# Definitions and Implementation Under the CAN-SPAM Act

> Briefs, arguments, decisions, and more.

URL: https://www.frixlaw.com/law-library/documents/fr%3AE8-11394

## Record

- **Collection:** Federal Register
- **Document type:** Rule
- **Published:** May 21, 2008
- **Citation:** 73 FR 29654

## Text

FEDERAL TRADE COMMISSION
16 CFR Part 316
[Project No. R411008]
RIN 3084-AA96
Definitions and Implementation Under the CAN-SPAM Act

AGENCY:

Federal Trade Commission.

ACTION:

Final Rule.

SUMMARY:

In this document, the Federal Trade Commission (“FTC” or “Commission”) issues its Statement of Basis and Purpose and final Discretionary Rule (“final Rule”) pursuant to section 7711(a) of the Controlling the Assault of Non-Solicited Pornography and Marketing Act of 2003 (“CAN-SPAM” or “the Act”), which gives the FTC discretionary authority to “issue regulations to implement the provisions of [the] Act.”

EFFECTIVE DATE:

The provisions of the final Rule will become effective on July 7, 2008.

ADDRESSES:

Requests for copies of the provisions of the Statement of Basis and Purpose and final Rule should be sent to: Public Records Branch, Room 130, Federal Trade Commission, 600 Pennsylvania Avenue, N.W., Washington, DC 20580. Copies of these documents are also available at the Commission’s Website:
http://www.ftc.gov.

FOR FURTHER INFORMATION CONTACT:

Janis Claire Kestenbaum, (202) 326-2798, and Sana Coleman Chriss, (202) 326-2249, Division of Marketing Practices, Bureau of Consumer Protection, Federal Trade Commission, 600 Pennsylvania Avenue, N.W., Washington, DC 20580.

SUPPLEMENTARY INFORMATION:

The final Rule: (1) Adds a definition of the term “person”; (2) modifies the term “sender” in those instances where a single email message contains advertisements for the products, services, or websites of multiple entities; (3) clarifies that a sender may comply with section 7704(a)(5)(A)(iii) of the Act by including in a commercial email message a post office box or private mailbox established pursuant to United States Postal Service regulations; and (4) clarifies that to submit a valid opt-out request, a recipient cannot be required to pay a fee, provide information other than his or her email address and opt-out preferences, or take any steps other than sending a reply email message or visiting a single page on an Internet website. This Statement of Basis and Purpose also explains the Commission’s rationale for not adopting other proposals contained in the Commission’s May 12, 2005 Notice of Proposed Rulemaking (“NPRM”),
1

and addresses the application of CAN-SPAM to forward-to-a-“friend” emails and certain other categories of email messages identified in the NPRM.

1
70 FR 25426.

STATEMENT OF BASIS AND PURPOSE

I. BACKGROUND

A. CAN-SPAM Act of 2003

On December 16, 2003, the President signed into law the CAN-SPAM Act.
2

The Act, which took effect on January 1, 2004, imposes a series of new requirements on the use of commercial electronic mail (“email”) messages. In addition, the Act gives federal civil and criminal enforcement authorities new tools to combat commercial email that is unwanted by the recipient and/or deceptive. The Act also allows state attorneys general to enforce its civil provisions, and creates a private right of action for providers of Internet access service.

2
15 U.S.C. 7701-7713.

In enacting the CAN-SPAM Act, Congress made the following determinations of public policy, set forth in section 7701(b) of the Act: (1) there is a substantial government interest in regulation of commercial email on a nationwide basis; (2) senders of commercial email should not mislead recipients as to the source or content of such mail; and (3) recipients of commercial email have a right to decline to receive additional commercial electronic mail from the same source.

Based on these policy determinations, Congress, in sections 7704(a) and (b) of the CAN-SPAM Act, outlawed certain commercial email acts and practices. Section 7704(a)(1) of the Act prohibits transmission of any email that contains false or misleading header or “from” line information. Section 7704(a)(2) prohibits the transmission of commercial email messages with false or misleading subject headings. Section 7704(a)(3) requires that a commercial email message contain a functioning return email address or similar Internet-based mechanism for recipients to use to “opt out” of receiving future commercial email messages. Section 7704(a)(4) prohibits the sender, or others acting on the sender’s behalf, from initiating a commercial email to a recipient more than ten business days after the recipient has opted out. Section 7704(a)(5) prohibits the initiation of a commercial email message unless it contains three disclosures: (1) clear and conspicuous identification that the message is an advertisement or solicitation; (2) clear and conspicuous notice of the opportunity to decline to receive further commercial email messages from the sender; and (3) a valid physical postal address of the sender. And section 7704(b) specifies four “aggravated violations” — practices that compound the available statutory damages when alleged and proven in combination with certain other CAN-SPAM violations.
3

3
15 U.S.C. 7704(b). The four such practices set forth in the statute are: address harvesting; dictionary attacks; automated creation of multiple email accounts; and relaying or retransmitting through unauthorized access to a protected computer or network. The Act’s provisions relating to enforcement by state attorneys general and providers of Internet access service create the possibility of increased statutory damages if a court finds a defendant has engaged in one of the practices specified in section 7704(b) while also violating section 7704(a). Specifically, sections 7706(f)(3)(C) and (g)(3)(C) permit a court to increase a statutory damages award up to three times the amount that would have been granted without the commission of an aggravated violation. Sections 7706(f)(3)(C) and (g)(3)(C) also provide for this heightened statutory damages calculation when a court finds that the defendant’s violations of section 7704(a) were committed “willfully and knowingly.”

The Act authorizes the Commission to enforce violations of the Act in the same manner as an FTC trade regulation rule.
4

Section 7706(f) authorizes the attorneys general of the states to enforce compliance with certain provisions of section 7704(a) of the Act by initiating enforcement actions in federal court, after serving prior written notice upon the Commission when feasible.
5

CAN-SPAM also authorizes providers of Internet access service to bring a federal court action for violations of certain provisions of sections 7704(a), (b), and (d).
6

4
Sections 7706(a) and (c) of the CAN-SPAM Act provide that a violation of the Act shall be treated as a violation of a rule issued under section 18(a)(1)(B) of the FTC Act, 15 U.S.C. 57a(a)(1)(B).

5
15 U.S.C. 7706(f). Specifically, the state attorneys general may bring enforcement actions for violations of section 7704(a)(1), 7704(a)(2), or 7704(d). The states may also bring an action against any person who engages in a pattern or practice that violates section 7704(a)(3), (4), or (5).

6
15 U.S.C. 7706(g). Section 7704(d) of the Act requires warning labels on commercial email messages containing sexually oriented material. 15 U.S.C. 7704(d). In April, 2004, the Commission promulgated its final rule regarding such labels.
See
69 FR 21024 (Apr. 19, 2004); 16 CFR 316.4.

B. Notice of Proposed Rulemaking

In its May 12, 2005 NPRM, the Commission proposed rule provisions on five topics: (1) defining the term “person,” a term used throughout the Act, but not defined; (2) modifying the definition of “sender” to make it easier to determine which of multiple parties

advertising in a single email message must have its valid physical postal address included in the message and is responsible for honoring “opt-out” requests; (3) clarifying that Post Office boxes and private mailboxes established pursuant to United States Postal Service regulations constitute “valid physical postal addresses” within the meaning of the Act; (4) shortening from ten days to three days the time a sender may take before honoring a recipient’s opt-out request; and (5) clarifying that to submit a valid opt-out request, a recipient cannot be required to pay a fee, provide information other than his or her email address and opt-out preferences, or take any steps other than sending a reply email message or visiting a single page on an Internet website.
7

7
Prior to the NPRM, the Commission issued an Advance Notice of Proposed Rulemaking (“ANPR”), 69 FR 11776 (Mar. 11, 2004), soliciting comments on a number of issues raised by CAN-SPAM, including the interpretation of the term “primary purpose,” which the Commission addressed in a final Rule issued on January 19, 2005, codified at 16 CFR 316.3. In addition, the ANPR requested comment on the definitions of “transactional or relationship message” and “valid physical postal address,” the application of the Act to both multiple-marketer and forward-to-a-“friend” emails, the sufficiency of the ten-business-day opt-out period that had been set by the Act, the potential addition of new aggravated violations, and implementation of the Act’s provisions generally. (Two issues addressed in the NPRM and in this Statement of Basis and Purpose — the definition of “person” and the prohibition on charging a fee or imposing other requirements on recipients who wish to opt-out — were not addressed in the ANPR.) The ANPR also solicited comment on questions related to four Commission reports required to be submitted to Congress. The Commission received over 13,500 comments in response to the ANPR.

In response to this NPRM, the Commission received 152 comments from email marketers and their associations, email recipients, and other interested parties.
8

Based upon the entire record in this proceeding and the Commission’s law enforcement experience, the Commission hereby adopts final Rule provisions that are very similar, but not identical, to the proposed Rule provisions. As discussed in detail below, the adopted provisions are based upon the recommendations of commenters to make certain modifications in the proposed provisions, as well as the Commission’s anti-spam law enforcement experience. Commenters’ recommendations that the Commission has declined to adopt in its final Rule are also identified, along with the Commission’s reasons for rejecting them.

II. DISCUSSION OF THE FINAL RULE

8
Approximately 93 of these comments were submitted by industry representatives, 56 were submitted by consumers, and 3 were submitted by privacy groups. Appendix A is a list of the commenters and the acronyms used to identify each commenter who submitted a comment in response to the NPRM. These comments are available on the Commission’s website at the following address:
http://www.ftc.gov/os/comments/canspam3/index.shtm.

A. Section 316.2 — Definitions

Section 316.12,
9

one of the Rule provisions previously adopted under CAN-SPAM, defines thirteen terms by reference to the corresponding sections of the Act that define those terms.
10

The NPRM proposed modification of the previously-adopted definition of “sender” by adding a proviso to cover multiple sender scenarios. The NPRM also proposed adding definitions of “person” and “valid physical postal address.” All other definitions were to remain as adopted. While the NPRM did not propose any changes to the Act’s definition of “transactional or relationship message,” it posed a series of questions about the interpretation and potential expansion of this definition, and similarly requested comment on the application of the Act’s definitions of “sender” and “initiate” to forward-to-a-“friend” email campaigns.

9
Because the final Rule contains several new provisions, the numbering of the Rule’s subsections has changed. All cites to the Rule in this Statement of Basis and Purpose are to the new, renumbered Rule provisions, unless otherwise stated.

10
The Commission adopted these definitions in the Adult Labeling Rulemaking proceeding under section 7704(d) of CAN-SPAM, which required the Commission to prescribe a mark to be included in commercial email containing sexually oriented material. 69 FR 21024 (Apr. 19, 2004). A fourteenth term, “character,” not defined in CAN-SPAM, was also defined in the Adult Labeling Rule. 16 CFR 316.2(b).

1. Section 316.2(h) — Definition of “Person”

In the NPRM,
11

the Commission proposed adding a definition of “person,” a term used throughout the Act,
12

pursuant to its authority to “issue regulations to implement the provisions of this Act.”
13

Under the definition proposed in the NPRM, which is identical to the definition contained in the Telemarketing Sales Rule, 16 CFR 310.2, the term “person” would mean “an individual, group, unincorporated association, limited or general partnership, corporation, or other business entity.”

11
NPRM, 70 FR at 25428.

12

See, e.g.
, 15 U.S.C. 7702(8), (9), (12), (15) & (16); 7704(a)(1), (2) & (3).

13
15 U.S.C. 7711(a).

Seven of the eight commenters that addressed this issue supported the addition of the Commission’s proposed definition of “person,” opining that it would clarify the types of entities to which the Act applies.
14

The sole objection came from the Society for Human Resources Management (“SHRM”), which argued that unincorporated nonprofit associations should be excluded from the definition of “person” and, therefore, wholly exempt from CAN-SPAM.
15

SHRM argued that, without such an exemption, the risk of liability under the Act could discourage the organization’s members from volunteering to serve in a leadership capacity.

14

See
Discover; Empire; ESPC; FNB; KeySpan; NAR; Metz. Adknowledge also advocated modifying the definition of “person,” but, at bottom, its argument appears to relate to liability in the context of a multi-marketer email. The Commission thus has considered Adknowledge’s comment in connection with the definition of “sender,” below.
See infra
Part II.A.2.

15

See also
ABA (noting that its comments on the ANPR asked the Commission to clarify that the term “person” should exclude associations and other tax-exempt nonprofit organizations with respect to their email sent in pursuit of their tax-exempt nonprofit purposes).

Having considered the comments, the Commission adopts without modification the definition of “person” in the proposed Rule. The Commission believes that the addition of this definition will advance the implementation of the Act by clarifying that the term “person” is broadly construed and is not limited to a natural person. The Commission rejects the argument that there should be a blanket exemption for all messages sent by unincorporated nonprofit entities. As we have previously observed, CAN—SPAM does not set up a dichotomy between “commercial” and “nonprofit” messages.
16

Accordingly, when nonprofit organizations send emails the primary purpose of which is the advertisement or promotion of a commercial product or service, recipients are entitled to the Act’s protections. In any event, as discussed below,
see infra
Part II.A.3.j., messages from an association to its members will often be “transactional or relationship messages” under section 7702(17) of the Act and thus not required to include a functioning Internet-based mechanism for consumers to use to opt out of receiving future commercial messages.
17

16
69 FR 50091, 50100 (Aug. 13, 2004).

17
Section 7706(d) makes clear that the Commission has only the same jurisdiction and power under the Act as it has under the FTC Act, 15 U.S.C. 41,
et seq.
Consequently, the FTC lacks jurisdiction to enforce CAN-SPAM against any entity that is not “organized to carry on business for its own profit or that of its members.” 15 U.S.C. 44. States and providers of Internet access service can bring CAN-SPAM actions against nonprofits, however.

2. Section 316.2(m) — Definition of “Sender”

Section 7702(16)(A) of CAN-SPAM defines “sender” as “a person who initiates [a commercial electronic mail]

message and whose product, service, or Internet web site is advertised or promoted by the message.”
18

In the NPRM, the Commission proposed amending the definition of “sender” to address concerns identified in the ANPR comments about the application of CAN-SPAM’s definition of “sender” to scenarios where multiple marketers use a single email message —— for example, where a commercial email from an airline also contains advertisements or promotions for a hotel chain and a car rental company. The Commission received almost 60 comments in response to this proposal, many of which suggested modifications to the proposed Rule provision. After consideration of these comments, the Commission has modified the definition of “sender” as proposed in the NPRM. The final Rule provides that multiple “senders” of a commercial email, under certain conditions, may identify one among them as the “sender” who will be deemed the sole “sender” of the message (the “designated sender”). Thus, under the final Rule, the designated sender, but not the other marketers using the same email message, must honor opt-out requests made by recipients of the message.
19

Moreover, under the final Rule, the physical address of the designated sender, but not the addresses of the other marketers using the same email message, must appear in the message.

18
15 U.S.C. 7702(16)(A). The Commission incorporated by reference into the CAN-SPAM rules this definition of “sender” in its primary purpose rulemaking. 16 CFR 316.2(l); 70 FR at 3127.

19
Under the final Rule, where a commercial email is sent by multiple “senders” who designate one “sender” to be responsible for honoring opt-out requests, the other marketers using the single email message still will be “initiators” of the email message and therefore responsible for complying with CAN-SPAM’s requirements concerning “initiators”: 15 U.S.C. 7704(a)(1), 15 U.S.C. 7704(a)(2), 15 U.S.C. 7704(a)(3)(A)(i), 15 U.S.C. 7704(a)(5)(A), and 16 CFR 316.4.

a. Background

As discussed in the ANPR, the Act itself does not specifically address multiple-marketer emails. Rather, under the Act, if multiple senders using a single email message meet the definition of “sender,” each would need to provide an opt-out mechanism, a valid physical postal address for each sender would have to appear in the message, and each would be responsible for honoring an opt-out request by a recipient.
20

The ANPR sought comment on “whether it would further the purposes of CAN—SPAM or assist the efforts of companies and individuals seeking to comply with the Act if the Commission were to adopt rule provisions clarifying the obligations of multiple senders under the Act.”
21

20
The “sender” is required by the Act to honor opt-out requests. 15 U.S.C. 7704(a)(4)(A)(i). Additionally, the “sender’s” physical postal address must be included in the message. 15 U.S.C. 7704(a)(5)(A)(iii).

21
69 FR at 11778.

Commenters responding to the ANPR claimed that implementation of the Act may be impeded in multiple marketer scenarios because marketers and consumers will encounter certain difficulties under a regime that holds more than one party responsible as the sender of a single email. First, commenters claimed that consumer confusion would result from multiple opt-out mechanisms and valid physical postal addresses in a single email message.
22

Second, some ANPR commenters predicted that rigid application of CAN-SPAM’s sender definition would likely chill electronic commerce and destroy the type of joint marketing arrangements that are common in industry.
23

According to these commenters, marketers would have to develop mechanisms for receiving suppression lists (lists of email addresses of consumers who previously had opted-out of receiving messages from a sender) from every marketer or co-marketer with which they deal, and for comparing their own mailing lists against multiple suppression lists.
24

In addition, a marketer would have to develop processes for managing multiple opt-outs,
i.e.
, ensuring that the consumer can opt out from each marketer and that all opt-outs sent to the marketer are forwarded to the marketers from whom the consumer no longer wishes to receive commercial email. These commenters argued that existing CAN-SPAM treatment of multiple senders in a single email is needlessly complex and results in unnecessary administrative costs and delays for legitimate email marketers because of the need to maintain and effectuate multiple suppression lists.
25

Third, commenters stated that a requirement to check names against multiple lists would necessitate passing lists back and forth among several parties, increasing the risk that consumers’ private information may be shared with inappropriate entities or exposed to hackers. Moreover, these commenters opined that multiple suppression lists could force a business to divulge customer names to list owners and other marketers, even when the business has promised to protect that information under its privacy policy.
26

22
70 FR at 25429 (citing comments by American Bankers Association; DMA; ERA; IAC; MPAA; Microsoft; PMA; Time Warner).

23

Id.
(citing comments by NAA; Time Warner).

24

Id.
(citing comments by American Bankers Association; DMA; ERA; IAC; MPAA; Microsoft; PMA; Time Warner).

25

Id.
(citing comments by American Bankers Association; DMA; ERA; MPAA; Microsoft).

26

Id.
(citing comments by American Bankers Association; ASTA; ACB; DMA; IAC; MPA; Microsoft; Time Warner). ANPR commenters identified a fourth problem in some situations, such as newsletters. Commenters stated that a requirement that each separate marketer in a single email message be treated as a separate sender would run counter to consumer expectations — consumers would expect to opt out of the email list of the person with whom the consumer had a relationship, not from a marketer in the newsletter.
Id.
(citing comments by ABM; DMA; Microsoft; Midway; Time Warner).

For these reasons, many commenters responding to the ANPR urged that the Act’s “sender” definition be modified to provide that when more than one company’s products or services are advertised or promoted in a single email message, only one among them be responsible as the sender of a message for purposes of the Act.

Based upon these comments, in the NPRM, the Commission proposed adding a proviso to the definition of “sender” to allow multiple sellers advertising in a single email message to designate one among them as the single “sender” of the message for purposes of the Act. Under the NPRM’s proposed proviso, only one of multiple persons whose products or services are advertised or promoted in an email message would have been the “sender” if that person: (A) initiated the message and otherwise met the Act’s definition of “sender,” and (B) was the
only
person who: (1) “controls the content of such message,” (2) “determines the electronic mail addresses to which such message is sent,” or (3) “is identified in the ‘from’ line as the sender of the message.” Under the proposed Rule, if more than one person meeting the Act’s definition of “sender” were to satisfy one of these three criteria, then each such person who satisfied the definition would have been considered a sender for purposes of CAN-SPAM compliance obligations.
27

27
A hypothetical example illustrated the NPRM “sender” definition proposal. If X, Y, and Z are sellers who satisfy the Act’s “sender” definition, and they designate X to be the single “sender” under the Commission’s proposal,
among the three sellers
, only X may control the message’s content, control its recipient list, or appear in its “from” line. X need
not
satisfy
all three
of these criteria, but
no other seller
may satisfy
any
of them. The sellers may use third parties to be responsible for any criteria not satisfied by X. For example, if X appears in the “from” line, the sellers may use third parties — but
not
Y or Z — to control the message’s content and recipient list. 70 FR at 25428.

b. The Final Rule

Based upon the comments responding to the NPRM proposal, the Commission believes that modification of the proposed Rule’s definition of “sender” as it relates to multi-marketer emails is necessary. The final Rule drops the proposed “controls the content” and “determines the electronic mail addresses to which such message is sent” elements, adds compliance with the core provisions of CAN-SPAM as an element, makes the elements conjunctive rather than disjunctive, and makes the element requiring identification of the person in the “from” line mandatory. The Commission believes that these modifications will meet the concerns of marketers while still preserving CAN-SPAM opt-out protections.

Thus, under the final Rule, multiple marketers can designate as a single “sender,” for purposes of compliance with the Act, a person who: (A) meets the Act’s definition of “sender,”
i.e.
, such person initiates a commercial electronic mail message in which it advertises or promotes its own goods, services, or Internet website; (B) is identified uniquely in the “from” line of the message; and (C) is in compliance with 15 U.S.C. 7704(a)(1), 15 U.S.C. 7704(a)(2), 15 U.S.C. 7704(a)(3)(A)(i), 15 U.S.C. 7704(a)(5)(A), and 16 CFR 316.4.
28

In 16 CFR 316.2(m), the final Rule thus states:

28
These provisions, as explained below, apply to initiators of commercial emails and require that the email message may not contain false or misleading transmission information or a deceptive subject heading; but must contain a valid postal address, a working opt-out link, and proper identification of the message’s commercial or sexually explicit nature.

The definition of the term “sender” is the same as the definition of that term in the CAN-SPAM Act, 15 U.S.C. 7702(16),
provided that
, when more than one person’s products, services, or Internet website are advertised or promoted in a single electronic mail message, each such person who is within the Act’s definition will be deemed to be a “sender,”
except that
, only one person will be deemed to be the “sender” of that message if such person: (A) is within the Act’s definition of “sender”; (B) is identified in the “from” line as the sole sender of the message; and (C) is in compliance with 15 U.S.C. 7704(a)(1), 15 U.S.C. 7704(a)(2), 15 U.S.C. 7704(a)(3)(A)(i), 15 U.S.C. 7704(a)(5)(A), and 16 CFR 316.4.

The Commission makes this clarification pursuant to its discretionary rulemaking authority to “issue regulations to implement the provisions of this Act.”
29

29
15 U.S.C. 7711(a). Like the proposed Rule, this final Rule does not eliminate the possibility that a message may have more than one “sender.” However, marketers can use the criteria set forth in the proviso to establish a single sender and reduce CAN-SPAM’s compliance burdens. If marketers fail to structure the message to avoid multiple senders under the sender definition, then each sender is obligated to comply with CAN-SPAM requirements for senders, notably, to provide its physical postal address and to honor any opt-out requests.

The definition of “sender” in the final Rule provides marketers flexibility to structure their messages in a way that alleviates redundant obligations for the various marketers in a single email while ensuring that recipients of such messages receive the benefit of CAN-SPAM’s core opt-out protections. Specifically, the final Rule makes it more practicable than the proposed Rule for multiple marketers promoting their products in a single email to designate a single entity as the “sender” under the Act because the marketers’ decision as to which of them will appear in the “from” line resolves the question of which will be considered a “sender” under the Act and will be charged with the resulting responsibilities. The final Rule eliminates the complex fact determination of who “controls” the content and the element of who “determines the electronic mail addresses to which such message is sent.” By placing the focus on the “from” line, the best point of reference for consumers, the modification in the final Rule more directly conforms to consumers’ expectations as to the identity of the entity responsible for sending them a multi-marketer email.

An example illustrates how the final Rule’s “sender” definition applies in the multi-marketer email context. Suppose A, B, and C have goods advertised or promoted in a single email message and that each is an initiator under the Act. If A’s name appears in the “from” line of the message, A is considered the “sender” under the final Rule. While B and C promote their goods, services, or Internet website in the message, may control portions or all of the content of the message, and may supply email addresses for A to use to address the message, neither B nor C would be considered “senders,” unless A did not comply with the listed requirements that apply to “initiators,” namely 15 U.S.C. 7704(a)(1), 15 U.S.C. 7704(a)(2), 15 U.S.C. 7704(a)(3)(A)(i), 15 U.S.C. 7704(a)(5)(A), and 16 CFR 316.4. It would be clear to a consumer that an opt-out request would be sent to A, the one person identified in the “from” line.

The comments and the FTC’s law enforcement experience suggest that a provision, such as the final Rule’s sender definition, that allows multiple senders flexibility in determining who will be the sole “sender” raises the possibility of abuse by illegitimate marketers. As discussed below, this concern is addressed in part by the addition of certain initiator provisions to the proviso: 15 U.S.C. 7704(a)(1), 15 U.S.C. 7704(a)(2), 15 U.S.C. 7704(a)(3)(A)(i), 15 U.S.C. 7704(a)(5)(A), and 16 CFR 316.4. If the designated sender is not in compliance with the initiator provisions, then all marketers in the message will be liable as senders.

c. Comments on the NPRM’s Definition of “Sender”

Commenters who addressed the proposed definition of sender were nearly unanimous in supporting a “sender” definition that would enable marketers to designate a single “sender” when multiple marketers use a commercial email message. Reiterating ANPR comments, several commenters noted that such a rule provision would avoid “daunting compliance challenges” for email marketers, such as the heavy burden of cross-checking the opt-out lists of all the individual marketers with the designated sender’s opt-out list.
30

Likewise, commenters supported the NPRM’s proposed Rule because it would enable recipients to determine the party responsible for honoring opt-out requests.
31

Others noted with approval that designating a single sender would eliminate confusion for consumers who otherwise would face multiple opt-out links and postal addresses.
32

Finally, other commenters opined that the proposed Rule would promote protection of consumer privacy.
33

30

See, e.g.
, ATAA; Charter; DoubleClick; ERA; ESPC; FNB; IAC; ICC; IPPC; Mattel; Microsoft; NAR; NEPA; NetCoalition; NNA. As the ERA summarized it, “[D]esignating a single sender will enhance accuracy and compliance efforts, streamline the opt-out process for consumers and sellers/marketers, and avoid confusion by, among other things, avoiding cluttered or repetitious information in messages or multiple suppression lists. It also helps address privacy concerns that may attend to sharing consumer suppression data.”

31

See, e.g.
, Mattel; NAFCU.

32

See
ATAA (it would be “difficult to format messages in a way that makes them compelling and understandable to recipients” because of the welter of opt-out links and postal addresses); ERA; ESPC.

33

See
ERA; NetCoalition.

In contrast to the almost unanimous support for a multi-marketer proviso, however, few commenters supported the definition of “sender” as proposed in the NPRM without change.
34

Many commenters raised concerns about the workability and clarity of the proposal,

as well as its consistency with consumer expectations. Most commenters urged the Commission to modify or clarify the criteria articulated in the proposed Rule. Such comments concerned four issues. The first three issues relate to the three listed criteria in the NPRM’s proposed proviso: (1) the significance of the person identified in the “from” line; (2) the meaning of “controls the content of the message” and the structure of the proviso; and (3) the meaning of “determines the electronic mail addresses” to which a message is sent. A fourth category of comments addressed what it means to “advertise” or “promote” a product, service, or website under the Act, which is related to the question posed in the NPRM about whether “list owners” can be “senders” under the Rule and thus be required (or allowed) to process opt-out requests in lieu of other marketers who promote a product, service, or website in the email.
35

34

See, e.g.
, ARDA; Empire; Mattel; NAFCU; NAR; NNA; SHRM; Wahmpreneur.

35
At least one commenter suggested, without further detail, that the sender in a multi-marketer email should be the “entity that controls the sampling, distribution, and opt-out registry.” CMOR. Another commenter suggested determination of a sender in a multi-marketer email with a “single, dominant marketer” test. Bigfoot.

The Direct Marketing Association (“DMA”) advocated formal adoption by the Commission of the Staff Letter of March 8, 2005, which opined on a specific fact pattern involving, among other things, multiple marketers who send commercial email messages to persons who had provided affirmative consent to receive multi-marketer commercial email messages. The Commission declines to adopt the Staff Letter. The final Rule will govern multi-marketer message sender liability.

(i) “From” Line

Many commenters favored looking to the “from” line of the message in order to determine who, under the Act, is the “sender” of a multi-marketer message. Commenters urged that this element is most critical for recipient expectations
36

and would be easy to use as a way to designate a single sender.
37

Some commenters argued that the other two proposed elements should be deleted.
38

A few commenters also requested that the Commission provide additional guidance on which non-deceptive names can be used in the “from” line, including a company’s brands and service names.
39

36

See, e.g.
, Bigfoot; Charter; DoubleClick; KeySpan; MBNA; Nextel; OPA; SHRM.

37

See
Charter; DoubleClick; Nextel; Reed.

38

See
DoubleClick; KeySpan.

39

See, e.g.
, MBNA; SIIA.

(ii) “Controls the Content”

Most commenters voiced concerns about the “controls the content” element of the proposed proviso and its likely effect. Many of these commenters found this criterion vague and urged the Commission to provide additional guidance concerning what it means to “control” the content of commercial email.
40

Many advocated eliminating this factor altogether,
41

and others urged various ways to modify it.
42

Two primary themes emerged from the comments: (1) several parties may exercise some degree of “control” over content, and (2) “control” in this context is a vague and ill-defined concept. Commenters explained that in joint marketing arrangements, it is standard industry practice for each marketer to exercise control over the use of its own trademarks, branding, legal disclosures, and advertising copy.
43

Commenters further explained that in highly regulated industries, such as life insurance, securities, pharmaceuticals, and alcoholic beverages, marketers may be required to include certain text and legal disclosures.
44

Some commenters also stated that, in addition to controlling their own trademarks and disclosures, marketers sometimes influence the content of other parts of a message without “controlling” it, or may suggest advertising text without making the final decision about the advertising content.
45

To protect their brand reputations, commenters explained that they need to be able to review and approve the advertising content of other marketers.
46

40

See, e.g.
, ACB; ACLI; Associations; BOA; CBA; Charter; DLA; DMA; Discover; ERA; ESPC; FNBO; HSBC; IAC; Mastercard; Microsoft; MPA; MPAA; NAA; NAIFA; NBCEP; NEPA; NetCoalition; PMA; SIIA; Time Warner.

41

See
Associations; ATAA; Charter; DoubleClick; Keyspan; MasterCard; NAIFA; SIIA; Wells Fargo. Similarly, other commenters suggested that the proposed Rule be modified to allow more than one marketer to control the content of the message, while still allowing one of the marketers to be designated as the sender.
See
CBA; DMA; MPA; NBCEP; NetCoalition; NRF.

42

See e.g.
, Adknowledge; ICC; MPA.

43

See
Reed; DoubleClick; Time Warner; MasterCard; Microsoft; Bigfoot; HSBC; MPAA; OPA.

44

See, e.g.
, ACLI; BF; HSBC; IPPC; MPAA; OPA; SIA.

45

See, e.g.
, BF; Visa.

46

See, e.g.
, Associations; ERA; HSBC; MasterCard; MPA; NetCoalition; Nextel; NRF; OPA; PMA.

A number of commenters opined that, without clarification, under a literal application of the proposed Rule, essentially
all
marketers would be deemed to “control” the content of a multi-marketer email, thereby preventing the designation of a single sender and defeating the purpose of the proposed Rule.
47

Conversely, according to commenters, a standard that forced marketers to cede all control of the content of messages to one marketer among several using a single email message would greatly disrupt standard industry practices.
48

47

See
ATA; DoubleClick; HSBC; IAC; IPPC; Mastercard; Time Warner.

48

See e.g.
, NAA; TimeWarner.

To alleviate these perceived problems, a number of commenters suggested that the Commission eliminate the “controls the content” element, because they believed that the proposed Rule could operate effectively in its absence.
49

Others suggested that the Commission clarify that “control” means control of the “primary” or “overall” content of the message, but does not mean either control by a company over its own advertisement
50

or the practice of reviewing and approving the advertising content of other marketers.
51

These commenters asked the Commission to clarify that “control” should refer to control over what content will be distributed in the email message as a whole and not control over the design, content, or placement of a particular advertisement in a multi-marketer message.
52

Other commenters advocated that “control” of the content of the message should mean the ultimate ability to determine whether and when the message is transmitted.
53

49

See
NAIFA; SIIA.

50

See, e.g.
, ACB; Adknowledge; Associations; ATAA; CBA; Charter; Discover; DMA; Experian; FNB; IAC; ICC; KeySpan; Microsoft; MPAA; NAIFA; NBCEP; NEPA; NetCoalition; NRF; OPA; Reed; SIIA; Time Warner; Wells Fargo.

51

See, e.g.
, ERA; HSBC; MasterCard; MPA; Nextel; PMA.

52

See
ACB; BoA; Discover; ERA; ESPC; Experian; HSBC; IAC; ICC; Mastercard; Microsoft; MPA; MPAA; NAA; PMA; Visa.

53

See, e.g.
, BigFoot; SIIA.

In a similar vein, some commenters felt that the structure of the proviso as proposed in the NPRM would have limited the ability of legitimate marketers to co-promote their products without any corresponding benefit to consumers.
54

Commenters pointed out that there are circumstances when one entity provides the email addresses to which a message is to be sent and one or more other entities control the content of the message. Under the proposal in the NPRM, all entities would be considered senders because the proposed Rule’s definitional requirements allowing one sender to be designated could not be met.
55

These commenters asked that the final Rule be made more flexible to accommodate the variety of marketing agreements commonly used in the industry.
56

54

See
Bigfoot; CBA; DMA; DoubleClick; ESPC; MPAA; NBCEP; NetCoalition; NRF; SIIA; Wells Fargo.

55

See
DMA; SIIA.

56

See, e.g.
, MPAA.

(iii) “Determines the Electronic Mail Addresses to Which Such Message is Sent”

Few commenters discussed the third element of the proposed proviso for the definition of “sender”: that the sender be the party that determines the email addresses to which such message is sent. Some commenters objected to this element of the definition because, they contend, entities in joint marketing campaigns may want to contribute or recommend some email addresses without being considered the primary “sender.”
57

57

See, e.g.
, KeySpan; Reed; SIA. Several commenters also requested clarification of what constitutes “determines” and suggested that merely providing criteria for targeting recipients (such as demographic characteristics) should not qualify as “determining” the email addresses.
See
DoubleClick; KeySpan; MasterCard; Unsub. As discussed below, this element has been removed, and thus these requests for clarification need not be addressed.

(iv) “Promote”

Finally, a few commenters suggested that the Commission define broadly the term “promote” in the Act’s definition of sender. They argued that a person “advertises” or “promotes” the person’s “product, service, or Internet website” by appearing in the “from” line of the message or simply by having the person’s name referenced in the email.
58

Under this interpretation, they argued, more persons could qualify as designated “senders” under the proviso.

58

See, e.g.
, Adknowledge; ESPC; Unsub.

d. Response to Comments on the Definition of “Sender” and Explanation of the Final Rule’s Definition of “Sender”

Having considered the comments on the proposed definition of “sender,” the Commission adopts a modified version as its final Rule. These modifications mitigate the concerns of marketers raised in the comments, recognize the benefits afforded by advertising by multiple entities in a single email, conform more closely to the expectations of email recipients, and continue to provide the CAN-SPAM protections contemplated by Congress. In summary, as discussed below, the Commission retains the “from” line element in the proviso as a mandatory element, drops the “controls the content” and “determines the electronic mail addresses to which the message is sent” elements, and adds a requirement that the designated sender be in compliance with certain provisions of the Act and Rules that apply to initiators.

In response to comments regarding the “from” line, the Commission found persuasive the suggestions that the “sender” of a multi-marketer email should be the person identified in the “from” line of the message. The Commission agrees that a rule that uses the “from” line as the sole determinant of the sender in a multi-marketer email would be straightforward for marketers to follow and is the single most helpful element of an email to enable recipients to identify the sender of the email.
59

A designated “sender” for purposes of a multi-marketer email must, in addition to meeting the other requirements listed below, include its non-deceptive name, trade name, product, or service in the “from” line of the email.
60

59

See
Charter (stating that the “from” line criterion “specifically accords with consumer expectations.”).

60
In response to commenters seeking further guidance about whether a company’s non-deceptive product or service names can be used in the “from” line, the Commission responds as follows. CAN-SPAM provides that “a ‘from’ line . . . that accurately identifies any person who initiated the message shall not be considered materially false or misleading.” 15 U.S.C. 7704(a)(1)(B). The Commission believes that this does not mean that the “from” line necessarily must contain the initiator’s formal or full legal name, but it does mean that it must give the recipient enough information to know who is sending the message. Email senders should consider their messages from their recipients’ perspective. If a reasonable recipient would be confused by the “from” line identifier, the sender is not providing sufficient information.
See
NPRM, 70 FR at 25431 (further discussing this issue).

And, under the final Rule, the designated sender must be “identified in the ‘from’ line as the
sole
sender of the message” — if two or more senders appear in the “from” line, the multi-marketer proviso would not be met.

On the second issue identified by commenters, the Commission has deleted the “controls the content of such message” element from the proviso. Comments urging its removal were persuasive, and comments that advocated clarification rather than removal revealed that retaining this element would not serve to assist recipients in identifying or confirming the sender of a multi-marketer message. By its nature, a multi-marketer message promotes more than one company’s content, and thus more than one company controls its content in at least some way.
61

Modifying the criterion to require “overall” control of the content would simply add further nuance and complication and make enforcement difficult. Deleting this criterion will make the proviso more practicable for legitimate marketers to designate a single “sender” while preserving for email recipients the protections of CAN-SPAM.
62

Under the final Rule, therefore, a non-designated sender under the multi-marketer proviso will not have “sender” liability just because it controls its own advertising copy, including its trademarks and legal disclosures, or reviews other marketers’ content to ensure the absence of objectionable material in proximity to its own brand.

61

See
IAC.

62

See, e.g.
, Charter (“the Commission’s proposed definition is inadequate and unworkable”); DoubleClick; Keyspan; MasterCard; NAIFA; SIIA.

The Commission has deleted the third element discussed by commenters that required that the designated “sender” of a multi-marketer email determine the email address to which such message will be sent. The NPRM rationale for this element was to ensure that the designated sender had the ability to process opt-out requests. The Commission is now convinced that requiring the designated sender to determine recipient email addresses would serve little, if any, purpose. Under the Act, as a sender, the designated sender already must check to make sure that none of the email recipients appears on its opt-out list. In a multi-marketer email, if the designated sender receives a list of proposed email addresses from a non-designated sender, the designated sender must scrub that list against its own opt-out list before sending the message to the addresses on that list.

On the fourth and final issue raised by commenters, the Commission declines to make any additional changes to the definition of “sender” proposed by the NPRM. Some commenters suggested that the FTC define broadly the phrase “advertised or promoted” in the Act’s definition of “sender,” so that more entities could qualify as “senders” under the multi-marketer proviso. The Commission believes that the definition of a “sender” should be based on consumer expectations. If a reasonable consumer would not believe that a person’s product, service, or website were “advertised or promoted” in the message, then that person does not qualify as a “sender.” The Commission believes that the meaning of “advertised or promoted” is clear and broadly understood.
63

63
By analogy, another definition in the Act, that of a “commercial electronic mail message,” states that

[t]he inclusion of a reference to a commercial entity or a link to the web site of a commercial entity in an electronic mail message does not, by itself, cause such message to be treated as a commercial electronic mail message for purposes of this chapter if the contents or circumstances of the message indicate a primary purpose other than commercial advertisement or promotion of a commercial product or service.

15 U.S.C. 7702(2)(D).

Lastly, based on its law enforcement experience, the Commission recognizes that illegitimate marketers may attempt to use the proviso to escape liability under CAN-SPAM. Both CAN-SPAM’s definition of “initiator” and the final Rule’s revised definition of “sender” substantially reduce the likelihood of such abuse.
64

First, marketers in a single email message who are not designated senders are still “initiators” under CAN-SPAM and liable under any of the provisions that apply to initiators, such as the prohibition against use of deceptive headers and subject lines and the requirement to include an opt-out link.
65

Second, the final Rule’s definition of “sender” requires that the designated “sender” be in compliance with certain initiator provisions of the Act: 15 U.S.C. 7704(a)(1), 15 U.S.C. 7704(a)(2), 15 U.S.C. 7704(a)(3)(A)(i), 15 U.S.C. 7704(a)(5)(A), and 16 CFR 316.4.
66

The proviso states that if the designated sender does not comply with these five “initiator” responsibilities, all the marketers will be liable as
senders
(and not just initiators) under the Act because the proviso will not apply. By requiring the designated sender to comply with these provisions of law, the other marketers using a single email message must ensure that the entity that is the designated “sender” complies with the Act and the Commission’s rules. Otherwise, the other marketers using the email risk losing the protections provided by the proviso and each will be a “sender” of the message. The final Rule, therefore, provides senders of multi-marketer emails a method of reducing the burdens associated with multiple opt-out links and postal addresses while guarding against possible abuse. Nonetheless, if the Commission finds such abuse through the operation of the proviso, it will reconsider whether the final Rule is justified under the Act.
67

64
At least one commenter suggested that the proviso could be subject to abuse.
See
Adknowledge (suggesting that to avoid abusive practices, the proposed regulation explicitly should state that a “person” must be a “
bona fide
business entity” because “spammers continually change the name of the originating entity along with header or other information, or consider a mere email address list as a ‘business entity.’”).

65

See, e.g.
,
FTC v. Phoenix Avatar
, 2004-2 Trade Cas. (CCH) ¶ 74,507 (N.D. Ill. Jul. 30, 2004) (order granting preliminary injunction);
FTC v. Opt-in Global
, No. 05-cv-1502 (N.D. Cal. filed Apr. 12, 2005) (final order entered Apr. 6, 2006);
FTC v. Dugger
, No. CV-06-0078 (D. Ariz. filed Jan. 9, 2006) (final order entered Jul. 31, 2006).

66
Section 7704(a)(1) of the Act prohibits initiation of an email that contains false or misleading transmission information, and section 7704(a)(2) prohibits initiation of an email with a deceptive subject heading. Section 7704(a)(3)(A)(i) requires an initiator to include a “functioning return electronic mail address or other Internet-based mechanism, clearly and conspicuously displayed, that a recipient may use to submit . . . a reply electronic mail message or other form of Internet-based communication requesting not to receive future commercial electronic mail messages from [the] sender [responsible for the initial commercial message].” Section 7704(a)(5)(A) of the Act requires that an initiator “provide clear and conspicuous identification that the message is an advertisement or solicitation, clear and conspicuous notice of the opportunity . . . to decline to receive further commercial electronic mail messages from the sender, and a valid physical postal address of the sender.” Finally, 16 CFR 316.4, the Sexually Explicit Labeling Rule, imposes certain requirements on a message that includes sexually oriented material, including the 19 characters “SEXUALLY EXPLICIT: ” at the beginning of the subject header of the message.

67
Of course, it should be noted that the proviso in no way relieves non-designated senders of liability for ensuring that their own advertising complies with the FTC Act.

e. List Owners

In the NPRM, the Commission asked whether under CAN-SPAM, third-party list providers who do nothing more than provide a list of names to whom others send commercial emails could be required to honor opt-out requests.
68

Specifically, the NPRM asked whether such list providers could satisfy the statutory definition of sender,
i.e.
, a person that both initiates a message
and
advertises its product, service, or website in the message.

68
70 FR at 25450.

Some commenters opposed extending opt-out responsibilities to third-party list providers because it would be contrary to congressional intent, difficult to implement and monitor, and would impose administrative costs and complexity for legitimate list providers and email marketers.
69

Although the NPRM asked about list owners who have no other involvement in the message besides providing a list of names to others, commenters discussed other list rental arrangements in which both the marketer and the list owner have some degree of control over the content of the message.
70

In those cases, list owners typically do not have control over the specific creative content within an advertisement, but they can approve or disapprove an advertisement for delivery to email addresses on their lists.

69

See
FNB; Jumpstart; Lashback; Schnell; SIA (list providers play a role “similar to that of a telephone directory service,” are neither “advertising or promoting their products and services,” nor “initiating the email,” and accordingly “do not come within the definition of ‘sender’ under the CAN-SPAM Act.”).

70

See, e.g.
, Unsub.

On the other hand, two commenters argued in favor of extending opt-out obligations to third-party list providers.
71

Some of these commenters thought the Commission should clarify that in such situations the list owner exercises fundamental “control” of the content of the message for purposes of the then-proposed regulatory definition of “sender.”
72

Other commenters urged the Commission to adopt the position that a list owner would be considered a sender if the list owner “advertises or promotes” its services merely by being referenced in the “from” line or in the message itself, thereby making it responsible for the opt-out function and other CAN-SPAM compliance.
73

71

See
Adknowledge; EPIC.

72

See, e.g.
, ESPC.

73

See, e.g.
, Adknowledge; Baker; ESPC;
cf.
Microsoft (arguing that it should constitute a deceptive trade practice for a list owner to fail to identify itself and the role that it plays in sending the message, that its identification would be considered advertising or promoting its services, and thus that the list owner would meet the definition of “sender” and have CAN-SPAM liability); Adknowledge (proposing that the Commission make it “mandatory for list owners to advertise or promote themselves in each email message they transmit”).

Because of the variety of situations in which a list owner might be involved in a commercial email, and because none of the commenters provided a workable mechanism for all of these situations, the Commission is persuaded that amending the rules under CAN-SPAM to create a specific provision for list owners is not feasible.

The Commission finds that a list owner must honor opt-out requests only if it qualifies as the “sender” of a commercial email (
i.e.,
it is an initiator and its “product, service, or Internet web site” are “advertised or promoted” in the email). And, if it does qualify as a “sender,” it may avail itself of the multi-marketer proviso added to the definition of sender in the final Rule.

f. Safe Harbor for Email Messages Sent By Affiliates

In the NPRM, the Commission asked whether it should adopt a “safe harbor” with respect to opt-out and other obligations for a sender whose product, service, or website is advertised by affiliates or other third parties. Moreover, the Commission sought guidance on the criteria for a safe harbor.
74

74
70 FR at 25450.

Although the Act does not provide a definition of “affiliate,” the Commission noted in the NPRM that “affiliates” are induced to send commercial email messages by sellers seeking to drive traffic to their websites, and that sellers generally pay affiliates based on the number of individuals who, directed by the affiliates, ultimately visit the seller’s

website and/or purchase the seller’s product or service.
75

75
70 FR at 25428 n.23. According to IAC, in a typical affiliate program, a marketer enters an arrangement with an affiliate to pay the affiliate for referrals to its website. The affiliate can employ a variety of methods to direct consumers to the marketer’s website, including email messages. The affiliate sends email messages containing an advertisement promoting the marketer’s goods or services and a hypertext link to visit the marketer’s website directly from the email message (either as a direct link or through the affiliate’s link, which redirects the recipient to the marketer’s website). If a recipient of the email uses this link to visit the marketer’s website, the marketer logs the visit as attributable to the affiliate’s email. Depending on the arrangement between the marketer and the affiliate, the marketer will pay the affiliate a prescribed amount either for the visit (also known as a “click through”) or for a completed sale, or both. IAC states in its comments that it has thousands of affiliates. For Expedia, one of IAC’s websites, however, the majority of the sales from the affiliate program are generated by a relatively small number of productive affiliates.

Before turning to the issue of whether a safe harbor is appropriate to shield marketers from liability for CAN-SPAM violations of affiliates, two preliminary questions must be considered. First, is the marketer who uses an affiliate an “initiator” under the final Rule? Second, in scenarios where a marketer uses an affiliate, what is the impact of the final Rule on the status of both the marketer and the affiliate as “senders”?

With regard to whether a marketer that uses affiliates is an “initiator,” under the Act, a person is an “initiator” if the person originates, transmits, or “procure[s] the origination or transmission of” a message.
76

In the typical affiliate marketing scenario, the affiliate originates and transmits the message, and is therefore an initiator. The marketer, however, does not originate or transmit the message, but does “
procure
” the origination of the message. The Act defines “procure” as “intentionally to pay or provide other consideration to,
or induce
, another person to initiate[]a message on one’s behalf.”
77

A few commenters argued that a marketer does not actually “initiate” an email message if it does not provide consideration to an affiliate for each
message
, because it provides consideration to the affiliate for
visits
to its website or
completed sales
made as a result of the affiliate’s email messages.
78

According to this argument, in these circumstances, the marketer pays consideration for the
referral
, but not for the
message
itself.

76
15 U.S.C. 7702(9).

77
15 U.S.C. 7702(12) (emphasis added).

78

See
IAC (arguing that affiliates are not “hired” to do anything, but are “simply paid a small fee for referrals,” and that the affiliate emails are “created and transmitted entirely at the discretion of the affiliate.”); Unsub (arguing that the payment structure does not differ from a company renting a mailing list from a third party).

The Commission believes that this interpretation is too narrow. By agreeing in advance to pay an affiliate for sales to persons who come to a marketer’s website as a result of an affiliate’s referral, a seller or marketer creates an inducement for the affiliate to originate or transmit commercial email messages to the public. In the language of the Act, the seller induces another person — the affiliate — to initiate messages on the seller’s behalf.

With regard to the second question, in the typical affiliate program, the marketer is a “sender” because its product, service, or website is promoted in the email message, and the affiliate is only an “initiator.” It is only when the affiliate promotes its
own
product, service, or website along with that of the marketer that the affiliate is also a “sender” under the Act. In such a case, under the final Rule, the affiliate may serve as the designated sender, provided that it is listed in the “from” line of the message and is in compliance with 15 U.S.C. 7704(a)(1), 15 U.S.C. 7704(a)(2), 15 U.S.C. 7704(a)(3)(A)(i), 15 U.S.C. 7704(a)(5)(A), and 16 CFR 316.4. If, however, the affiliate promotes its own product, service, or website in addition to that of the marketer, but does not comply with the designated sender requirements in the final Rule, then
both
the affiliate and the marketer are liable as “senders” under the final Rule.
79

79
In either case, both the affiliate and the marketer are “initiators” under the Act.

A “safe harbor” would absolve a marketer of initiator liability (or of sender liability if the affiliate is not the designated sender under the final Rule) if the marketer takes prescribed steps to ensure that the affiliate complies with CAN-SPAM. Those who commented on this issue were split on whether the Commission should adopt a safe harbor for CAN-SPAM liability for marketers whose products are promoted by affiliates or other third parties. Those opposed to a safe harbor stated that it would allow marketers to circumvent CAN-SPAM requirements.
80

Those in favor of a safe harbor stated that it would: (1) provide clarity to marketers that practice due diligence when selecting third-party email marketers; (2) encourage marketers to maintain reasonable practices and procedures to prevent violations of CAN-SPAM; and (3) effectuate congressional intent.
81

80

See, e.g.
, Amin; Jumpstart; LashBack; Schaefer; Unsub; VFCU.

81

See e.g.
, AeA; ARDA; ERA LashBack; MPAA; NADA.

Many online businesses advocated the adoption of a safe harbor in principle,
82

but only a fraction of those commenters suggested specific components to the safe harbor. Those suggestions included the following requirements: (1) that the contract between the marketer and the affiliate specifically require the affiliate to comply with CAN-SPAM;
83

(2) that the affiliate periodically certify that it complies with CAN-SPAM;
84

(3) that the marketer provide the affiliate with written guidelines on how to comply with CAN-SPAM;
85

(4) that the marketer maintain additional reasonable procedures to determine whether the affiliates are complying with CAN-SPAM;
86

(5) that a marketer comply with its privacy policy relating to the conduct of third parties sending email messages on its behalf;
87

and (6) that a marketer have “flexibility to determine what procedures are reasonable.”
88

82

See
ESPC (noting that it is “generally supportive of safe harbor programs” and “would be very interested in further discussion of such programs”); SIIA (making a “preliminary proposal”); Visa (“such a safe harbor could be based on examples demonstrating relationships that do not result in control of content or email addresses.”); Wahmpreneur (suggesting a safe harbor that would apply to permission-based marketing).

83

See
IAC.

84

See id.

85

See id.

86

See id.

87

See
SIIA; ACLI.

88

See
IAC.

After considering all the comments submitted and in the light of the changes to the Rule’s definition of “sender” for multi-marketer messages as well as its law enforcement experience, the Commission has decided against creation at this time of a “safe harbor” for companies whose products, services, or website are advertised by affiliates or other third parties. First, the requisite criteria for a safe harbor have not been articulated clearly. Second, email marketing models continue to evolve, and there may not be enough transparency in email marketing to support a safe harbor.

The Commission believes that the final Rule’s definition of “sender” gives marketers the necessary flexibility to market their products using email on their own or in conjunction with other parties while at the same time preserving the protections afforded to consumers by CAN-SPAM. If, after marketers have had the opportunity to conduct business under the “sender” definition in the final Rule, concerns about the necessity of a safe harbor persist, the Commission can reconsider this issue.

g. Messages Sent to Members of Online Groups

The NPRM asked whether CAN-SPAM should apply to email messages sent to members of online groups. According to ESPC, online groups are also known as discussion lists, list servs, mailing lists, and chat groups. They often constitute communities engaging in both commercial and non-commercial speech via email. Many such lists are volunteer efforts, but their messages sometimes include commercial content. Lists can be fee-based or free.
89

89

See
ESPC.

Generally discussion groups are permission-based, that is, “opt-in.” Those lists that are free to join often include advertising in messages sent to subscribers, either with or without content relating to the purpose of the group. Depending on the type of discussion group, different individuals may be able to send messages to the entire group. In some groups, any member may send a message; in other groups, only the moderator or list owner may send messages; in still other groups, anyone may send a message, but the message must be approved by a moderator. It is rare for mailing list software to allow subscribers to choose the senders from whom they want to receive messages. In other words, they opt to receive all messages in the discussion group or none at all.
90

90

See
ESPC.

Four commenters stated that they believe online groups should not be subject to CAN-SPAM.
91

They felt that compliance with CAN-SPAM would be too burdensome for unpaid list moderators and might cause them to cease operations, potentially chilling free speech. ESPC argued that email service providers that host mailing list services generally are considered to be engaged in routine conveyance under the Act, taking them outside the definition of initiator under the Act. ESPC also argued that most moderators also would be engaging in routine conveyance when sending messages to the group on behalf of group members.
92

91

See
ESPC; NAEDA; PCIAA; Schnell.

92
The Commission notes, however, that CAN-SPAM defines “routine conveyance” as requiring an “automatic technical process.” 15 U.S.C. 7702(15). Thus, if a list moderator is manually forwarding messages to the group on behalf of group members, the moderator would not be engaged in “routine conveyance.”
See also infra
Part II.A.5 (discussing “routine conveyance” in connection with forward-to-a-“friend” emails).

One commenter urged the Commission not to distinguish between email messages sent to members of groups and email messages sent to recipients who are not members of groups. That commenter stated that an exception from CAN-SPAM would give an unfair advantage to the operators of online groups without compelling justification, and would create an incentive for “group” status that would likely be exploited by aggressive marketers.
93

93

See
Jumpstart.

The Commission believes that CAN-SPAM compliance is not unduly burdensome for online groups. Of course, in some cases, the primary purpose of emails sent by and to online groups will not be commercial, and thus the Act will not apply.
94

However, for those messages with a primary purpose that is commercial, group members should be entitled to the benefits of CAN-SPAM’s opt-out provisions. Indeed, best practices in the industry already require group members to opt into listservs and provide straightforward mechanisms for opting out.
95

The Commission, therefore, has determined not to exempt online groups from CAN-SPAM at this time, but may reconsider the issue in the future should circumstances warrant.

94
Most of the Act’s requirements apply to an email only if it is a “commercial electronic mail message,” which is defined as an email “the primary purpose of which is the commercial advertisement or promotion of a commercial product or service (including content on an Internet web site operated for a commercial purpose).” 15 U.S.C. 7702(2)(A).
See also
16 CFR 316.3 (primary purpose rule).

95

See
ESPC.

3. Section 316.2(o)—Definition of “Transactional or Relationship Message”

CAN-SPAM designates five broad categories of emails as “transactional or relationship messages.”
96

The Act excludes these messages from its definition of “commercial electronic mail message,”
97

and thus relieves them from most of the Act’s requirements and prohibitions.
98

In the NPRM, the Commission proposed no modification to Rule 316.2(n), which incorporates the Act’s definition of “transactional or relationship message” by reference. Under the Act, the Commission can expand or contract the definition of “transactional or relationship message” only if two conditions are met: (1) such modification is necessary to accommodate changes in email technology or practices;
and
(2) such modification is necessary to “accomplish the purposes of [the Act].”
99

None of the 50 comments submitted on this issue demonstrated that an expansion or contraction of the “transactional or relationship message” categories were necessary to accommodate changes in email technology of practices. Accordingly, the final Rule leaves the statutory definition unaltered.
100

The NPRM also invited comment on a series of questions concerning the application of the existing categories of “transactional or relationship messages” to certain types of messages. The Commission has carefully reviewed these comments and discusses its views on these issues below.

96
Section 7702(17)(A) of the Act defines a “transactional or relationship message” as “an electronic mail message the primary purpose of which is —

(i)to facilitate, complete, or confirm a commercial transaction that the recipient has previously agreed to enter into with the sender;

(ii)to provide warranty information, product recall information, or safety or security information with respect to a commercial product or service used or purchased by the recipient;

(iii) to provide —

(I)notification concerning a change in the terms and features of;

(II)notification of a change in the recipient’s standing or status with respect to; or

(III) at regular periodic intervals, account balance information or other type of account statement with respect to, a subscription, membership, account,loan, or comparable ongoing commercial relationship involving the ongoing purchase or use by the recipient of products or services offered by the sender;

(iv)to provide information directly related to an employment relationship or related benefit plan in which the recipient is currently involved, participating, or enrolled; or

(v)to deliver goods or services, including product updates or upgrades, that the recipient is entitled to receive under the terms of a transaction that the recipient has previously agreed to enter into with the sender.”

97

See supra
n.94.

98
Section 7704(a)(1)’s prohibition on false or misleading transmission information applies equally to “commercial electronic mail messages” and “transactional or relationship messages.” Otherwise, CAN-SPAM’s prohibitions and requirements cover only “commercial electronic mail messages.”

99
15 U.S.C. 7702(17)(B).

100
The NPRM asked whether there are any types of messages that erroneously fall outside of the reach of the proposed Rule, and, if so, how such a shortcoming should be remedied. 70 FR at 25450. No commenters identified any such categories of messages.
See, e.g.
, Discover (stating that it was aware of no messages that fall outside the Rule that should be covered by it). Accordingly, the Commission adopts no modification of the definition of “transactional or relationship message” to accommodate any such categories of messages.

a. Legally Mandated Notices

In the NPRM, the Commission asked whether an email message that contains only a “legally mandated notice” —
i.e.
, communications mandated by state or federal law — should be considered a “transactional or relationship message.”
101

Commenters identified messages mandated by the Truth in Lending Act, the Gramm-Leach-Bliley

Act, and the USA PATRIOT Act as well as messages concerning billing errors and changes in terms or account features as examples of legally mandated notices.
102

101
70 FR at 25450.

102

See, e.g.
, ACA; CBA; FNB; NRF.

All 13 commenters that addressed this issue opposed classifying messages that solely contained legally mandated notices as “commercial electronic mail messages.”
103

Commenters were divided on whether such messages should be exempt from the Act,
104

categorized under a new definition of “transactional or relationship message,”
105

or classified under one of the existing, statutory categories of transactional or relationship emails, such as messages to facilitate a commercial transaction that the parties have entered into (section 7702(17)(A)(i))
106

or messages to provide notification regarding a change in the terms and features of an account (section 7702(17)(A)(iii)).
107

103

See
FNB; KeySpan; Schnell; Wells Fargo; ESPC; BOA; ACA; DoubleClick, NRF, HSBC; CBA; Discover; PCIAA.

104

See
Discover; ESPC (arguing that legally mandated notices are either exempt from the Act or transactional or relationship in nature, depending on the content and context of the message in question); FNB; KeySpan (arguing that legally mandated notices should either be exempt from the Act or that the Commission should create a new transactional or relationship category for legally required notes); PCIAA (same); MPAA (arguing that messages containing legally mandated notices are not “commercial electronic mail messages” provided that their commercial content does not exceed the amount reasonably believed by the sender to be required to meet the legal requirement prompting the message); Schnell (“[A]n e-mail message containing only a legally mandated notice should have no standing in CAN-SPAM at all, other than perhaps a routine conveyance. It is not a commercial e-mail message, and is not a transactional or relationship message.”).

105

See
DoubleClick; KeySpan; NRF.

106

See
HSBC (arguing that such an email facilitates the commercial transaction into which the parties have entered).

107

See
ACA; CBA; Wells Fargo; BOA.

The Commission declines either to expand the definition of “transactional or relationship message” to include legally mandated notices or to make a blanket determination that such messages fall under one of the existing categories of transactional or relationship emails. Despite the unanimity of opinion expressed in the comments that such notices should not be treated as commercial in nature, none of the commenters demonstrated that expansion of the definition of “transactional or relationship message” to include legally mandated notices was necessary to accommodate changes in email technology or practices and to accomplish the purposes of the Act.
108

That said, the Commission believes that, in most cases, the types of legally mandated notices described by the commenters likely would be categorized as transactional or relationship messages. Such determinations, however, must be made on a case-by-case basis depending on the specific content and context of such messages. Moreover, if a message providing a non-commercial legally mandated notice also includes commercial content, it should be evaluated under the Commission’s primary purpose criteria as a dual purpose message.
109

108
KeySpan addressed the statutory standard by arguing that “[i]t has become common practice for senders to email legally required notices to individuals who purchased the sender’s products or services online.” The Commission, however, is not persuaded that this is a “change” in email practices that has evolved since the passage of the Act.

109
16 CFR 316.3;
see also
NPRM, 70 FR at 25438.

b. Debt Collection Emails

In the NPRM, the Commission invited comment on the Act’s application to debt collection email messages, including messages sent by a third party on behalf of the seller from whom the recipient purchased goods or services rather than by the seller itself.
110

Nearly all of the 15 commenters that addressed this issue urged that debt collection emails by a seller from whom the consumer made a purchase should be considered transactional or relationship in nature.
111

Most of these commenters also stated that the same conclusion should apply to emails sent by third-party debt collectors.
112

110
NPRM, 70 FR at 25450.

111

See
NADA; Schnell; FNB; ESPC; DMA; NCTA; NNA; Charter; HSBC; CUNA; KeySpan; PCIAA; VFCU.
But see
Discover (arguing that all debt collection emails should be exempt from regulation under CAN-SPAM); ACA (arguing that “at most” debt collection emails should be regulated as “transactional or relationship messages”).

112

See, e.g.
, DMA; ESPC; FNB; NCTA.
But see
Schnell (arguing that debt collection emails from a third party should be considered commercial); Charter (arguing that debt collection messages sent by third-party debt collectors would be neither “commercial” nor “transactional or relationship” messages and thus would fall outside the scope of CAN-SPAM).

The Commission declines to modify the definition of “transactional or relationship messages” to include an express provision addressing debt collection emails because there is no evidence in the record that such a modification is necessary to accommodate new email technology or practices. Such a modification is also unwarranted because debt collection messages will usually qualify as “transactional or relationship messages” under the existing definition of the term. The primary purpose of debt collection emails is not the “advertisement or promotion of a commercial product or service,” and, therefore, they generally would not be “commercial electronic mail messages” under section 7702(2)(A) of CAN-SPAM.
113

Rather, debt collection emails from a seller from whom the consumers made a purchase are best understood as “complet[ing] . . . a commercial transaction that the email recipient has previously agreed to enter into with the sender,” and thus are “transactional or relationship messages” under section 7702(17)(A)(i). Morever, the Commission agrees with the overwhelming majority of commenters that the “sender” with whom the “recipient has previously agreed to enter into” a commercial transaction can be interpreted to encompass a third party acting on behalf of a seller from whom the consumer made a purchase.
114

Thus, an email from a third party collecting on behalf of a seller likely is a “transactional or relationship message.”

113

Cf.
Telemarketing Sales Rule, 68 FR 4580, 4664 n.1020 (Jan. 29, 2003) (“[D]ebt collection . . . activities are not covered by the [Telemarketing Sales Rule, 16 CFR 310] because they are not ‘telemarketing’ —
i.e.
, they are not calls made ‘to induce the purchase of goods or services.’”). If a debt collection email also contains material advertising or promoting a commercial product, service, or website, then it must be analyzed as a dual purpose message under Rule 316.3.

114
Debt collection emails also must comply with other applicable federal and state laws. Significantly, the Fair Debt Collection Practices Act, 15 U.S.C. 1601,
et seq.
(“FDCPA”), imposes limitations on debt collectors’ communications with consumers and third parties. Compliance with CAN-SPAM in no way excuses a debt collector from complying with the FDCPA and other statutes and regulations affecting communications regarding debt collection.

c. Copyright Infringement Notices and Market Research

Two business organizations urged the Commission to clarify that messages containing copyright infringement notices or marketing and opinion research surveys are neither commercial nor transactional or relationship in nature and thus are exempt from the Act.
115

One of these commenters further asserted that an email containing a copyright infringement notice that also provided information on how to obtain a legitimate, licensed version of the copyrighted material in question would not fall within the scope of the Act.
116

In the NPRM, the Commission acknowledged that there may be messages that are neither “commercial electronic mail messages” nor “transactional or relationship messages” as defined by the Act, and thus are not

addressed in CAN-SPAM.
117

As a general matter, the Commission agrees that if a sender has had no previous dealings with the recipient — thus lacking the predicate for a message to be deemed “transactional” — and that sender’s messages contain
only
a copyright infringement notice, the messages also are not primarily commercial in purpose and thus are not subject to the requirements and prohibitions of CAN-SPAM. Nevertheless, where a copyright infringement notice also contains information on how to obtain licensed versions of copyrighted materials, evaluation under the Primary Purpose Rule provisions governing dual purpose messages may lead to the conclusion that such messages are covered by CAN-SPAM.
118

Likewise, emails containing true opinion and research surveys may fall outside the scope of the Act, but to the extent that any such message seeks to advertise or promote a brand, a company, or a product or service to the recipient, it also may be primarily commercial in purpose, and therefore subject to the Act’s requirements and prohibitions.

115

See
BSA (copyright infringement notices); SIA (research and opinion surveys).

116

See
BSA.

117
NPRM, 70 FR at 25433 n.85.

118
16 CFR 316.3.

d. Transactions that Do Not Involve an Exchange of Consideration

The NPRM invited comment on the Act’s application to messages sent pursuant to a relationship in which no consideration passes, such as messages from a “free” Internet service (such as Evite or Shutterfly). No commenters provided any evidence of changes in email practices or technology that would warrant modifying the definition of “transactional or relationship message” specifically to address such messages. Indeed, as explained in the NPRM, even without a Rule change, the existing definition of “transactional or relationship message” includes two categories that could include messages sent pursuant to a relationship in which there has been no exchange of consideration: section 7702(17)(A)(i), under which an electronic mail message the primary purpose of which is to “facilitate, complete, or confirm a
commercial transaction
[emphasis added] that the recipient has previously agreed to enter into with the sender” is deemed transactional or relationship in nature; and section 7702(17)(A)(v), which provides that an email the primary purpose of which is “to deliver goods or services, including product updates or upgrades, that the recipient is entitled to receive under the terms of a
transaction
[emphasis added] that the recipient has previously agreed to enter into with the sender” also qualifies as transactional or relationship in nature. In the NPRM, the Commission explained that it believed an email from a free Internet service to someone who has registered with the service would be considered a message “to deliver goods or services * * * that the recipient is entitled to receive under the terms of a transaction” under section 7702(17)(A)(v) rather than a “
commercial
transaction” under section 7702(17)(A)(i) (emphasis added), but sought comment on this question.
119

119
NPRM, 70 FR at 25434.

Ten of the 13 commenters that addressed this issue took the position that an email message that is primarily for the purpose of facilitating, completing, or confirming a commercial transaction with the sender previously agreed to by the recipient is “transactional” under section 7702(17)(A)(i), even when the transaction at issue involves no exchange of consideration.
120

A few of these commenters argued further that, in any event, many “free” Internet services
do
involve an exchange of consideration; these commenters contended that agreeing to receive commercial email or to view advertising, for example, constitutes consideration.
121

Three commenters argued that a “commercial transaction” under section 7702(17)(A)(i) must involve an exchange of consideration.
122

120

See
Discover; Jumpstart; Mattel; NFCU; NAR; NetCoalition; SIA; Schnell; United; VFCU.

121

See
Jumpstart; United. One commenter also suggested that to protect consumers, trial memberships and other situations where consideration is not paid until a later time should be considered commercial.
See
Schnell.

122

See
ABM; NADA; PCIAA.

The Commission continues to believe that in many cases it is unnecessary to reach the question of whether registration with a “free” Internet service constitutes a “
commercial
transaction” under section 7702(17)(A)(i) (emphasis added), because it is likely a “transaction” under section 7702(17)(A)(v). That said, having reviewed the comments, the Commission has been persuaded that the term “commercial transaction” in section 7702(17)(A)(i) can encompass situations in which there has been no exchange of consideration between the sender and the recipient.
123

This is consistent with the Commission’s interpretation of the term “commercial electronic mail message,” which, as defined in section 7707(2), includes an email the primary purpose of which is the advertisement or promotion of a commercial product or service that is free and does not involve the exchange of consideration so long as it is a “commercial product or service (including content on an Internet website operated for a commercial purpose).” Many free Internet services are undoubtedly engaged in “commerce” and offer consumers goods or services that are “commercial” in nature whether or not they involve an exchange of consideration.
124

123
The NPRM stated that the Commission “believe[d] that the modifier ‘commercial’ has been deliberately omitted from [section 7702(17)(A)(v)] of CAN—SPAM to accommodate just the sort of scenario that IAC and Microsoft raise,”
i.e.
, emails from free Internet services, like Evite, to their members. 70 FR at 25434. Upon further reflection, the Commission has concluded that a transaction between a free Internet website, such as Evite, and its members —
e.g.
, the transaction that occurs when a consumer registers at the website — can reasonably constitute a “
commercial
transaction.”

124
As the Commission noted in the Primary Purpose Rulemaking, 70 FR at 3113, the Random House College Dictionary defines “commercial” as “of, pertaining to, or characteristic of commerce; engaged in commerce.” It defines “commerce” as “an interchange of goods or commodities, especially on a large scale; trade; business.”
Random House College Dictionary 270
(Rev. ed. unabridged 1980). Likewise, the term “commerce” as defined in section 4 of the FTC Act, 15 U.S.C. § 44, is broadly construed to include services that are provided without charge where they include commercial advertising.
See, e.g.
,
Ford Motor Co. v. FTC
, 120 F.2d 175, 183 (6th Cir. 1971) (“Interstate commerce includes intercourse for the purpose of trade which results in the passage of property, persons or messages from within one state to within another state. All of those things which stimulate or decrease the flow of commerce, although not directly in its stream, are essential adjuncts thereto . . . . The use of advertising as an aid to the production and distribution of goods has been recognized so long as to require only passing notice.”).

e. Affiliated Third Parties Acting on Behalf of a Person With Whom the Recipient Has Previously Entered Into a Commercial Transaction

The NPRM invited comment concerning the application of the Act to messages sent by affiliated third parties that are acting on behalf of an entity with whom a consumer has transacted business. All but one of the dozen commenters addressing this issue argued that messages “to facilitate, complete, or confirm a commercial transaction to which the recipient has previously agreed” are generally “transactional or relationship messages” under section 7702(17)(A)(i) regardless of whether the messages were transmitted by the entity with whom the consumer transacted business or an affiliated third party acting on the business’s behalf.
125

125

See
NAEDA; Wahmpreneur; FNB; Wells Fargo; ESPC; NAFCU; NAIFA; CBA; Discover; PCIAA; SIA.
But see
Schnell (arguing against application of section 7702(17)(A)(i) to affiliated third parties).

Because there is no evidence of changes in email technology or practices that would warrant amending the Rule expressly to address messages sent by affiliated third parties that are acting on behalf of an entity with whom the recipient has done business, the Commission does not make any modifications to the Rule concerning such messages. In addition, the Commission notes that the examples provided by commenters (
e.g.
, travel agents, insurance agents) are fairly straightforward examples of types of messages that would likely qualify as a “transactional or relationship message” under section 7702(17)(A)(i).
126

The Commission, however, does not interpret this provision as necessarily covering
every
email message sent by an affiliated third party. For example, if an affiliated third party were to market its own product, service, or Internet website in an email message in which the affiliated third party is also facilitating or completing a transaction on behalf of another vendor, then that message would contain both commercial and transactional content, thus triggering analysis of the primary purpose of the dual purpose message.

126

See
NAIFA; NAIDA; FNB; IAC (comments submitted in response to ANPR); Wahmpreneur. For example, if a consumer purchases an airline ticket on a travel website like Orbitz, a subsequent message from Orbitz or the airline (or both) “to facilitate, complete, or confirm” the message will be a “transactional or relationship message” (or a dual purpose message if there is additional content in the email). Likewise, an email from an insurance agent to a customer can qualify as transactional or relationship in nature notwithstanding the fact the customer paid the premium to the insurer, not its agent.

f. Messages Sent to Effectuate or Complete a Negotiation

In the NPRM, the Commission asked under what circumstances an email sent to effectuate or complete a negotiation should be considered a “transactional or relationship message” under section 7702(17)(A)(i).
127

Twelve of the 13 commenters addressing this issue agreed that such messages should be deemed transactional or relationship messages or should fall outside the scope of the Act.
128

127
NPRM, 70 FR at 25434, 25450.

128

See
NADA; ARDA; FNB; Wells Fargo; BOA; Cendant; SIA; SIIA; CBA; MPAA; KeySpan; Discover.
See also
Schnell (emails to effectuate or complete a negotiation should be deemed transactional or relationship only if the recipient has a reasonable expectation that such a negotiation will occur via email).

The Commission declines to alter the definition of “transactional or relationship message” to address communications for the purpose of effectuating or completing a negotiation because of the lack of any evidence in the record that such a modification would be necessary to accommodate changes in email technology or practices and to further the purposes of the Act. However, even without such a modification, the Commission continues to believe that, as it stated in the NPRM, to the extent that negotiation may be considered a “commercial transaction” that a recipient has previously agreed to enter into, such messages likely would be considered transactional or relationship under section 7702(17)(A)(i) if they were sent to facilitate or complete the negotiation.
129

The Commission, however, does not interpret the term “transactional or relationship message” to include an initial unsolicited message that proposes a transaction and attempts to launch a negotiation by offering goods or services. Likewise, after a party has terminated a negotiation, an email from the other party seeking to restart the negotiations would not be a “transactional or relationship message.”

129
NPRM, 70 FR at 25434.

g. Messages in the Employment Context

In the NPRM, the Commission sought comment on the Act’s application to several types of emails that arise in the employment context. Due to the lack of evidence in the record that would satisfy the statutory standard for modifying the definition of “transactional or relationship message,” the Commission does not adopt any provision in the final Rule concerning such messages.

(i) Messages Concerning Employee Discounts or Similar Messages

The NPRM asked whether it is appropriate to classify emails from employers offering employee discounts or similar messages as communications that “provide information directly related to an employment relationship” under section 7702(17)(A)(iv).
130

In addition, the Commission asked whether it was relevant whether the employee’s email address to which the message was sent had been assigned to the employee by the employer.
131

All 20 commenters that addressed this issue argued either that such messages should be considered “transactional or relationship messages” under section 7702(17)(A)(iv)
132

or that they are neither “commercial” nor “transactional or relationship” messages and thus fall outside the scope of the Act.
133

A consistent theme in the comments was that an employer should be free to send whatever information it wants to an email address that the employer owns and assigns to an employee.
134

In such circumstances, these commenters argued, the employer is both the “sender” and the “recipient” under the Act.

130

Id.
at 25436, 25450.

131

Id.
at 25450.

132

See
Associations; NNA; CBA; NRF; NADA; FNB; MPA; SIIA; Coalition; MPAA; KeySpan; Wells Fargo; BOA; ASTA; DoubleClick; Nextel.

133

See
AeA; Discover; PCIAA; Schnell.

134

See, e.g.
, CBA (“The conclusion must be that an employer can send whatever message it desires to an e-mail account that the employer owns and assigns the employee.”); NRF (“[If] the company provides the e-mail account to the employee primarily for the employer’s benefit, [then] the employer should be free to utilize its own proprietary network to send information to its employees.”).

The comments persuade the Commission that section 7702(17)(A)(iv) should be interpreted to encompass messages that offer employee discounts from employers to email accounts they have provided to their employees. Moreover, there is nothing in the legislative history suggesting that such emails were of concern to Congress in enacting CAN-SPAM. Further, it seems unlikely that employers would inundate their employees’ workplace email accounts with offers of employee discounts and the like and thereby divert their employees’ attention from their job responsibilities.
135

Thus, because the definition of “transactional or relationship message” is broad enough to encompass emails from employers to their employees offering discounts, it is unnecessary to modify the definition to address such messages.

135
The Commission, however, rejects the argument of some commenters that employees should not be deemed “recipients” under the Act of such messages sent by their employers to their employer-provided email addresses.
See, e.g.
, BOA; CBA; Coalition; DoubleClick; DMA; MPA; Wells Fargo. The Act broadly defines the “recipient” as an “authorized
user
of the electronic mail address to which the message was sent or delivered” and does not require
ownership
of the email address. 15 U.S.C. 7702(14) (emphasis added). Consequently, employees are “recipients” of messages delivered to their workplace email accounts, whether such emails were sent by their employers or another person.

(ii) Messages From a Third Party on Behalf of the Recipient's Employer

In the NPRM, the Commission asked whether an email that “provide[s] information directly related to an employment relationship or related benefit plan in which the recipient is currently involved” and that would be a “transactional or relationship message” under section 7702(17)(A)(iv) if it were sent by the recipient’s employer would retain its transactional or relationship character if sent by a third party acting on the employer’s behalf. Most of the handful of commenters that addressed this

question agreed with the Commission’s view that messages sent by a third party on behalf of an employer should be considered transactional or relationship in nature.
136

The Commission reiterates its interpretation of section 7702(17)(A)(iv) as being sufficiently broad to allow an employer to retain a third party as its agent to send a message to its employees that would otherwise fit within the confines of a “transactional or relationship message.”
137

Thus, because the definition of “transactional or relationship message” is broad enough to include a message sent by the third-party agent of an employer to its employees, provided the message would be considered transactional or relationship in nature if sent by the employer itself, there is no need to modify the definition of “transactional or relationship message” to address such messages.

136

See
KeySpan; FNB; MPAA; PCIAA.
But see
Schnell (“commercial messages to employees of a given employer that come from third parties should not be considered transactional or relationship messages, and should be considered commercial under CAN-SPAM”).

137
Nevertheless, the Commission’s interpretation does have its limits. For example, if a third party were to market to a client company’s employees the third party’s own goods and services on its own behalf, rather than on behalf of the client, those messages would not be deemed “transactional or relationship messages” under section 7702(17)(A)(iv).

(iii) Messages Sent After an Offer of Employment is Tendered

In the NPRM, the Commission asked whether, for purposes of section 7702(17)(A)(iv) of the Act, providing information directly related to an employment relationship should include providing information related to such a relationship after an offer of employment is tendered, but prior to the recipient’s acceptance of the job offer.
138

The several commenters that addressed the issue believed that such messages provide “information directly related to an employment relationship” and thus are transactional and relationship in nature.
139

None of the commenters argued that prospective employees would be subject to unwanted commercial email messages from their prospective employers between the time an offer of employment is made and the time it is either accepted or rejected.

138
NPRM, 70 FR at 25436, 25450.

139

See
FNB; KeySpan; Discover; MPAA.

As an initial matter, the Commission notes that, where the primary purpose of an email from an employer to a prospective employee is something other than the promotion or advertisement of a commercial product or service, the message would not be subject to CAN-SPAM’s requirements for commercial email messages.
140

Where, for example, a message provides only information about a prospective employee’s salary and job responsibilities and does not advertise or promote a commercial product or service, it is not a “commercial electronic mail message” under the Act. Rather, an email sent to a prospective employee who has received a
bona fide
offer of employment after actively seeking such employment would be considered information “directly related to an employment relationship or related benefit plan” under section 7702(17)(A)(iv), provided the email concerned only the prospective employment relationship.
141

To the extent, however, that such messages included both information about the job offer
and
an advertisement or promotion of a commercial product or service,
e.g.
, an effort to induce the job applicant to purchase the employer’s goods or services, then the message would be analyzed as a dual purpose message under the Primary Purpose provisions of the Commission’s CAN-SPAM Rules.
142

140
15 U.S.C. 7702(2).

141
One commenter argued that section 7702(17)(A)(iv)’s exemption for employment-related emails “does not go far enough” and that the final Rule should exempt “e-mails regarding current or prospective job openings that are sent to individuals who are not currently employed by the sender, and who are not charged any fees or other consideration in connection with any current or prospective job.” ASA. As noted above, if such emails do not advertise or promote a product or service, they are not commercial email messages and thus they fall outside the Act.

142
16 CFR 316.3.

h. Electronic Newsletter Subscriptions and Other Content that a Recipient is Entitled to Receive as a Result of a Prior Transaction with the Sender

The NPRM asked “where a recipient has entered into a transaction with the sender that entitles the recipient to receive future newsletters or other electronically delivered content, should email messages the primary purpose of which is to deliver such products or services be deemed transactional or relationship messages?”
143

The commenters that addressed this issue generally believed such emails were “transactional or relationship messages” under section 7702(17)(A)(v).
144

Several commenters thought the Commission’s “primary purpose” rule already addressed the issue and supported the position that transmission of a periodical delivered via email “falls within one of the ‘transactional or relationship message’ categories.”
145

In addition, three commenters stressed that it is irrelevant whether electronic newsletters or other content provided via subscription are entirely commercial in nature (
e.g.
, a catalog), so long as the content conforms to the consumer’s reasonable expectations about the material he or she has requested.
146

143
NPRM, 70 FR at 25450.

144

See
NADA; NAEDA; Wahmpreneur; ICC; MPAA; KeySpan; PCIAA; United; IPPC; Jumpstart; NEPA; TimeWarner; DoubleClick; Mattel.
See also
NFCU (electronic newsletters sent to a sender’s members should be entirely exempt from CAN-SPAM); Discover (arguing that primary purpose of a newsletter delivered by email should be determined on a case-by-case basis); Schnell (opining that consumer request for electronic newsletter or other content is not determinative under CAN-SPAM); Sonnenschein (advocating a distinction between the “bona fide transaction [in which a consumer] sign[s] up for a service or subscrib[es] to receive emails, coupons, or electronic newsletters and the mere provision of affirmative consent to receive commercial emails”).

145

See
DoubleClick; MPAA; FNB.

146

See
NEPA; ICC; Sonnenschein.

The comments do not establish the statutory prerequisite to modifying the definition of “transactional or relationship message” expressly to address electronic newsletters and other content sent pursuant to a subscription. Specifically, there is no showing that such a modification is necessary to accommodate changes in email technology or practices and to accomplish the goals of the Act. Moreover, the Commission believes that the existing definition of “transactional or relationship message” already adequately addresses such emails. In view of the comments received on this issue, the Commission continues to believe, as it stated in the Primary Purpose Rulemaking, that when a recipient subscribes to a periodical delivered via email, transmission of that periodical to that recipient falls within section 7702(17)(A)(v), which includes “goods or services . . . that the recipient is entitled to receive under the terms of a transaction that the recipient has previously agreed to enter into with the sender,” provided the periodical consists exclusively of informational content or combines informational and commercial content.
147

On the other hand, when a sender delivers an
unsolicited
newsletter or other periodical via email, and there is no subscription, the situation is materially

different for purposes of CAN-SPAM than when such content is delivered with the consent of the recipient. In such a scenario, the emails likely would not be “transactional or relationship messages” within the meaning of the Act.

147

See
NPRM, 70 FR at 3118. Likewise, the Commission continues to believe that, as it explained in the Primary Purpose Rulemaking, “if an email consists exclusively of commercial content (such as a catalog or other content that is purely an advertisement or promotion), then the email would be a single-purpose commercial message. This is because delivery of such advertising or promotional content would not constitute the ‘delivery of
goods or services
* * * that the recipient is entitled to receive under the terms of a transaction that the recipient has previously agreed to enter into with the sender,’ under section 7702(17)(A)(v).”
Id.
at 3118 n.91.

i. “Business Relationship” Messages

The NPRM asked whether the Commission should expand the Act’s definition of “transactional or relationship message” to include what some commenters call “business relationship messages,” which are individualized messages sent from one employee of a company to an individual recipient (or a small number of recipients) at another business.
148

Or, as one commenter described this type of message “one-to-one e-mail that is sent by employees in the business-to-business context.”
149

The nine commenters who addressed the issue of “business relationship” messages all supported expanding the definition of “transactional or relationship message” to include this type of email. Commenters did not claim that business relationship messages
are
“commercial electronic mail messages” under the Act, but, rather, opined that
if
such messages were deemed “commercial electronic messages,” they would face significant administrative and technological burdens, because business email systems are not designed to scrub each email sent by each employee against the business’s CAN-SPAM opt-out list.
150

In addition, commenters argued that such a requirement would interfere with legitimate practices that are critical to business relationships and operations.
151

To avoid any such potential problems, the commenters urged the Commission to add a new category of “transactional or relationship message” to cover business relationship messages.

148

Id.
at 25438 n.137, 25450. For the most part, commenters described “business relationship messages” as arising in the context of business-to-business communications, rather than communications with individual consumers.
See, e.g.
, BOA (“For example, in the first mortgage business, e-mails are sent to brokers to inform them up-to-the minute information about current mortgage rates.”); CBA (“in the context of the equipment leasing industry, it is typical for lenders to e-mail equipment vendors a rate sheet that describes the amount of interest a lender would charge on a given piece of equipment”); Reed (“For example, our ad sales personnel routinely contact current advertisers about upcoming issues of publications.”).
But see
Cendant (interpreting “business relationship messages” to encompass messages from a business to individual consumers with whom the sender has an existing business relationship).

149

See
CBA.

150

See, e.g.
, BOA; CBA; Wells Fargo; MPAA.

151

See
BOA; CBA; Cendant; ESPC; ICC; KeySpan; MPAA; Reed; Wells Fargo.

None of the commenters, however, demonstrated changes in email technology or practices that would warrant an express carve-out for business relationship messages. For example, there is no evidence that the technological burdens that the commenters cite as a basis for creating the exemption did not exist when the Act was passed in 2003. There is, therefore, an insufficient evidentiary basis to modify the definition of “transactional or relationship message” under the statutory standard. Thus, the Commission declines to add a “business relationship message” category to the definition of “transactional or relationship.”

In any event, the commenters’ concerns about the impact of the Act on the ability of one of their employees to send emails to a small number of employees at another company with which they have a preexisting relationship may be overblown. For example, to the extent an employee at one company provides affirmative consent to receive emails from an employee of another company, or from that company in general, such consent overrides any prior opt-out request.
152

Consequently, when affirmative consent has been given, there is no need to “scrub” the email against the business’s CAN-SPAM opt-out list. Nevertheless, the recipient can always opt out of receiving
future
emails from the sender, notwithstanding his or her prior affirmative consent. As the Commission has previously observed, affirmative consent to receive commercial emails from a sender does not eliminate the sender’s obligation to provide a functioning Internet-based mechanism to opt out of receiving future emails or any of the sender’s other obligations under CAN-SPAM.

152
15 U.S.C. 7704(a)(4)(B).

j. Messages from an Association to its Membership

In the NPRM, the Commission stated that it believes that email messages from an association or membership entity to its members are likely “transactional or relationship messages” under section 7702(17)(A)(v).
153

The Commission inquired whether messages from such senders to
lapsed
members should also be considered transactional or relationship under section 7702(17)(A)(v), and whether messages to lapsed members should be considered commercial electronic messages when they advertise or promote the membership entity.
154

The seven commenters that addressed this question argued that email messages to lapsed members should be considered “transactional or relationship messages,”
155

but most recommended limiting the amount of time that such email messages may be sent to former members.
156

153
NPRM, 70 FR at 25450.

154

Id.

155

See
NAEDA; Independent; NAFCU; CUNA; Cendant; PCIAA; SIIA. In addition, some commenters, while not responding to the NPRM’s inquiry about lapsed members, addressed the question of the Act’s regulation of communications from an association to its current members.
See, e.g.
, Metz; SHRM; ABM; ARTBA; NAR; ACA; ASAE. As the Commission explained in the NPRM, 70 FR at 25438, and reiterates here, messages from an association to its membership are likely transactional or relationship in nature. The Commission continues to believe, however, that there is no basis to expand the existing definition of “transactional or relationship” to create an express exemption for such communications.

156

See
NAEDA (arguing that messages to former members should be allowed and considered transactional or relationship messages for a specific amount of time
e.g.
, 180 days); Independent (arguing that messages to former members are still “transactional or relationship messages” rather than “commercial” messages for 12 months after membership lapses); Cendant (membership entity should be able to contact members for 18 months after last transaction); CUNA (arguing that contact may be made for a reasonable amount of time); PCIAA (stating that, consistent with the Do-Not-Call Rules, an email message to a lapsed member should be considered a “transactional or relationship message” for 90 days after the membership has lapsed); VFCU (arguing that email messages to lapsed members should still be considered transactional or relationship in nature if the purpose is related to administrative matters).
See also
SIIA (arguing against a “
per se
approach” concerning an association’s communications with lapsed members).

Under the existing definition of “transactional or relationship message” the Commission believes that where a recipient is no longer a member of an organization, it is unlikely that messages from the organization fall within any of the categories of “transactional or relationship messages.”
157

For example, a message that advertises or promotes the sale of a new or renewed membership would be a “commercial electronic mail message” (or a dual purpose message to the extent it also includes non-commercial content). However, the Commission declines to modify the definition of “transactional or relationship message” to include such emails. None of the commenters offered any evidence that either such modification is necessary to accommodate changes in email

practices or technology or to accomplish the purposes of the Act, and thus the statutory standard for amending the definition of “transactional or relationship message” is not satisfied.

157
There are, of course, exceptions; for example, an email from a membership organization to a lapsed member to obtain payment of a debt would be a “transactional or relationship” message under section 7702(17)(a)(i), just as a debt collection email from non-membership entity would be transactional and relationship in nature, as discussed above.
See supra
Part II.A.3.b.

4. Section 316.2(p) — Definition of “Valid Physical Postal Address”

Proposed Rule 316.2(p) clarified that a sender may comply with section 7704(a)(5)(A)(iii) of the Act — which requires inclusion in any commercial email message of the sender’s “valid physical postal address” — by including in any commercial email message any of the following: (1) the sender’s current street address; (2) a Post Office box the sender has registered with the United States Postal Service; or (3) a private mailbox the sender has registered with a commercial mail receiving agency (“CMRA”) that is established pursuant to United States Postal Service regulations. A substantial majority of commenters supported the proposed definition. In consideration of these comments, the Commission adopts as a final Rule a modified version of the definition proposed in the NPRM. This modified definition allows for the use of Post Office or private mailboxes, but clarifies that a sender must “accurately” register such mailboxes pursuant to postal regulations to be considered a “valid physical postal address” under the Act. Comments addressing the proposed definition are discussed in detail below.

In response to the NPRM, the Commission received 25 comments addressing the definition of “valid physical postal address.” Of these, 18 commenters supported the definition as proposed. Specifically, supporters noted that the proposed definition appropriately recognized that many legitimate businesses, large and small alike, use Post Office boxes or private mailboxes, and that allowing commercial email messages to disclose such a P.O. box or private mailbox would provide flexibility and security to email marketers without compromising law enforcement efforts.
158

Other commenters, including small businesses and independent contractors, supported the proposed definition because it recognizes the privacy and security concerns of individuals who work from home or are fearful of publishing their street address for other reasons.
159

158

See, e.g.
, ACLI; ACB; DMA; DoubleClick; NNA; SIA.

159

See
Discover; Independent; NAR.

Two additional commenters supported the Commission’s proposal that P.O. boxes and private mailboxes be included under the definition of “valid physical postal address,” but objected to the additional requirement that the sender be registered with the United States Postal Service (“USPS”). Specifically, HSBC Bank Nevada (“HSBC”) and MasterCard suggested that the definition be modified to allow for any address to which mail is delivered for a particular sender, whether or not that sender is registered with the USPS.
160

HSBC noted that several affiliated companies often will receive mail at the same P.O. box, yet not all such companies may be registered to use that box with the USPS, as the proposed definition would require.
161

HSBC and MasterCard argued that their proposed modifications would achieve the purposes of the Act by providing consumers with a mechanism to contact senders other than by email.
162

The approach suggested by MasterCard and HSBC, however, does not take into account the other important purpose of the valid physical postal address provision — that law enforcement authorities be able to identify a sender using a given address, which would be difficult if not impossible without registration of all mailbox users with the USPS.
163

160

See
HSBC; MasterCard.

161

See
HSBC.

162

See
HSBC; MasterCard.

163
Under USPS regulations, federal, state, or local government agencies may obtain postal and private mailbox registrant information from the USPS upon written certification that such information is required to perform the agency’s duties. 39 CFR 265.6(d)(4) & (d)(9). This is one avenue that law enforcement can pursue in order to identify a sender that fails to comply with CAN-SPAM.

Furthermore, USPS regulations require that anyone registering an individual P.O. box identify the names of all persons authorized to receive mail at such address, and to provide two forms of identification for each listed person.
164

Similarly, with respect to “organization” P.O. boxes or private mailboxes where the applicant is a “firm,” USPS regulations require any of the organization’s members or employees who receive mail at such mailbox to be listed on the requisite postal form.
165

Thus, USPS regulations specifically require that anyone receiving mail at a given address be registered with the USPS.

164

See
Domestic Mail Manual (“DMM”) 508.4.3.1(b) (other adult persons who receive mail in the post office box of an individual box customer must be listed on Form 1093 and must present two items of valid identification to the post office).

165

See
DMM 508.4.3.1(c) (requiring an organization’s employees or members who receive mail at the organization’s postal box to be listed on Form 1093; each person must have verifiable identification and present this identification to the Postal Service upon request) and PS Form 1583 (if applicant is a firm, applicant must provide the name of each person whose mail is to be delivered).

Only five commenters opposed the Commission’s proposed definition of “valid physical postal address.” Three of these commenters felt that P.O. boxes and private mailboxes should not be included in the proposed definition because they are often used in fraud schemes as a way to shield their owners from identification.
166

The Commission previously addressed this argument in the NPRM, noting that “‘[a]n individual or entity seeking to evade identification can just as easily use inaccurate street addresses’ as hide behind a Post Office box or private mailbox.”
167

No commenters provided any information to refute this statement.

166

See
CUNA; NFCU; Sowell.

167
NPRM, 70 FR at 25439 (quoting SIIA).

One consumer commenter opposing the proposed definition suggested that P.O. boxes have proven insufficient as a means of contacting senders that fail to honor opt-out requests.
168

The Commission, however, has no evidence to suggest that certain senders are difficult to contact
because of the fact
that those senders have provided P.O. boxes or private mailboxes as their contact addresses. It is more likely the case that such senders are unscrupulous and have either provided a false or nonexistent address as a means of evading identification, or simply do not respond to consumer inquiries. In such instances, the Commission sees no added benefit to requiring that senders provide a street address, which could just as easily be falsified or simply disregarded.

168

See
Kapecki.

Finally, ACUTA suggested that the Commission assess and evaluate the relevant postal regulations to ensure that they adequately protect the interests of consumers and law enforcement.
169

Such evaluation, however, goes beyond the scope of this rulemaking

[Text truncated at 120,000 characters. The full text is on the page linked above.]

---

Source: Frix Law Library, https://www.frixlaw.com/law-library/documents/fr%3AE8-11394. Public record. Not legal advice.