Spam law limits use of e-mails by companies

Lori E. Worley is a corporate attorney with Lathrop & Gage L.C. in Kansas City. This column is made available by The Missouri Bar as part of Law Day.

Every day in America, people are unproductive and inefficient because they're drowning in spam.

They sift through hundreds of e-mails that advertise the latest herbal supplements and diet pills; urge them to forward an e-mail to 20 friends to grant a dying child's last wish; or offer the chance to earn $15,000 a week from home.

To add to the aggravation, legitimate e-mail messages get lost or overlooked in the quagmire of offers, hoaxes and scams.

How can a business with a legitimate product or service rise above this garbage and succeed through e-mail marketing? How can these businesses get consumers to actually read and respond to their notices? Can your company even use e-mail marketing and messages, now that Congress has passed a law prohibiting spam?

The answer to the first two questions is: Establish customer loyalty and brand recognition by operating ethically and with integrity, and follow the law. As for the third question, this article discusses how you can comply with the new federal anti-spam law and ensure your e-mails do not show up on the Federal Trade Commission's or a state attorney general's radar screens.

The new federal anti-spam law, known as the Controlling the Assault of Nonsolicited Pornography and Marketing Act of 2003 (CAN-spam Act) took effect Jan. 1. It establishes electronic marketing requirements for e-mail marketers, and replaces the contradictory and conflicting patchwork of state commercial e-mail laws.

The CAN-spam Act applies to unsolicited commercial e-mails, or spam, and allows the FTC or any state attorney general to bring actions against violators, and seek remedies including injunctions, actual damages and statutory damages of $250 per e-mail (capped at $2 million if no misrepresentation occurred). Damages can be tripled if the court finds the violator willfully and knowingly violated the law. Internet service providers also may bring actions against violators in some instances, but the law sets damages at $100 per e-mail if the sender misrepresented its identity and $25 per e-mail (capped at $1 million) if the sender committed no other violation. Private actions by individuals are not permitted.

Your e-mails will fall within the act's scope if they fall under one of two categories: relationship/transactions messages or commercial electronic messages.

RTMs are messages that apply to warranty upgrades, account information and e-mails confirming an order for goods or services. If you send RTMs to your customers, you must follow these requirements:

1. Do not use fraudulent headers (do not create "false" e-mail accounts or domains to send untraceable e-mail);

2. Do not disguise the origin of your e-mail;

3. Do not use deceptive or misleading information in "from" and "subject" lines;

4. Do not promote a business that uses false information in its headers;

5. Do not allow another business to promote you if they use false information in your headers;

6. Do not display outdated contact information. Make sure your domain name is registered with the correct postal address, a working e-mail address and phone number.

CEMs are messages that advertise a product or service. Generally, all marketing-type e-mails will fall into the CEM category. If your company sends CEMs:

1. Do not allow outside e-mail to go through your servers without your permission; turn off your computers' open mail relays.

2. Do not send CEMs through another person's server without their permission.

3. Do not populate lists through dictionary attacks, harvested e-mails or randomly generated e-mail addresses.

4. Do not purchase distribution lists that use those tactics.

5. Do not rent or sell e-mail addresses or use e-mail addresses for marketing purposes if it violates your privacy policy.

What companies should do in CEMs:

1. Use accurate header information.

2. Include an "unsubscribe" mechanism in every e-mail.

3. Remove all unsubscribe requests within 10 days after receiving them.

4. Include the sender's valid physical postal address.

5. Provide a reason why the recipient received your CEM.

6. Include a functioning return e-mail address that will accept e-mail for at least 30 days after you send the CEM and has enough capacity to accept consumer responses, including automated "out of office" and other messages.

7. Include an "ADV" (advertisement) label on the subject line of CEMs being sent without the recipient's express not implied permission.