were the same entity); IPPC; MMS; USTOA; Weston.

Other commenters raised different concerns with how the “sender” definition's approach to separate lines of business or divisions would apply to various business models in e-mail

marketing. These commenters argued that third-party list providers or e-mail services should be considered akin to separate lines of business or divisions and asked that the Commission incorporate the concept of “third-party advertising service” or list provider into the definition of “sender.”

These commenters expressed concern that the definition of “sender” does not encompass third-party advertising services, e-mail list service providers, or similar services that compile lists of e-mail addresses, have an established relationship with the recipients, and often use their own lists of e-mail addresses to transmit messages on behalf of advertisers.

Some commenters disagreed, urging the Commission to hold responsible the entity whose products or services are advertised or promoted in an e-mail, not the facilitators of the transaction such as list owners/brokers/managers, broadcast services, and other entities not promoting their own products and services in the e-mail.

See, e.g.

, Experian; Coalition (suggesting the Commission could interpret the Act as providing that a “third party advertising service” which “holds itself out to the recipient throughout the message as that particular [third party advertising service] rather than as the [advertiser itself], shall be treated as the sender of such message for purposes of this Act”).

See, e.g.

, Experian.

See, e.g.

, MMS.

The Act is quite clear that the definition of “sender” includes two elements: one must initiate a message

and

advertise one's own product, service, or Web site in order to be a “sender.”

Thus, the Act reflects Congress's determination that the obligations of the “sender” will fall only on an entity whose products or services are advertised in the message, even though other parties may also transmit or procure the transmission of the message. The Act's definition of “sender” simply does not apply to entities that do nothing more than provide a list of names or transmit a commercial e-mail message on behalf of those whose products or services are advertised in the message. Of course, if an e-mail service provider or list compiler or owner initiates messages that advertise or promote its

own

product or service as well as the products or services of others, the list owner may be considered to be the sender. Given this framework, the Commission is not inclined to expand CAN-SPAM's regulation of who must honor opt-out requests to entities whose products or services are

not

advertised or promoted in a message. However, pursuant to section 7709, which requires the Commission to report to Congress on its analysis of the effectiveness and enforcement of the Act, the Commission includes questions in Part VII on the benefits and burdens of such an expansion.

S. Rep. No. 108-102.

(2) Sender Liability for Practices of Affiliates or Other Similar Entities

Some commenters asked the Commission for a ruling that content providers are not responsible for e-mail messages advertising their product or service if the messages are sent by affiliates or other third parties over which they have no control.

The Commission declines to issue so broad a statement—especially because, in other contexts, it has specifically held sellers liable for the actions of third-party representatives if those sellers have failed to adequately monitor the activities of such third parties and have neglected to take corrective action when those parties fail to comply with the law.

The Commission believes it inappropriate to excuse content providers in advance from the obligation to monitor the activities of third parties with whom they contract. However, the Commission includes questions in Part VII on whether a “safe harbor” provision should be added to the Rule and, if so, what criteria such a safe harbor might include.

See, e.g.

, ACB; IFA MPAA; Time Warner; Weston.

See, e.g.

, 310.4(b)(3)(v) of the Telemarketing Sales Rule, which requires sellers and telemarketers to monitor and enforce compliance with the do-not-call policy and procedures.

See also

ACA (claiming that debt collection e-mail messages are not commercial, and are “at most, ‘transactional or relationship messages’ ”). The Commission agrees that certain types of messages may not satisfy either the “commercial” or “transactional or relationship” definitions, and thus are not regulated by CAN-SPAM. The Commission has posed questions in this NPRM asking whether certain types of messages are beyond the scope of the Act, and whether CAN-SPAM should be modified to address these messages.

(1) Section 7702(17)(A)(i)—Messages To Facilitate, Complete, or Confirm a Commercial Transaction That the Recipient Has Previously Agreed To Enter Into With the Sender

Of the five categories of messages included in the Act's definition of transactional or relationship messages, the first is messages “to facilitate, complete, or confirm a commercial transaction that the recipient has previously agreed to enter into with the sender.”

Although numerous commenters suggested modifications—predominantly that this part of the definition be expanded—the Commission proposes no modification to the Act's definition of “transactional or relationship message” in this area. As noted above, the Commission finds insufficient support in the comments to meet the statutory standard for modifying this definition. Commenters did not demonstrate that any modification is needed to accommodate changes in e-mail technology or practices, and to accomplish the purposes of the Act. Nonetheless, the Commission believes it worthwhile to summarize briefly the kinds of modifications suggested by commenters, and to explain its views regarding certain of this section's provisions. These suggested modifications fall under four basic topics: (a) What constitutes a “commercial transaction” under section 7702(17)(A)(i)? (b) How many confirmation messages under section 7702(17)(A)(i) may a sender transmit pursuant to a single transaction? (c) May an e-mail sender use a third-party to send messages under section 7702(17)(A)(i) on its behalf? and (d) Do messages negotiating a commercial transaction satisfy section 7702(17)(A)(i)? Comments relating to each of these topics are discussed in the sections below.

15 U.S.C. 7702(17)(A)(i).

(a) What Constitutes a “Commercial Transaction” Under Section 7702(17)(A)(i)?

IAC urged the Commission to opine that a “commercial transaction,” as used in section 7702(17)(A)(i) , need not involve the exchange of consideration.

IAC noted that in the definition of “commercial electronic mail message” the term “commercial products or services” includes “content on an Internet Web site operated for a commercial purpose.” Based on this, IAC argues that registering for a free Internet service such as Evite (a Web site through which registrants may send electronic invitations to events) constitutes a commercial transaction. Microsoft also advocated this position, raising the specter that if the Commission does not adopt this view, it would only encourage “many more online businesses to charge for their services.”

IAC.

Microsoft.

The Commission believes that this reading of section 7702(17)(A)(i) is unnecessary because the types of e-mail messages that prompt the concern of IAC and Microsoft would likely be deemed “transactional or relationship messages” under a separate subparagraph of section 7702(17)(A). Specifically, under section 7702(17)(A)(v), it seems likely that a message sent from Evite or a similar entity to one who had registered to use its services would be considered a message “to deliver goods or services * * * that the recipient is entitled to receive under the terms of a transaction” between the recipient and Evite. The Commission believes that the modifier “commercial” has been deliberately omitted from this provision of CAN-SPAM to accommodate just the sort of scenario that IAC and Microsoft raise. The Commission seeks comment on whether messages sent pursuant to a relationship in which no consideration passes may be considered to be a “commercial transaction” under section 7702(17)(A)(i), or would more appropriately be considered a transactional or relationship message under section 7702(17)(A)(v), or under some other theory.

(b) How Many Confirmation Messages Under Section 7702(17)(A)(i) May a Sender Transmit Pursuant to a Single Transaction?

IAC also requested that the Commission expressly allow each confirmation message pursuant to a single transaction to be a transactional or relationship message, even if more than one such message is sent. As an example, IAC cited a scenario in which one confirmation is sent immediately after a consumer completes an online transaction (such as booking an airline flight or hotel room) and another is sent in close proximity to the travel time to remind a recipient of her reservation.

The Act is silent as to the number of times a sender may transmit to a particular recipient a message to facilitate, complete, or confirm a single commercial transaction. Nevertheless, the Commission believes that, given the purposes of the Act, a standard of reasonableness is implied, and that senders must meet that standard.

IAC's scenario would appear to meet this standard, but other scenarios would not. As an extreme example to illustrate the point, if a company sent hourly confirmations of a transaction that warranted merely a single such notice—particularly if the message also contained content advertising or promoting products or services—the Commission would likely view such messages as commercial and not transactional.

IAC.

See

Go Daddy (advocating requiring contact via transactional or relationship messages to be reasonable).

IAC also urged the Commission to opine that when an entity with whom a recipient has done business uses a third party to send a message confirming a transaction, the message would still be considered a transactional or relationship message.

By way of example, IAC argued that when a consumer books an airline reservation using Expedia, the consumer should be considered to have entered into a transaction not only with the airline, but also with Expedia.

NAIFA asked that the Commission opine that e-mail messages from an insurance agent to a customer should be considered transactional or relationship messages even though the customer pays the premium to the insurer, not the agent.

IAC.

According to IAC, absent such an interpretation, if a consumer were to forward an opt-out request to Expedia pursuant to section 7704(a)(3)(A)(i) prior to the time Expedia had transferred the customer's e-mail address to the airline, such transfer could be considered a violation of section 7704(a)(4)(A)(iv).

NAIFA.

These comments raise the question of whether the language of section 7702(17)(A)(i) supports allowing such transactional or relationship messages only from the sender, or also from affiliated third parties if they are facilitating, completing, or confirming a transaction. In the examples cited—when Expedia processes sales on behalf of an airline, and when an insurance company uses agents to sell policies—a message confirming the transaction would qualify as a transactional or relationship message under section 7702(17)(A)(i) whether, in the first example, it came from either Expedia or the airline, and whether, in the second example, it came from either the insurance company or the selling agent. These examples seem fairly straightforward; the Commission seeks comment on whether other situations involving transactional or relationship messages from an entity purporting to be acting on behalf of a sender might be more problematic for consumers or cooperating sellers, or present opportunities for evasion of CAN-SPAM's consumer protections.

(d) Do Messages Negotiating a Commercial Transaction Satisfy Section 7702(17)(A)(i)?

Some commenters asked that the Commission ensure that e-mail messages sent to negotiate a transaction be included in the definition of transactional or relationship message.

The Commission believes that, to the extent that negotiation may be considered a “commercial transaction” that a recipient has previously agreed to enter into, it would seem that such messages likely would be considered transactional or relationship as long as they were sent to facilitate or complete the negotiation. On the other hand, the Commission would not interpret the term “transactional or relationship message” to include an initial unsolicited message that proposes a transaction and attempts to launch a negotiation by offering goods or services. Rather, such a message would likely be categorized as a commercial e-mail message, and would be required to comply with all prescriptions of the Act. The Commission seeks more information about whether e-mail messages sent to effectuate or complete a negotiation might be considered “transactional or relationship messages” under section 7702(17)(A)(i), and if so, under what circumstances that may or may not be the case.

See, e.g.

, Mellon; SIA; Wells Fargo.

(2) Section 7702(17)(A)(ii)—Messages To Provide Warranty Information, Product Recall Information, or Safety or Security Information With Respect to a Commercial Product or Service Used or Purchased by the Recipient

Commenters had relatively few suggestions for modification to this category, but NADA requested that the Commission opine that scheduled maintenance notifications be considered safety or security information and covered by this definition.

To the extent that scheduled maintenance is designed to ensure the safe operation of a product, the Commission believes that reminders of this nature would be considered safety information under the “transactional or relationship” partial exemption from CAN-SPAM's requirements. Scheduled maintenance that is

not

necessary for safe operation of a product, however, would not satisfy this “transactional or relationship” category. A message notifying recipients when such scheduled maintenance is due could satisfy section 7702(17)(A)(v)—covering, among other things, delivery of product updates or upgrades—if recipients previously agreed to receive such notices from the sender. Section 7702(17)(A)(v), the fifth “transactional or relationship” category, is discussed below.

NADA.

Two other comments requested expansion of this category to cover additional messages. First, Ford Motor recommended that “product service” information be expressly included in this category. It is not clear from the comment what kinds of messages might fall outside the existing categories in this section, but within the “product service” category. Nor does the comment contain sufficient evidence that this suggested modification is necessary to accommodate changes in e-mail technology or practices and accomplish the purposes of the Act. As a result, the Commission declines to incorporate this language into the proposed Rule.

Second, Countrywide recommended expansion of “security information” to include “security-related notifications or education.” The language of the Act is clear that messages relaying “security information” will be categorized as “transactional or relationship,” and the Commission finds that the comments contain insufficient justification for altering this language.

If recipients agreed to receive such messages, however, they could satisfy section 7702(17)(A)(v) in the same way that messages reminding recipients of scheduled maintenance could.

See

discussion of section 7702(17)(A)(v) below.

(3) Section 7702(17)(A)(iii)—Messages To Provide—(I) Notification Concerning a Change in the Terms or Features of; (II) Notification of a Change in the Recipient's Standing or Status With Respect To; or (III) at Regular Periodic Intervals, Account Balance Information or Other Type of Account Statement With Respect to, a Subscription, Membership, Account, Loan, or Comparable Ongoing Commercial Relationship Involving the Ongoing Purchase or Use by the Recipient of Products or Services Offered by the Sender

The Commission received many comments related to the three sub-categories that comprise this provision. Most business commenters recommended expanding these sub-categories or interpreting them broadly to include more (or even all) messages between a sender and any customer with whom the sender has an established business relationship.

Some commenters who endorsed this expansion suggested that the proposed Rule require that the frequency with which recipients are contacted must be reasonable.

Some consumers expressed concern about the volume of e-mail messages they might receive if this transactional or relationship category were interpreted too broadly.

See, e.g.

, Cendant.

Go Daddy.

Jensen (noting that merely purchasing a single item from a company should not “allow the company to then inundate the customer with sales pitches, nor should a bank be able to send messages for its many services unrelated to a customers [sic] checking account if that is the only relationship that exists between the parties”).

The recommendations for expansion were couched in a variety of terms. Some commenters requested that any e-mails regarding a transaction that formed the basis of a relationship between the seller and consumer be considered transactional or relationship messages. Others suggested that messages about an ongoing service that the customer has requested or consented to receive be considered “transactional or relationship.”

100

Still others recommended adding a new category for messages “concerning information, products, or services that the recipient has received or will receive from the sender.”

101

100

MPAA; Lenox.

101

Wells Fargo.

Some of the comments focused on specific elements of the language of section 7702(17)(A)(iii). For example, some comments advocated interpreting “an ongoing commercial relationship” as beginning when a person opts in to receiving future messages, even in the absence of a purchase.

102

Others suggested removing the restriction that account balance information and statements be sent at regular intervals, noting that certain account statements are “sent following a transaction, rather than on a ‘regular’ temporal schedule.”

103

Some sought a specific articulation that billing statements are transactional or relationship messages, even if some advertising content is included because “billing statements would be sent irrespective of the inclusion of an advertisement.”

104

One commenter recommended allowing not only account balance but also “account-related” information to be considered transactional.

105

Another inquired whether offerings of related or alternative financial relationships could be categorized as transactional or relationship messages.

106

102

See, e.g.

, MPAA (noting that a “subscription or ‘preferred customer’ loyalty program where special discounts and event opportunities are routinely promoted” often do not involve the exchange of consideration).

103

CBA. The Commission believes that if such notices are routinely sent at a certain interval following a transaction that this may well meet the regular interval standard.

104

Reed. This issue is addressed in the January 19, 2005,

Federal Register

Notice. 70 FR at 3117.

105

Countrywide.

106

Visa.

The Commission is not inclined to adopt any of these suggestions. As noted above, the Commission believes that the “transactional or relationship” provision should be interpreted narrowly to prevent erosion of the protection CAN-SPAM affords recipients from receiving unwanted messages. The categories delineated in the “transactional or relationship” provision of the statute are clear and comprehensive, representing Congress's judgment as to the kinds of messages that should be exempt from most provisions of the Act, including its opt-out requirements. Furthermore, the statute provides that the Commission can modify these categories only if the modification is necessary to accommodate changes in e-mail technology or practices and accomplish the purposes of the Act. Because there is inadequate support in the comments to support such a finding, the Commission is not inclined to expand this category of transactional or relationship messages as suggested by commenters.

A small number of the comments focused on narrowing the category to prevent abuses in instances when marketers continue to send commercial

e-mail messages under the guise of transactional or relationship messages even after a loan is paid off, claiming to be changing the status of the recipient from “paid off” to “inactive.”

107

In a similar vein, NCL expressed concern about the use of dual-purpose messages not only to transmit the recipient's bank balance, but also to advertise additional financial products or services, noting the “potential for abuse” if the advertising content overwhelms the transactional or relationship content. As noted above, application of the Commission's primary purpose criteria

108

will allow for proper categorization of such messages. Moreover, as noted in relation to section 7702(17)(A)(i), the Commission interprets the Act as implying a standard of reasonableness. As a result, the Commission may evaluate whether the frequency of contact with which messages purported to be “transactional or relationship” are sent exceeds what would be reasonable for such communications in determining whether the message is delivering

bona fide

transactional or relationship content. The Commission therefore is not inclined to propose a rule provision that departs from the statutory language of section 7702(17)(A)(iii).

107

See, e.g.

, Ford.

108

16 CFR 316.3.

(4) Section 7702(17)(A)(iv)—Messages To Provide Information Directly Related to an Employment Relationship or Related Benefit Plan in Which the Recipient Is Currently Involved, Participating, or Enrolled

The Commission received a relatively small number of comments on this part of the definition of transactional or relationship message. A consistent theme in the few comments received was the concern that employers be able to send messages to their employees promoting discounts or other offers available to them because of their status as employees.

109

As noted above, the Commission believes that the categories within the definition of transactional or relationship message should be interpreted narrowly. It is unclear from the comments received in response to the ANPR, however, how narrowly this provision must be construed to ensure that e-mail recipients are not unduly burdened by unwanted commercial e-mail messages in the context of an employer-employee relationship. The Commission therefore poses questions in this NPRM soliciting data about classifying messages that offer employee discounts or other similar messages as transactional or relationship messages on the ground that they “provide information directly related to an employment relationship * * *.”

109

Wells Fargo; CBA; NADA.

One commenter urged the Commission to opine that a message sent by a third party on behalf of an employer would be considered transactional.

110

The Commission believes that it is reasonable to interpret the Act to allow an employer to retain a third party as its agent to send a message that would otherwise fit within the confines of this definition; such a message would not be excluded from the definition merely because the third party initiated the e-mail. Nevertheless, the Commission does not interpret this provision as providing blanket treatment as “transactional or relationship” for any e-mail message sent on behalf of a third party, even with the permission of an employer. Thus, if a third party were to market its own goods and services to the employees of another company on its own behalf, rather than on behalf of the employer, those messages would not be deemed “transactional or relationship” under section 7702(17)(A)(iv). The Commission welcomes further comment this issue.

110

SVM (“This definition should be modified to acknowledge that a message is transactional or relationship message, regardless of whether it is sent directly by the employer or with the consent of the employer or on behalf of the employer by a third party or by a service in which the employer of the recipient has enrolled on behalf of the recipient.”).

A few commenters suggested that the Commission depart from the language of the Act by deleting the term “directly,” to require only that a message be “related to an employment relationship or related employee benefit plan.”

111

Others suggested that the term “ ‘directly related to an employment relationship’ is not sufficiently clear,” and recommended that the proposed Rule provide that “[e]ven commercial messages are employment related when delivered over employer-provided computers.”

112

The Commission believes such departures from the statute are unwarranted because the comments provide insufficient evidentiary basis that the modification would meet the statutory standard—

i.e.

, necessary to accommodate changes in e-mail technology or practices and to accomplish the purposes of the Act. Moreover, such a modification would diminish the protections provided to recipients of unwanted commercial e-mail messages. For the same reasons, the Commission declines to interpret the phrase “employment relationship” so broadly as to allow

any

messages sent by an employer to an employee to qualify as transactional or relationship messsages. The language of the statute clearly delineates this category of transactional or relationship messages as those “to provide information directly related to an employment relationship * * *” and the Commission finds no basis in the comments to expand this category.

111

See, e.g.

, Countrywide.

112

Ford Motor.

Other comments focused on when an employment relationship begins. MPAA requested clarification that an “ ‘employment relationship’ begins at the time when an offer of employment is tendered.”

113

This transactional or relationship category includes “provid[ing] information directly related to an employment relationship.” Information submitted to a prospective employee who has received a

bona fide

offer of employment after actively seeking such employment could be considered information “directly related to an employment relationship,” provided such information regards only the prospective employment relationship. As discussed above, the Commission narrowly interprets the scope of the employment relationship. Therefore, e-mail messages sent in regard to the initiation of such an employment relationship present little risk of abuse. At this time, the Commission believes that there is little likelihood that prospective employees would be subject to unwanted commercial e-mail messages from their prospective employers between the time an offer of employment is made and the time it is either accepted or rejected. Questions regarding this interpretation are posed in this NPRM.

113

MPAA.

As discussed above, since no comments suggested changes that would meet the statutory standard, the Commission declines to propose a rule that would depart from the statutory language.

(5) Section 7702(17)(A)(v)—Messages To Deliver Goods or Services, Including Product Updates or Upgrades, That the Recipient Is Entitled To Receive Under the Terms of a Transaction That the Recipient Has Previously Agreed To Enter Into With the Sender

The Commission received many comments on this provision, most of which addressed application of the act to: (a) E-mail messages delivered pursuant to an electronic subscription; (b) e-mail sent in response to a request for information from a recipient; or (c) messages from an association to its

membership. Each of these is discussed below.

(a) E-mail Messages Delivered Pursuant to an Electronic Subscription

Several commenters recommended considering subscriptions (to newsletters, membership clubs, or other similar electronically delivered content) “transactional or relationship” because such messages deliver goods or services the recipient is entitled to receive under the terms of a transaction that the recipient previously agreed to enter into with the sender.

114

According to one of these commenters, section 7702(17)(A)(v)'s reference to a previously agreed-to transaction is satisfied when a recipient opts in to a sender's mailing list, whether or not the recipient provided consideration.

115

Similarly, Microsoft suggested “where the underlying transaction specifically includes the receipt of promotional e-mails, such as a subscription to a free online service that is supported in whole or in part through the transmission of promotional messages to subscribers,” such promotional messages should be considered “transactional or relationship.”

116

114

P&G United; Speer (noting that the language of the Act should be expanded to allow for the delivery of “information” as well as goods or services); SIA (requesting that the FTC clarify that certain informational messages, including “newsletters, reports, and others that provide information to customers, concerning such things as investments or advice, do not have a primary purpose that is commercial in nature”); Lunde; Lenox; Venable; NEPA; Comerica.

115

Edgley.

116

Microsoft.

CAN-SPAM's regulation of a message delivered pursuant to a subscription depends on whether or not the message contains exclusively commercial content. The Commission addressed this distinction in the “primary purpose” rulemaking proceeding. In that proceeding, the Commission stated that an exclusively commercial message does

not

satisfy section 7702(17)(A)(v).

117

Rather, CAN-SPAM treats such a message, when it is sent pursuant to a subscription, as a commercial e-mail message delivered with the recipient's “affirmative consent.”

118

In that case, all of CAN-SPAM's provisions regulating commercial e-mail apply, except a recipient's “affirmative consent” overrides his or her previously-submitted opt-out request, and a message sent with a recipient's affirmative consent does not have to provide clear and conspicuous identification that the message is an advertisement or solicitation.

119

When a subscription calls for delivery of a message that is not exclusively commercial, then the message is “transactional or relationship” under section 7702(17)(A)(v) as long as “the recipient is entitled to receive [the message] under the terms of a transaction that the recipient has previously agreed to enter into with the sender.”

120

The sender is not required to receive consideration from the recipient for the message to fall within this category.

117

70 FR at 3118, n. 91.

118

See

15 U.S.C. 7702(1) for the Act's definition of “affirmative consent.”

119

See

15 U.S.C. 7704(a)(4)(B); 7704(a)(5)(B).

120

15 U.S.C. 7702(17)(A)(v).

(b) E-mail Messages That Respond to a Recipient's Request for Information

Some commenters suggested that messages containing information specifically requested by the recipient be considered “transactional or relationship.”

121

ValueClick noted that absent such an interpretation, a consumer visiting a travel Web site and requesting information about a specific destination might be unable to receive messages about the destination about which she inquired.

122

Justasmallthing.com echoed this sentiment, stating that if a request for a catalog is made by a recipient, a company should have the right to respond by e-mail, unless the recipient has requested not to be contacted in that manner.

123

ABM argued that messages sent in response to a specific request for information should be allowed even if the requestor had previously opted out of commercial mail messages.

124

These commenters were consistent in their belief that the intent of the Act is not to regulate solicited e-mail messages, and that failure to state expressly that such messages are included in the definition of transactional or relationship message would lead to decreased productivity and unnecessary restrictions on consensual communication.

125

121

See

Edgley; ESPC; Fredrikson; Mellon.

122

See also

Discover; KeyCorp; PMA; SIA. ASA made a similar argument in the business-to-business context regarding messages responding to an invitation from a general contractor to bid on a project. According to ASA, if bid proposals sent in response to such invitations were not considered transactional, subcontractors wishing to reply could have to determine if the general contractor has opted out before doing so.

123

See also

Edgley; Fredrikson.

124

See also

KeyCorp; NADA (analogizing to the Telemarketing Sales Rule, which permits telemarketing calls in response to an inquiry or application even if the individual called is on the National Do Not Call Registry). This is permissible under section 7704(a)(4)(B) of the Act.

125

See, e.g.

, ABA (noting that the Act was “intended to apply primarily to unsolicited communications sent by for-profit businesses, not to e-mail communications between associations and other tax-exempt nonprofit organizations and their respective members” and that members “expect—and value—the receipt of such information” as renewals, seminar notices, and educational materials); UNC; United (arguing that since messages a recipient “knowingly chooses to receive” are not unsolicited, they should be treated as transactional or relationship messages); Lenox; ClickZ; ICOP; Aspects.

The Commission believes that the concerns raised by these commenters are already addressed by section 7704(a)(4) of the Act, which makes clear that even commercial e-mail messages may be sent to a recipient who has previously opted out “if there is affirmative consent by the recipient subsequent to the opt-out request.”

126

In each of the scenarios posed by commenters, consumers who request information or consent to receive it would, presumably, have provided “affirmative consent,” thus enabling the sender to respond.

127

126

15 U.S.C. 7704(a)(4)(B). Section 7702(1) presents the Act's definition of “affirmative consent.” Of course, any commercial e-mail message sent with a recipient's affirmative consent must provide an opt-out mechanism that complies with sections 7704(a)(3) and 7704(a)(5).

127

15 U.S.C. 7702(1)(A) (defining “affirmative consent” to mean “the recipient expressly consented to receive the message, either in response to a clear and conspicuous request for such consent or at the recipient's own initiative”).

Many membership associations argued that e-mail messages sent by associations to their members should be considered transactional. ABA requested that the definition of transactional or relationship messages be modified to expressly “include all e-mail communications, whether commercial or informational, that are sent by associations and other tax-exempt nonprofit organizations to their own members.”

128

As ABA noted, “[t]he act of procuring membership in an organization has long provided explicit and implicit consent to communication from that organization regarding that membership, especially when the individual voluntarily provides his or her e-mail address fully anticipating receipt of e-mail communications.”* * *

129

128

ABA.

See also

RTCM; AAOMS; IAAMC; ABM; AOC (suggesting that while existing categories of transactional or relationship message may include communications between organizations and their members, the expansion of either category or the creation of a new category that explicitly delineates such messages as transactional or relationship would be preferable).

129

One consequence of categorizing such opt-in mail as transactional or relationship is that those who receive it would not have a legally-mandated opportunity to make an opt-out request pursuant to sections 7704(a)(3)(A) and (a)(4)(A). Some

commenters noted that association members, and others who receive transactional or relationship messages, are afforded the right to “opt out” as part of their membership.

See, e.g.

, AOC; AWWA. There is, however, no legal compulsion for associations to grant this right to members.

The Commission believes it is likely that many such messages may have a primary purpose that fits within the existing categories of transactional or relationship messages. However, the Act does not provide an explicit exemption for communications by membership associations with their members, nor do any of the comments argue that modifying the definition of “transactional or relationship message” to include comments from associations to their membership is necessary to accommodate changes in e-mail technology or practices and accomplish the purposes of the Act. Thus, to the extent that application of the primary purpose criteria yields the conclusion that a membership association's e-mail message sent to its membership has a commercial primary purpose, then the association, as a sender, would need to comply with the provisions of the Act relating to commercial e-mail messages.

Lastly, some commenters requested expanding the section 7702(17)(A)(v) category to include messages about service updates or upgrades, in addition to product upgrades.

130

One suggested that the provision should be framed around messages the sender is entitled to send, rather than those a recipient is entitled to receive.

131

As neither of these suggestions was supported by evidence that the proposed change is necessary to accommodate changes in e-mail technology or practices and accomplish the purposes of the Act, the Commission is not inclined to adopt them.

130

SVM.

131

SVM.

(6) New Categories of Transactional or Relationship Messages Recommended by Commenters

Commenters proposed a variety of new transactional or relationship categories for specific market segments or types of campaigns. These include messages from educational institutions to their faculty, staff, students, alumni, and friends;

132

communications between franchisors and franchisees;

133

messages sent by cemeteries and funeral homes;

134

all messages sent by businesses to their existing customers;

135

business-to-business communications,

136

including what some commenters termed “business relationship messages’”;

137

messages sent by non-profit organizations;

138

messages that provide legally mandated notifications to customers;

139

and messages reminding consumers “that they are included in the sender's database or have been added to such database and how they may opt-out.”

140

As discussed above, because no comments suggest that the recommended changes are necessary to accommodate changes in e-mail technology or practices and accomplish the purposes of the Act, the Commission declines to adopt these recommendations. If a message contains the commercial advertisement or promotion of a commercial product or service, it contains “commercial” content under the Act. If a message providing non-commercial content (such as a legally mandated notification) also contains commercial content, then it will be governed by the Commission's primary purpose criteria as a dual-purpose message.

141

The Commission has included in this NPRM questions that solicit further information on the topic of new transactional or relationship categories.

132

KSUF; UNC (arguing that “CAN-SPAM compliance language” requiring an opt-out mechanism in every message deemed to be commercial would negatively impact the recipients' view of the message, and “reduce drastically the size” of their e-mail contact list).

133

Cendant (arguing that the primary purpose of these messages, even those offering business seminars, is not to sell such services, but rather to “timely communicate and offer business seminars to our franchisees”).

134

ICFA (arguing that the CAN-SPAM Act “never intended to restrict” messages sent by cemeteries and funeral homes to alert families to special events or services, or changes in cemetery rules).

135

NEPA.

See also

Comerica; ACB; PMA (“[A]ny e-mail relating to the goods or services which formed the basis of the transaction or relationship between the sender and the consumer should be considered a transactional or relationship message.”).

136

See, e.g.

, Visa (noting that the Commission had included a business-to-business exemption in the Telemarketing Sales Rule); ACLI (noting the definition of “Pre-Existing Business Relationship” in § 214 of the FACT Act, Pub. L. 108-159, 117 Stat. 1952); MMS; Harte; RMAS; SIA. Courthouse agreed that such a preexisting or current business relationship exemption is desirable, but noted that it may be appropriate to limit it to relationships where there has been a “prior monetary payment by the recipient to the sender.”

137

Some commenters mentioned a special category of “business relationship” messages: those that are individualized and sent from one employee of a company to an individual recipient (or small number of recipients).

See, e.g.

, ESPC; Wells Fargo (stating that if each e-mail sent by an employee of a business has to be scrubbed against that business's suppression list it would be “extraordinarily burdensome and expensive”). The Commission has asked questions in Part VII of this NPRM about whether such a carve-out is warranted due to changes in e-mail technology and practices, and whether such a carve-out is necessary to accomplish the purposes of the Act.

138

See, e g.,

ASAE; AWWA; ABA; RTCM; AAOMS; IAAMC; ABM; AOC. Several of these commenters argued that all e-mail communications from non-profit organizations to their current members should be deemed “transactional or relationship messages.” Others claimed that messages by nonprofits might be considered “commercial” only if the messages’ content related to an activity not substantially related to the organization's tax-exempt, non-profit purposes. The main justification offered by these commenters was that a nonprofit's messages to its members are intended to provide information in connection with an organization or association membership and/or to deliver goods and services under the terms of an existing member, donor or customer relationship.

139

According to commenters, these include privacy notices, billing error notices, and change in terms notices.

See

IBAT; RMAS (urging that e-mails including a service deliverable, obligatory notice, or other contracted-for advice, product, or service should be transactional); SIA (recommending that notices mandated under Gramm-Leach-Bliley be considered transactional); Wells Fargo (suggesting that the Commission coordinate with banking regulators regarding the overlap in regulations regarding legal notices); Comerica.

140

ValueClick.

141

See

16 CFR 316.3. For a detailed discussion of the Commission's primary purpose criteria,

see

70 FR 3110.

4. Section 316.2(p)—Definition of “Valid Physical Postal Address”

The proposed Rule defines the term “valid physical postal address” to clarify that a sender may comply with section 7704(a)(5)(A)(iii) of the Act by including in any commercial e-mail message any of the following: (1) The sender's current street address; (2) a Post Office box the sender has registered with the United States Postal Service; or (3) a private mailbox the sender has registered with a commercial mail receiving agency (“CMRA”) that is established pursuant to United States Postal Service regulations. This proposed definition is important because section 7704(a)(5)(A)(iii) of the Act requires any commercial e-mail message to include “a valid physical postal address of the sender.”

142

15 U.S.C. 7704(a)(5)(A)(iii). It is noteworthy that other anti-spam legislation introduced in the 108th Congress contained a requirement that the valid physical address of the sender be included in each e-mail message.

See

SPAM Act, S. 1231, section 206 (introduced June 11, 2003). Still other bills required inclusion of the sender's valid physical street address.

See, e.g.

, Reduction in Distribution of Spam Act of 2003, H.R. 2214, section 101(a)(1)(D) (introduced May 22, 2003).

In its ANPR, the Commission noted that many senders of commercial e-mail seeking compliance advice had questioned the scope of the term “valid physical postal address,” suggesting rulemaking under section 7711 might be appropriate to clarify this issue.

143

Accordingly, the ANPR asked whether the term “valid physical postal address” could fairly be read to encompass a Post Office box or private mailbox,

144

and

whether it would be desirable for the Commission to adopt rule provisions clarifying the scope of the term.

145

143

69 FR at 11781.

144

This NPRM uses the term “private mailbox,” a term of art used in the regulations of the United States Postal Service, in place of the term commercial mail drop, which the ANPR used.

When a commenter is quoted, however, the term the commenter actually used is reproduced.

145

69 FR at 11781.

Dozens of commenters responded on this issue.

146

A significant majority of these comments urged the Commission to clarify that a sender could satisfy the Act's valid physical postal address disclosure requirement by providing a Post Office box or private mailbox address. The Commission is persuaded by the arguments these commenters advanced, and therefore has defined the term in the proposed Rule to include the sender's street address, Post Office box, or private mailbox, duly registered with the United States Postal Service or a CMRA. These comments address a valid physical postal address as a means of identifying and locating the sender; the statutory intent reflected in the use of the term “physical” in the Act's reference to “valid physical postal address;” and practical concerns regarding the potential burdens on e-mail senders if Post Office boxes and private mailbox addresses were not considered to satisfy this requirement. Comments relating to each of these topics are discussed in turn immediately below.

146

One commenter suggested requiring that information provided to a domain name registrar be valid and include a confirmed physical address. Vandenberg. Such a requirement is unnecessary as obtaining a domain name by false or fraudulent representations is already prohibited by section 7704(a)(1)(A) of the Act.

See

15 U.S.C. 7704(a)(1)(A).

a. A Valid Physical Postal Address as a Means of Identifying and Locating the Sender

Commenters uniformly agreed that one intent of CAN-SPAM is to allow recipients and law enforcement officials to easily identify and locate senders of e-mail.

147

These commenters were split, however, on the issue of whether inclusion of a street address is necessary to effectuate this intent. Arguing that Post Office boxes and private mailboxes have been used by criminals in the past as a means of preserving their anonymity, NFCU opposed reading the term “valid physical postal address” to include those alternatives.

148

Other commenters opposed defining “valid physical postal address” to include private mailboxes on the grounds that they are more likely than Post Office boxes to be used to mask the identity of a rogue spammer because the United States Postal Service typically has more rigorous identification procedures than private mailbox companies.

149

ASTA opined that allowing a Post Office box or commercial maildrop to be a “valid physical postal address” would frustrate the purpose of the Act because, if the sender falsified his or her registration information, the address would not help recipients or law enforcement authorities locate the sender.

150

147

A few commenters on either side of this issue were particularly precise, focusing on the value of a valid physical postal address to law enforcement authorities and potential plaintiffs seeking to accomplish service of legal process.

See

AT&T; K. Krueger.

But see

DoubleClick (“If the purpose of this provision were to identify where companies could be served with legal process, then the law would have required the listing of a sender's corporate headquarters or legal ‘place of doing business.’ ”).

148

See

NFCU (noting that “such addresses are often used in fraud schemes and effectively shield their owners from identification”).

See also

Sachau (“[W]e have too many fly by nights with post office boxes—here today and gone tomorrow.”); ValueClick; ICC.

149

Gilbert (“P.O. Boxes require identification etc. Many private mailboxes do not.”); NCL (noting that since some individuals' and businesses' “only mailing address * * * is a post office box,” inclusion of a P.O. box would be acceptable, but that private mailbox addresses should be excluded because they “are often used to obscure [senders'] real physical locations”); Shaw (no “mail drops”).

150

ASTA (also noting that a street address is desirable “to have a locus about which complaints could be filed if necessary”).

See also

RDS (noting that recipients and law enforcement officials must “have access to the persons responsible for sending the e-mail”); NetCoalition (A physical address is necessary to “ensur[e] that a sender can be physically located.”).

Many commenters took the opposite tack, arguing that allowing a Post Office box or private mailbox to be a “valid physical postal address” would make it possible to identify and locate senders because renters of Post Office boxes must provide their street location to the Post Office as a condition for obtaining a box address.

151

ERA also suggested that since very few recipients would ever visit the sender in person, a Post Office box or private mailbox address would be useful even if it only allowed the recipient to contact the sender by conventional mail.

152

Experian opined that for the Commission to limit the definition of “valid physical postal address” by excluding Post Office boxes and private mailboxes would exceed the agency's mandate under the Act.

151

See, e.g.

, SIA; Discover; IAC; DMA (suggesting that a Post Office box should be included as a valid physical postal address “[w]here the sender is otherwise locatable as a result of being a registered entity under corporate law or federal securities regulation”); ABA; DoubleClick.

But see

Gilbert (claiming that many private mailboxes do not require identification).

152

ERA (noting that a requirement that the street location be disclosed could result in sender's having to train staff to handle customer visits).

The Commission is aware from its own law enforcement experience that those who orchestrate illegal schemes typically seek to remain anonymous to law enforcement officials and the irate public affected by their schemes. Nevertheless, CAN-SPAM and the FTC's regulations under it will impact the business practices of many legitimate companies that send commercial e-mail messages, and the Commission is reluctant to require such entities to alter their mail handling procedures unnecessarily. As SIIA noted, “[a]n individual or entity seeking to evade identification can just as easily use inaccurate street addresses” as hide behind a Post Office box or private mailbox.

153

Such a seller would simply tell the same lies in a different way. Thus, allowing the use of Post Office boxes and private mailboxes creates no greater risk that a sender will falsify information to thwart the purposes of the Act. Moreover, the regulations of the United States Postal Service require verification of the street address of any person seeking to rent a Post Office box or a private mailbox through a CMRA.

154

Therefore, the proposed Rule defines the term “valid physical postal address” to include Post Office boxes and private mailboxes duly registered pursuant to regulations of the United States Postal Service.

155

153

See

SIIA.

See also

Coalition (noting that this provision is likely to impact legitimate marketers who do not misrepresent their identity rather than spammers who might as easily falsify a street address as hide behind a falsely registered Post Office box or private mailbox).

154

A CMRA must confirm that an applicant for a private mailbox resides or conducts business at the permanent address shown on the application submitted to the CMRA. Applicants have a duty to file a revised application if any of the information provided changes. D042.2.6 (governing procedures for delivery of mail to a CMRA). Similarly, an application for a Post Office box “may not be approved until the applicant's identity and current permanent physical address where he or she resides or conducts business is verified.” D910.2.1-2.2 (DMM Issue 58 plus Postal Bulletin changes through PB 22130 (6-10-04)). Furthermore, criminal or civil sanctions for providing false or misleading information on either application accrue, pursuant to 18 U.S.C. 1001.

155

Proposed Rule 316.2(p).

b. Statutory Intent Reflected in the Use of the Term “Physical”

A second issue raised by several commenters was the meaning of the term “physical” in this section of the Act. Some commenters argued that the inclusion of the word “physical” must be given weight and that this word must be seen as a delimiter of the rest of the phrase, “valid * * * postal address,” thus requiring a street address.

156

These

commenters read “physical” to mean something more than a mere mailbox. Other commenters countered this argument by citing legislative history to show that Congress intended that the term “physical” be viewed in contrast to the term “electronic,” and to clarify that it would be insufficient for a sender to simply include an e-mail address to comply with this provision.

157

156

ValueClick (noting that “[t]he principal rule of statutory construction is to give meaning to every word”); ICC (“To give some meaning to the term ‘physical,’ something more than a mere P.O. Box is required.”); AT&T (“[B]y choosing the adjective

‘physical,’ Congress intended to authorize the Commission to require a more substantial presence than a mere Post Office box.”).

157

Bahr.

The Commission is persuaded that the term “physical” can reasonably be read to include not only street addresses, but also validly registered Post Office boxes and private mailboxes. Post Office boxes and private mailboxes have a physical presence, and both are considered legitimate by the United States Postal Service.

c. Practical Concerns if Post Office Boxes and Private Mailboxes Were Not Considered “Valid Physical Postal Addresses”

Commenters who advocated that Post Office box and private mailbox addresses be considered “valid physical postal addresses” also raised several practical concerns about the possible consequences of excluding them from the definition. First, some commenters argued that exclusion of these alternatives could create confusion because there are still some areas within the United States that do not use street addresses, but rather rely on Post Office boxes for the delivery of all local mail.

158

The proposed definition of “valid physical postal address,” which includes Post Office boxes and private mailboxes, will resolve the concerns expressed by these commenters.

158

True (noting that “[i]t would be literally impossible for many legitimate mailers to comply with the Act if a PO Box were not acceptable”); AAR; Jaffe; NAA noting that many smaller newspapers are on rural routes, designated as box numbers); NCL (“[T]he only mailing address that some people have is a post office box.”)

Other commenters expressed concern that any interpretation of “valid physical postal address” that would require a small home-based business to include its street address in commercial e-mail would negatively impact the privacy, and possibly the physical security, of those who run such enterprises.

159

SBA noted that it has long advocated allowing the use of Post Office boxes to protect the security of home-based businesses, which account for more than half of all small businesses.

160

The Commission finds these comments persuasive, and believes that the proposed Rule's definition of “valid physical postal address” addresses their concerns.

159

MIS; Consumer; Lunde; Jaffe; Oldaker; ESPC; Bahr (noting that “junk mailers” are not required by the Postal Service to include a return address on their mail); DSA: Independent; ERA.

160

SBA.

Finally, commenters cited efficiency as a reason for allowing a Post Office box or private mailbox to be considered a “valid physical postal address.” Comerica noted that Post Office boxes are typically used by corporations to speed the process of delivery of mail internally.

161

ACLI and others pointed out that this is not only an efficient business practice, but a common one used for many years by a host of legitimate businesses. Prompted by these and the other considerations discussed above, the Commission proposes to define “valid physical postal address” to include such addresses.

161

Comerica.

See also

Visa; DoubleClick; ESPC; SIA; ABA; MasterCard; Ford Motor; Coalition; SIIA.

5. Implications of Certain Definitions for “Forward-to-a-Friend” Scenarios

In the ANPR, the Commission requested comment on the impact of CAN-SPAM on “forward-to-a-friend” e-mail marketing campaigns, by which recipients forward a company's message to other persons. In response, the Commission received more than forty comments on the issue of whether forward-to-a-friend marketing campaigns should be required to comply with the Act.

The most clear-cut “forward-to-a-friend” scenario involves the situation in which a person receives a commercial e-mail message and forwards the e-mail message to another person. Commenters were also concerned about a similar, but materially different, scenario involving a Web page that enables persons who visit it to send a link to or a copy of that Web page to others via e-mail. CAN-SPAM does not expressly address either of these forward-to-a-friend scenarios, but three of the Act's interconnected core definitions—“sender,” “initiate,” and “procure”

162

—have an impact on them. Therefore, to assist industry in complying with the Act, this notice discusses the applicability of these definitions to forward-to-a-friend practices.

162

The final Rule incorporates by reference these definitions in 316.2(m), (f), and (i).

Industry commenters uniformly opined that forward-to-a-friend campaigns should not be required to comply with the Act, especially when no consideration is provided.

163

They also opined that once a commercial e-mail message is forwarded by the original recipient to a friend or family member, it ceases to be a “commercial e-mail message” under the Act.

164

Industry commenters expressed concern that they would be held responsible for CAN-SPAM violations in messages over which they have no control.

165

They cited the fact that when the initial recipient of an e-mail message forwards a company's message, the company has no control over the content or destination of the message, and, thus, lacks the ability to ensure CAN-SPAM compliance.

166

The original recipient could, for example, delete the required opt-out mechanism or the valid physical postal address before forwarding the message to another, or forward the message to someone who, unbeknownst to the original recipient, has previously sent the company an opt-out request. If the company—the original sender or initiator of the e-mail message—is also deemed the sender or initiator of the forwarded e-mail message, then the company may be liable for sending a commercial e-mail message that does not include all the disclosures required by CAN-SPAM

167

or for sending a

message to a person who had already sent the company an opt-out request.

168

163

See, e.g.

, NRF; Visa; M&F PMA; NAA; DoubleClick; MPAA; Coalition; Time Warner. Commenters tended to discuss two categories of e-mail messages: marketing campaigns that provide consideration for forwarding messages and those that do not. Of course, commenters' concerns were solely about

commercial

e-mail messages. One who transmits a non-commercial e-mail message, including a “transactional or relationship message,” is not covered by most CAN-SPAM requirements.

164

See, e.g.

, Experian; Visa; M&F PMA; Coalition; DMA; MPA; ERA. These commenters reasoned that what begins as a message with a commercial primary purpose takes on a new

personal

primary purpose once the original recipient forwards it to friends and family. As discussed below, this argument is unavailing. Under the Act, the primary purpose of an e-mail message does not change based on the original recipient's reasons for forwarding it. If the original sender has procured the forwarding of its commercial e-mail message by intentionally paying, providing other consideration to, or inducing the original recipient to forward it, then the message retains its commercial primary purpose. If the original sender does not procure the forwarding of its message, then that entity is no longer the “sender” of that message if the original recipient forwards it to other people.

165

These commenters' concerns regarding CAN-SPAM compliance and control over an e-mail message are not implicated in situations in which the seller/advertiser, rather than the original recipient, actually originates or transmits the message, such as when the recipient submits to the seller/advertiser a list of friends and family to receive commercial messages.

166

See, e.g.

, Experian; PMA; ERA.

167

“It is unlawful for any person to

initiate

the transmission of any commercial electronic mail message to a protected computer unless the message provides (i) clear and conspicuous identification that the message is an advertisement or solicitation; (ii) clear and conspicuous notice of the opportunity under paragraph (3) to decline to receive further commercial electronic mail messages from the sender; and (iii) a valid physical postal address of the sender.” 15 U.S.C. 7704(a)(5) (emphasis

supplied). A recipient who forwards a sender's non-compliant commercial e-mail message to one or more people could also face liability as an initiator under CAN-SPAM. 15 U.S.C. 7702(9).

168

“It is unlawful for any person to

initiate

the transmission to a protected computer of a commercial electronic mail message that does not contain a functioning return electronic mail address or other Internet-based mechanism, clearly and conspicuously displayed, that (i) a recipient may use to submit, in a manner specified in the message, a reply electronic mail message or other form of Internet-based communication requesting not to receive future commercial electronic mail messages from that sender at the electronic mail address where the message was received. * * *” 15 U.S.C. 7704(a)(3)(A) (emphasis supplied). A recipient who forwards a sender's non-compliant commercial e-mail message to one or more people could also face liability as an initiator under CAN-SPAM. 15 U.S.C. 7702(9).

In contrast, a few consumers, consumer groups, and others opined that forward-to-a-friend campaigns should comply with the Act regardless of whether consideration is offered or provided for forwarding an e-mail message.

169

NCL expressed concern that these campaigns may violate the privacy rights of consumers because e-mail may be sent to consumers who have opted out of receiving e-mail from the seller. Go Daddy expressed the opinion that such campaigns should contain an opt-out mechanism that applies to the advertiser.

169

K. Krueger; NCL; Go Daddy.

The analytical starting point for determining the applicability of the Act to forward-to-a-friend scenarios is the Act's definitions. CAN-SPAM's definition of “ ‘sender,’ when used with respect to a commercial electronic mail message, means a person who

initiates

such a message and whose product, service, or Internet web site is advertised or promoted by the message.”

170

The term “initiate,” in turn, means “to originate or transmit such message or to

procure

the origination or transmission of such message,

but shall not include actions that constitute routine conveyance of such message.

”

171

Finally, “procure” is defined as follows: “when used with respect to the initiation of a commercial electronic mail message, [‘procure’] means

intentionally to pay or provide other consideration to, or induce,

another person to initiate such a message on one's behalf.”

172

By operation of these definitions, a person who intentionally pays, provides consideration to, or induces another to send on his or her behalf a commercial e-mail message that advertises or promotes his or her product may be considered to have “procured” the origination of that message under the Act, and therefore to be an initiator or sender.

173

That person is therefore legally responsible for ensuring that the message includes an opt-out mechanism and the disclosures CAN-SPAM requires,

174

and for ensuring that opt-out requests are honored.

175

170

15 U.S.C. 7702(16)(A) (emphasis supplied).

171

15 U.S.C. 7702(9) (emphasis supplied). “Routine conveyance” is defined as “the transmission, routing, relaying, handling, or storing, through an automatic technical process, of an electronic mail message

for which another person has identified the recipients or provided the recipient addresses.

” 15 U.S.C. 7702(15) (emphasis supplied).

172

15 U.S.C. 7702(12) (emphasis supplied).

173

This, of course, assumes that the activity in question is not routine conveyance. Activity which constitutes routine conveyance is not considered initiating or sending a commercial e-mail. 15 U.S.C. 7702(9) and (15).

174

See

notes 167 & 168.

175

15 U.S.C. 7704(a)(4).

There are two words used in the definition of “procure” that need further explication—“consideration” and “induce”—because they are not defined within the Act and are key to understanding the scope of the application of the phrase “intentionally to pay or provide other consideration to, or induce” to forward-to-a-friend scenarios.

The term “consideration” is generally understood to mean “something of value (such as an act, a forbearance, or a return promise) received by a promisor from a promisee.”

176

Nothing in CAN-SPAM's legislative history suggests that Congress intended any meaning different from this common legal definition of the term. Thus, where a person forwards, or uses a Web-based mechanism to transmit, a commercial e-mail message to another, the Commission believes the initiation of the message has been “procured” if the person receives money, coupons, discounts, awards, additional entries in a sweepstakes, or the like in exchange for doing so. In such cases, the seller/advertiser would be the sender or initiator and would be responsible for ensuring that the message contains the required opt-out mechanism and disclosures, and that opt-out requests are honored.

176

Black's Law Dictionary 300 (7th ed. 1999).

On the other hand, where there is no payment or consideration from the sender or initiator, the forwarding of the e-mail will not have been “procured” unless the recipient has been “induced” to forward the message. To

induce

means “to lead on to; to influence; to prevail on; to move by persuasion or influence.”

177

“To induce” is much broader than “to pay consideration” because it does not require a transfer of something of value. Nevertheless, the modifier “intentionally” limits the verb “induce,” and the Commission believes that Congress used this language to convey that to “procure,” one must do something that is designed to encourage or prompt the initiation of a commercial e-mail.

178

Thus, the Commission believes that in order to “intentionally induce” the initiation of a commercial e-mail, the sender must affirmatively act or make an explicit statement that is designed to urge another to forward the message.

179

177

Webster's New International Dictionary

1269 (2nd ed. unabridged 1938).

178

For example, an e-mail message likely satisfies the Act's definition of “procure” when it includes text such as “Tell-A-Friend—Help spread the word by forwarding this message to friends! To share this message with a friend or colleague, click the ‘Forward E-mail’ button.”

179

In most cases, the Commission is not required to prove intent when it alleges a law violation.

See

note 45 above (Commission not required to prove sender's intent); 70 FR at 3118. However, in this case, Congress has specifically included intent as part of the definition of “procure.”

The Commission believes that making available the means for forwarding a commercial e-mail message, such as using a Web-based “click-here-to-forward” mechanism, would not likely rise to the level of “inducing” the sending of the e-mail.

180

The Commission believes that this conduct falls within the ambit of “routine conveyance,” defined as “the transmission, routing, relaying, handling, or storing, through an automatic technical process, of an electronic mail message

for which another person has identified the recipients or provided the recipient addresses.

”

181

The Act specifies that “actions that constitute routine conveyance” do not constitute initiation of a commercial e-mail message.

182

180

For example, online retailers may include in their e-mails or on their Web sites a link that simply states “E-mail to a friend.” Retailers give consumers who click on such links the opportunity to forward a Web address or content on a Web site via e-mail. The Commission does not believe that these features satisfy the definition of “induce” because there is only

de minimis

, if any, persuasion or influence exerted through such a statement.

181

15 U.S.C. 7702(15) (emphasis supplied).

182

15 U.S.C. 7702(9).

When a company makes available the means for persons to forward a commercial e-mail message—such as using a Web-based “click-here-to-forward” mechanism—the company obviously hopes that its products or services will be advertised by interested viewers.

183

Nevertheless, the Act's legislative history regarding the definition of “initiate” explains that a company is engaged in “routine

conveyance” rather than “initiating” a commercial e-mail message when it “simply plays a technical role in transmitting or routing a message and is not involved in coordinating the recipient addresses for the marketing appeal.”

184

Based on this legislative history, it seems clear that a seller that simply offers a mechanism on a Web site for forwarding advertising engages in “routine conveyance” when someone other than the seller identifies the recipients or provides their addresses. It seems equally clear, however, that a seller who offers payment or other consideration to Web site visitors to use a forwarding mechanism encourages visitors to send commercial e-mail to recipients who otherwise would not receive the e-mail. In such cases, the Commission believes that the seller is “involved in coordinating the recipient addresses for the marketing appeal.” Such a seller would not be entitled to avail itself of the “routine conveyance” exception to “initiate.” Questions concerning the Commission's interpretation of “routine conveyance” are included in Part VII of this Notice.

183

See, e.g.

, Jaffe (“All companies rely heavily on their happy customers to spread the word of their products or services.”); Register (“There is nothing untoward in a company asking its customers to recommend its goods and services.”).

184

S. Rep. 108-102, at 15.

B. Section 316.4—Prohibition Against Failure To Effectuate An Opt-Out Request Within Three Business Days of Receipt

Section 7704(a)(4) of the Act prohibits senders, or persons acting on their behalf, from initiating the transmission of a commercial e-mail message to a recipient more than ten business days after senders have received a recipient's opt-out request.

185

Section 7704(c)(1) of the Act empowers the Commission to modify the ten-business-day opt-out period if it “determines that a different time frame would be more appropriate after taking into account the purposes of section 7704(a); the interests of recipients of commercial electronic mail; and the burdens imposed on senders of lawful commercial electronic mail.”

186

Accordingly, the ANPR asked whether ten business days is a reasonable time period for effectuating opt-out requests, or whether the Commission should shorten or lengthen the time frame.

185

15 U.S.C. 7704(a)(4).

186

15 U.S.C. 7704(c)(1).

As discussed in greater detail below, 316.4(a) of the proposed Rule tracks section 7704(a)(4) verbatim, with the exception of shortening the time period for implementation to three business days instead of ten. This proposed modification will provide enhanced protection for e-mail recipients' privacy, a key goal of section 7704(a) of the Act, and is supported by the record that current technology allows for processing such opt-out requests more expeditiously than the current ten-business-day time frame.

Section 316.4(b) of the proposed Rule provides that, when enforcing compliance with proposed 316.4(a) through an order to cease and desist or an injunction, the Commission, the Federal Communications Commission, and the attorney general, official, or agency of a State will not be required to allege or prove a defendant's state of mind as required by subsections (a)(2)-(4). Proposed 316.4(b) tracks sections 7706(e) and (f)(2) of the Act, which provide that law enforcement officials need not allege or prove a defendant's state of mind to obtain a cease and desist order or an injunction to enforce compliance with any CAN-SPAM provision that includes a state-of-mind component. The Commission proposes 316.4(b) pursuant to its rulemaking authority under section 7711(a) to “issue regulations to implement the provisions of [the] Act.”

187

Proposed 316.4(b) satisfies this rulemaking standard because it will ensure that the Act's regulation of CAN-SPAM enforcement applies equally to enforcement of the Rule and the Act: Whenever a provision of the Act or the Commission's proposed Rule contains a state-of-mind component, that component is waived when a law enforcement official seeks a cease and desist order or an injunction.

188

187

15 U.S.C. 7711(a).

188

Pursuant to the Act, this waiver is not available to a provider of Internet access service bringing a civil action pursuant to section 7706(g). 15 U.S.C. 7706(g).

Below, the Commission reviews comments on the proper time limit to process opt-out requests and whether recipients' opt-out requests should expire, and explains its proposed requirement that opt-out requests be processed within three business days.

1. Commenters' Proposals Regarding the Appropriate Deadline for Effectuating an Opt-Out Request

Commenters were divided on this issue, with the majority of industry members, including small businesses, recommending that it be kept at ten business days or lengthened, and the majority of individual consumers favoring shortening the period.

189

Additionally, of the 3,818 responders to the web-based questionnaire, nearly half (1,700 responders) felt that ten business days was an appropriate time period for processing opt-out requests. Thirty-eight percent (1,449 responders), however, supported shortening this time frame. Only sixteen percent (623 responders) felt that the time period should be extended.

a. Comments Suggesting That a Ten-Business-Day Deadline for Effectuating an Opt-Out Request Is Appropriate

Nearly half of consumers who commented, and some e-mail senders who commented, indicated that ten business days is an appropriate time period for processing opt-out requests,

190

opining that this time period provides sufficient time for companies who must synchronize multiple e-mail databases, forward opt-out requests to third parties, or manually process opt-out requests.

191

Other commenters indicated that currently they are able to process opt-out requests in far fewer than ten days, but still support the ten-business-day opt-out period to provide flexibility to accommodate the various ways companies effectuate opt-out requests.

192

190

DoubleClick; ClickZ; SVM; NCL.

191

NetCoalition; MPAA; DoubleClick.

192

NFCU; NetCoalition; ValueClick.

b. Comments Suggesting That Ten Business Days Is Not Enough Time To Effectuate an Opt-Out Request

A substantial number of commenters proposed lengthening the deadline for effectuating an opt-out request, citing complex business arrangements, the use of third-party marketers, and the maintenance of multiple e-mail databases as reasons for doing so.

193

While the time periods proposed by commenters varied, the most common suggestion was thirty-one days.

194

Smaller numbers of commenters suggested extending the opt-out period to fifteen, twenty, or thirty days.

195

Visa suggested that rather than a “bright-line standard” for the opt-out time period, the Commission should provide senders with “flexibility that is consistent with their business operations and [opt-out] processing schedules.”

196

193

See, e.g.

, DMA; ESPC.

194

See, e.g.

, ABM; Chamber; Wells Fargo; DMA; Piper CBA; MPA; Bankers. Several commenters argued that thirty-one days is an appropriate time period because it conforms to the recently amended Telemarketing Sales Rule, which requires telemarketers to scrub their telemarketing lists against the National Do-Not-Call Registry every thirty-one days. 69 FR 16368 (March 29, 2004).

195

See, e.g.

, Time Warner (recommending fifteen days); BMO (recommending twenty days); NNA (recommending thirty days); ESPC (recommending thirty days).

196

Visa (noting that in the Gramm-Leach-Bliley Act rulemaking, the Commission ultimately determined that it is appropriate for consumers' opt-out requests to be honored “as soon as reasonably practicable”).

The ANPR posed questions about the technical procedures, and the relevant time and costs, associated with processing opt-out requests. The vast majority of commenters who responded

to these questions, however, provided only the most conclusory information. For example, commenters who asserted that complex business arrangements or the use of third-party marketers impede many senders from effectuating opt-out requests within ten business days omitted details about how or why these complex arrangements affect the time and procedures involved in processing opt-out requests.

197

Nor did they specifically explain the role of third parties as they relate to maintaining and processing suppression lists. Similarly, several commenters who referred to the use of third-party e-mailers as a reason for extending the opt-out period did not specify how long it takes to transfer opt-out requests to these third parties, or the specific technical procedures involved in such a transfer.

198

197

See, e.g.

, NNA; ABM.

198

See, e.g.

, Visa; ICC; ERA; ABM.

But see

RDS (suggesting that where third parties are used, three to five days is an appropriate time period for processing opt-out requests); Go Daddy (recommending that five days is an appropriate time frame to allow for companies that utilize third parties).

Several commenters indicated that the average time to effectuate an opt-out request “varies” or that it depends on the size and structure of the sender's business, but did not provide any specific data reflecting the minimum or maximum amount of time it can take to effectuate an opt-out request.

199

Some commenters complained that the Act's ten-business-day time frame has proven burdensome for small businesses with limited staff and resources, or those who lack an Information Technology department, yet these commenters provided no specific data justifying a longer period.

200

199

Experian. Generally, commenters indicated that currently there is no industry standard for effectuating opt-out requests.

See, e.g.

, Go Daddy; ACLI.

200

See., e.g.

, NNA; BMO.

The Commission received very few comments that addressed how long it takes for each step of the opt-out process.

201

Some commenters indicated that many opt-out requests are effectuated almost entirely electronically; other commenters indicated that senders often must process opt-out requests manually, and argued that such manual processing warranted extending the opt-out period.

202

These commenters did not fully explain the circumstances that would require opt-outs to be processed by hand, or precisely what such manual processing entails. As a result, the record lacks anything beyond mere assertions that complex business processes, limited resources, and manual processing may prevent senders from honoring opt-out requests within ten business days. Thus, there is insufficient basis for extending the opt-out period.

201

See

MBNA.

202

See, e.g.

, MPAA; IPPC; KeyCorp; MBA; BMO (suggesting that employees who send out individual commercial e-mail messages often need to collect and circulate opt-out requests manually).

Another basis advanced to justify a longer time frame in which to process opt-out requests was the argument that additional time was necessary to enable senders to process requests that are submitted via regular mail or using a method that does not conform to the manner specified in the e-mail message.

203

The Commission notes that section 7704(a)(3)(A)(i) of the Act requires that a commercial e-mail message contain a functioning return e-mail address or

other Internet-based mechanism

that the recipient may use to submit an opt-out request, but does not require requests submitted in other ways be honored within the given time period.

204

203

See, e.g.

, ESPC; BMO; IPPC; KeyCorp; MBNA.

204

15 U.S.C. 7704(a)(4)(A).

Another concern cited by commenters in support of a longer time period was that unavoidable technical errors occurring during the ten-business-day window could prolong the opt-out process.

205

While this may be a valid concern, the Act already contemplates such unavoidable technical anomalies. Specifically, section 7704(a)(3)(c) of the Act states that an electronic return address or other mechanism used for processing opt-out requests does not fail to satisfy the opt-out requirement if it “is unexpectedly and temporarily unable to receive messages or process requests due to a technical problem beyond the control of the sender if the problem is corrected within a reasonable time period.”

206

The Commission, accordingly, believes it unnecessary to extend the opt-out period to account for technical errors.

205

See, e.g.

, AeA.

206

15 U.S.C. 7704(a)(3)(C).

Finally, some commenters expressed concern that if the Commission adopts an interpretation that a commercial mail message can have more than one sender, ten business days is not a sufficient time to process opt-out requests.

207

These commenters argued that under a “multiple-sender” scenario, opt-out requests would need to be communicated to each sender of any given commercial message, a process which could take longer than ten business days to complete. As noted above, the proposed modification of the “sender” definition would allow multiple advertisers in a single commercial e-mail message to establish a single “sender” for purposes of CAN-SPAM compliance. Therefore, the Commission is not inclined to extend the length of time a sender has to honor opt-out requests to address this concern.

207

See, e.g.

, NetCoalition; Bankers; Chamber.

c. Comments Suggesting That the Deadline for Effectuating an Opt-Out Request Should Be Less Than Ten Business Days

Several commenters urged the Commission to set a deadline of less than ten business days to effectuate an opt-out request, because doing so would better protect the privacy interests of e-mail recipients and because the Act's ten-business-day time frame is unnecessarily generous, given the advanced state of technology used to process opt-out requests. Specifically, some commenters expressed concerns that under the current ten-business-day time frame, senders would legally be allowed to “mail-bomb” recipients for ten business days during the opt-out period.

208

As one commenter put it, “Ten days still gives a commercial spammer a LOT of time to send junk.”

209

These concerns were not supported by factual evidence that such practices actually occur, or that these practices would be eliminated by a shorter processing period. The Commission is including questions in Part VII to learn more about the volume of e-mail received from a particular sender after a recipient has submitted an opt-out request to that sender.

208

See, e.g.

, Giambra; Go Daddy.

209

Vandenberg (emphasis in original).

Several commenters stated that many senders already have the ability to process opt-out requests in far fewer than ten business days, and that many do so immediately upon receipt of such a request.

210

Go Daddy, a domain name registrar, indicated that it currently honors opt-out requests within seconds, and accordingly, recommended that the Commission shorten the opt-out period.

211

This view was supported by several other commenters who noted that opt-out requests received via an opt-out hyperlink can be added to a suppression list immediately.

212

Still other commenters pointed to currently available mailing list software which will process opt-out requests almost immediately, with delays of only

minutes, or even seconds.

213

Additionally, the Commission is aware of companies that have designed, or are developing, products geared specifically towards complying with this aspect of the CAN-SPAM Act, and which claim to be able to provide fully automated opt-out processing within minutes. Given that such products are in development, it seems likely that the market will yield additional competing technologies in the near future.

210

See, e.g.

, RDS; NFCU; NetCoalition; ValueClick.

211

Go Daddy (“There are very little costs associated with deleting a person's e-mail address from a database, since mailing lists are almost always electronically automated.”).

212

See, e.g.

, MBNA.

213

Satchell; K. Kreuger.

2. Commission Proposal Regarding the Appropriate Deadline for Effectuating an Opt-Out Request

Having considered the comments, the Commission believes that while the record does not demonstrate whether fears of “mail-bombing” during an opt-out period are well-founded, the fact that many commenters already are able to process opt-out requests virtually instantaneously supports the conclusion that the opt-out period can and should be shortened. The purpose of the opt-out provision in the Can-SPAM Act is to protect recipients from unwanted commercial e-mail. Given that the record suggests that nearly instantaneous processing of a recipient's request not to receive future e-mail messages can be accomplished without an undue burden,

214

the Commission believes that shortening the opt-out period to three business days is appropriate. This furthers the key policy objective underlying Can-SPAM to afford e-mail recipients maximal privacy consistent with reasonable compliance costs. The three-business-day window allows for adequate time for processing, even by those entities whose business practices or technology may not allow for instant removal of e-mail addresses submitted in opt-out requests. This proposed provision will also ensure that law enforcement officials need not allege or prove a defendant's state of mind when seeking a cease and desist order or injunctive relief to enforce compliance with 316.4(a).

214

See, e.g.

, Go Daddy.

3. Commenters' Suggestions Regarding Expiration of Opt-Out Requests

Several commenters noted that the Act does not indicate how long a recipient's opt-out request should remain in effect. Therefore, several commenters were concerned that senders would be required to maintain opt-out lists indefinitely.

215

Commenters argued that without limiting the duration of opt-out requests, suppression lists could grow without limit. Several commenters noted that individuals frequently change their e-mail addresses, or that e-mail addresses often become inactive from non-use, and argued that without putting a cap on the duration of opt-out lists, senders would be required to maintain lists with a potentially large percentage of inaccurate, out-of-date, or inactive e-mail addresses.

216

Therefore, commenters urged the Commission to limit how long opt-out requests remain in effect, and suggested a limit of two to three years.

217

215

See, e.g.

, Wells Fargo; Experian; Coalition.

216

Piper.

217

CBA; DMA.

The Commission has carefully considered these comments, and notes that in the somewhat similar context of the National Do Not Call Registry, the duration of a person's registration is five years, or until the registrant changes his or her telephone number, or determines to take the number off the Registry.

218

In addition, other means exist to minimize the outmoded entries in the Registry—specifically, the existence of relevant databases makes it possible for the Registry's administrator periodically to purge defunct or changed telephone numbers from the Registry. In this way, the process of “scrubbing” a call list is limited so that it is no more expensive or time-consuming for industry than is necessary. The Commission is not aware of any similar databases that are available for e-mail marketers to purge defunct e-mail addresses from their distributions lists. On the other hand, the fact that an e-mail marketer's suppression list is likely to have far fewer entries than the 91 million numbers on the National Do Not Call Registry makes the prospect of “scrubbing” far less daunting, and tends to vitiate the argument for an expiration of opt-out requests after a certain period of time. Finally, Congress chose neither to impose such a time limit nor to specifically authorize the Commission to do so at this time. In view of all these considerations, the Commission has determined not to propose such a time limit. Nevertheless, the Commission is receptive to submissions of information or data that would show that a provision placing a limit on the duration of an opt-out request would be useful in implementing the provisions of the Act under section 7711(a).

218

68 FR 4640 (Jan. 29, 2003).

C. Section 316.5—Prohibition on Charging a Fee or Imposing Other Requirements on Recipients Who Wish To Opt Out

Proposed 316.5 broadly prohibits the imposition of any fee, any requirement to provide personally identifying information (beyond one's e-mail address), or any other obligation as a condition for accepting or honoring a recipient's opt-out request. This issue was not addressed in the ANPR, but the Commission now believes it necessary, based on its observation that some senders of commercial e-mail may be encumbering recipients' Can-SPAM opt-out rights with such requirements. The Commission believes that such requirements are entirely inconsistent with the explicit Congressional policy and purposes embodied in the Act.

Section 7704(a)(3)(A) of the Act prohibits any person from initiating “a commercial electronic mail message that does not contain a functioning return electronic mail address or other Internet-based mechanism, clearly and conspicuously displayed, that a recipient may use to submit * * * a reply electronic mail message or other form of Internet-based communication requesting not to receive future commercial electronic mail messages from [the] sender * * *

219

Section 7704(a)(3)(B) of the Act allows those who initiate commercial e-mail messages to comply with section 7704(a)(3)(A) “by providing the recipient a list or menu from which the recipient may choose the specific types of commercial electronic mail messages the recipient wants to receive or does not want to receive from the sender, if the list or menu includes an option under which the recipient may choose not to receive any commercial electronic mail messages from the sender.”

220

Section 7704(a)(4), among other things, directs senders, and those acting on a sender's behalf, to honor recipients' opt-out preferences within ten business days of receipt of those preferences.

221

219

15 U.S.C. 7704(a)(3)(A).

220

15 U.S.C. 7704(a)(3)(B).

221

See

15 U.S.C. 7704(a)(4)(A). As was explained above, the Commission is proposing to shorten the amount of time senders, and those acting on the sender's behalf, have to honor recipients' opt-out request to three business days.

See

proposed 16 CFR 316.4.

Can-SPAM requires clear and conspicuous display of the mandatory opt-out mechanism, but imposes no further explicit requirements regarding the manner in which initiators of commercial e-mail comply with these provisions. Nevertheless, the whole thrust of the Act is to ensure recipients can opt out of receiving subsequent

commercial messages from any sender. Indeed, the sole purpose of the Act's opt-out provisions is to protect recipients' privacy from senders of unwanted commercial e-mail; it would be a complete subversion of this privacy protection to allow senders to compel recipients to disclose personally identifying information as the price of opting out. Accordingly, the Commission believes that an e-mail recipient's ability to submit an opt-out request should not be encumbered by any extraneous requirements.

Proposed 316.5 provides: “Neither a sender nor any person acting on behalf of a sender may require that any recipient pay any fee, provide any information other than the recipient's electronic mail address and opt-out preferences, or take any other steps except sending a reply electronic mail message or visiting a single Internet web page, in order to: (a) Use a return electronic mail address or other Internet-based mechanism, required by 15 U.S.C. 7704(a)(3), to submit a request not to receive future commercial electronic mail messages from a sender; or (b) have such a request honored as required by 15 U.S.C. 7704(a)(3)(B) and (a)(4).”

The Commission intends that this proposed provision apply to all parties involved in processing recipients' opt-out requests: senders of commercial e-mail, those who initiate commercial e-mail, and any third parties that provide assistance to senders in receiving and honoring recipients' opt-out requests. As was explained above, this proposal prohibits these parties from charging a fee to submit an opt-out request, from collecting any information about a recipient other than his or her e-mail address and opt-out preferences,

222

and from requiring recipients to visit more than one Web page to submit an opt-out request.

222

The concept of opt-out preferences is introduced in section 7704(a)(3)(B). Pursuant to that provision, people who initiate commercial e-mail messages may ask recipients to specify which types of commercial e-mail they do and do not want from a sender.

CAN-SPAM's legislative history supports this proposed regulation. Congressman W. J. (Billy) Tauzin stated that “We intend that senders of commercial e-mail provide a convenient, clear and simple way for consumers to opt-out of commercial e-mail.”

223

The Commission's proposal furthers this intent. An opt-out mechanism that requires a fee, unnecessary disclosure of personal information, or access to multiple Web pages would be inconsistent with the demand for a “convenient, clear and simple” opt-out mechanism.

224

This proposal also responds to the concerns of the commenter who argued against burdensome opt-out procedures.

225

223

Hon. W. J. (Billy) Tauzin, Cong. Rec. E74 (Jan. 28, 2004) (Extension of remarks).

224

The findings Congress incorporated in the Act reflect concern about the costs that spam imposes on unwilling recipients: “The receipt of unsolicited commercial electronic mail may result in costs to recipients who cannot refuse to accept such mail and who

incur costs

for the storage of such mail, or for the time spent accessing, reviewing, and discarding such mail, or for both.” 15 U.S.C. 7701(a)(3) (emphasis supplied). This concern supports the Commission's proposal to prohibit charging or otherwise encumbering the opt-out rights that the Act creates.

225

See

O'Connor.

As noted above, the Commission is aware that some e-mail marketers are attempting to use the CAN-SPAM opt-out mechanism as an opportunity to collect information about recipients or to subject them to sales pitches before an opt-out request is completed. Conceivably, some e-mail marketers could even attempt to charge recipients a fee for accepting or honoring their opt-out requests. All of these encumbrances are unacceptable, and, pursuant to section 7711 of the Act, which authorizes the Commission to “issue regulations to implement the provisions of [the] Act,”

226

the Commission proposes a rule provision that would prohibit these encumbrances.

226

15 U.S.C. 7711.

The prohibitions proposed in this rule provision are not intended to impose any new burden on e-mail marketers beyond those already imposed by CAN-SPAM. Nothing on the record suggests a need or justification for e-mail senders to charge recipients a fee to process opt-out requests. Moreover, there appears to be no reason why an e-mail sender would need to collect any information about a recipient other than his or her e-mail address and opt-out preferences in order to process that opt-out request because, according to CAN-SPAM, opt-out requests are specific to a recipient's

e-mail address

, not his or her name. Finally, the Commission believes that e-mail senders should be able to get all the opt-out information they need from a recipient—namely, the recipient's e-mail address and opt-out preferences—in a single Web page. Requiring a recipient to visit multiple Web pages would frustrate recipients' ability to exercise their opt-out rights under CAN-SPAM, and that is clearly contrary to congressional intent. In Part VII below, the Commission asks questions requesting information regarding this proposed rule provision.

D. Section 7704(c)(2)—Aggravated Violations Relating to Commercial E-mail

Committing an aggravated violation along with a violation of section 7704(a) could subject a defendant to triple damages in a CAN-SPAM enforcement action by a state or an ISP.

227

Section 7704(b) of the Act lists four practices which are to be considered “aggravated violations.”

228

According to a Senate Committee Report on an earlier version of the Act, designating specific practices as “aggravated” violations is intended to “apply to those who violate the provisions of the bill while employing certain problematic techniques used to either generate recipient e-mail addresses, or remove or mask the true identity of the sender.”

229

227

15 U.S.C. 7706(f)(3)(C), (g)(3)(C).

228

The four practices are: (1) automated e-mail address harvesting; (2) dictionary attacks; (3) automated creation of multiple e-mail accounts; and (4) relay or retransmission of a commercial e-mail message through unauthorized access.

229

S. Rep.

This text is long and has been trimmed here. Open the source document for the complete record.

This is a copy of a public record, reproduced as it was published. It is not legal advice, and it may not be the version a court would rely on. Check the official source before you cite it.