Federal CAN-SPAM Act of 2003
The Controlling the Assault of Non-Solicited
Pornography and Marketing Act requires
unsolicited
commercial
e-mail messages to be
labeled (though not by a standard method) and to include
opt-out
instructions and the sender's physical address. It prohibits the use of
deceptive subject
lines and false
headers in such messages. The
FTC is authorized
(but not required) to establish a
"do-not-email"
registry. State laws that require labels on unsolicited commercial e-mail
or prohibit such messages entirely are pre-empted, although provisions merely
addressing falsity and deception would remain in place. The CAN-SPAM Act takes
effect on January 1, 2004.
The CAN-SPAM Act of 2003 was introduced by
Senators Conrad R. Burns (R-MT) and Ron Wyden (D-OR) in April 2003, with minor
changes from the previous year's version, S. 630 (2002). Two other bills
(S. 1231 and S. 1293) were subsequently merged into it. The final version was
approved by the Senate in November 2003 and by the House of Representatives in
December 2003, and was signed into law by President Bush on December 16, 2003.
Alaska
Alaska enacted a law in May 2003 that requires a
label ("ADV:ADLT")
at the beginning of the
subject line of
any sexually explicit
unsolicited
commercial
e-mail message, if the sender knows that the recipient is an Alaska resident.
Arizona
An Arizona law enacted in May 2003 requires that
unsolicited
commercial
e-mail messages include a
label ("ADV:") at
the beginning of the
subject line, and contain an
opt-out
mechanism. Such messages may not contain falsified
routing information.
The law prohibits false or misleading subject lines in all commercial e-mail,
and prohibits the use of a third party's Internet address or domain name
without consent in order to make it appear that the third party sent the
message. The law applies if a message is sent from within Arizona, or if the
recipient's service provider is based in or has equipment in Arizona, or if
the sender knows or has reason to know that the recipient is an Arizona
resident.
Arkansas
Under Arkansas laws enacted in April 2001 and April 2003, all
commercial
and sexually explicit e-mail messages must include a functioning
reply e-mail
address and opt-out
instructions; opt-out requests must be honored.
Unsolicited
sexually explicit messages must also contain a
label ("ADV:ADULT")
at the beginning of the
subject line. In
addition, unsolicited commercial and sexually explicit messages must include
the sender's name, physical address, and domain name, and may not use a third
party's domain name without permission, nor misrepresent the point of origin
or routing
information. It is illegal to distribute software designed to falsify
routing information.
California
In September 2003, legislation was approved in California that made it the
second state (after Delaware) to adopt an
opt-in rule for
e-mail advertising. Under this legislation, it is illegal to send
unsolicited
commercial
e-mail from California or to a California e-mail address. The law applies to
senders as well as to advertisers on whose behalf messages are sent. It also
includes less restrictive rules from which the broad prohibition may be
severed in the event that it is struck as unconstitutional. (California's
prior law, approved in September 1998, required opt-out disclosures and
subject-line labels.)
Colorado
The Colorado Junk Email Law, enacted in June 2000, prohibits the sending of
unsolicited
commercial
e-mail that uses a third party's Internet address or domain name without
permission, or contains false or missing
routing information.
Unsolicited commercial e-mail messages must contain a
label ("ADV:") at
the beginning of the
subject line, and must include the sender's e-mail address and
opt-out
instructions; opt-out requests must be honored. The law applies to e-mail that
is sent to Colorado residents via a provider's service or equipment located in
Colorado.
Connecticut
A Connecticut law enacted in June 1999 makes it illegal to send
unsolicited
bulk e-mail
containing falsified
routing information in violation of a
provider's
policies, or to
distribute software designed to falsify routing information. A court may
exercise personal jurisdiction over a nonresident who uses a computer or
computer network located in Connecticut.
Delaware
Under legislation approved in July 1999, it is illegal to send
unsolicited
bulk
commercial
e-mail, to send unsolicited bulk e-mail containing falsified
routing information,
or to distribute software designed to falsify routing information. The law
applies to messages originating outside the state if the recipient is located
in Delaware and the sender is aware of facts making the recipient's presence
in Delaware a reasonable possibility.
Florida
Florida has not enacted spam legislation, although a Florida bar rule (Fla.
R.P.C. 4-7.6(c)(3)) requires attorneys who advertise via unsolicited
e-mail to put "legal advertisement" in the subject line.
Idaho
A law approved in April 2000 requires that
unsolicited
bulk
commercial
e-mail messages must include an e-mail address for
opt-out requests
and requires senders to honor opt-out requests. Such messages may not use a
third party's name for the return address without permission, and must contain
accurate routing
information.
Illinois
Legislation approved in July 1999 makes it illegal to send an
unsolicited
commercial
e-mail message using a third party's domain name without permission;
containing falsified
routing information; or with a false or misleading
subject line.
The law was amended in July 2003 to require inclusion of the sender's valid
reply e-mail
address or toll-free telephone number for
opt-out
requests, along with a
label ("ADV:" or "ADV:ADLT") at the beginning of the subject line. The law
applies to e-mail that is delivered to an Illinois resident via a
provider's
facilities located in Illinois. A separate provision makes it illegal to send
unsolicited bulk
e-mail with falsified routing information or to distribute software designed
to falsify routing information.
Indiana
An Indiana law approved in April 2003 prohibits
commercial
e-mail that uses a third party's domain name without permission, includes a
false or misleading
subject line, or misrepresents its point of origin or other
routing information.
Unsolicited
commercial e-mail messages must include a
label ("ADV:" or "ADV:ADLT")
at the beginning of the subject line, along with
opt-out
instructions. The law applies to messages sent from outside Indiana if the
sender knows that the recipient is an Indiana resident, or if that information
is available upon request from the registrant of the domain name contained in
the recipient's e-mail address.
Iowa
An Iowa law approved in May 1999 prohibits the sending of
unsolicited
bulk e-mail that
uses a third party's name for the
return address
without permission, or contains false or missing
routing information.
Unsolicited bulk
commercial e-mail messages must include
opt-out
instructions and contact information, and opt-out requests must be honored.
The law applies to e-mail that is sent to or through a computer network
located in Iowa.
Kansas
Under a Kansas law enacted in May 2002,
commercial
e-mail messages may not contain falsified
routing information,
use a third party's domain name without permission, or have a false or
misleading subject
line. Senders of commercial e-mail messages must include
opt-out
instructions and honor opt-out requests.
Unsolicited
bulk commercial
e-mail messages (500 or more recipients) and advertisements for sexually
explicit content must contain a
label ("ADV:" or "ADV:ADLT")
at the beginning of the subject line. The law applies if a message is sent
from within Kansas, or if the sender knows that the recipient is a Kansas
resident. The law also prohibits the distribution of software designed to
falsify routing information.
Kentucky
Kentucky has not enacted spam legislation. A Kentucky Supreme Court rule (Ky.
Sup. Ct. R. 3.130(7.09)(3), as amended effective January 2002) requires
attorneys who advertise via written, recorded, or electronic communication
targeted at potential clients to include the words "THIS IS AN ADVERTISEMENT"
prominently in each communication.
Louisiana
A Louisiana law approved in July 1999 makes it illegal to send
unsolicited
bulk
commercial
e-mail to more than 1,000 recipients if the e-mail messages contain falsified
routing information
or the sender uses a
provider's
facilities to transmit the messages in violation of the provider's
policies. The
law also prohibits the distribution of software designed to falsify routing
information. Louisiana's obscenity law was amended in June 2003 to cover
electronic communications. Commercial e-mail messages with sexually explicit
content must include a
label ("ADV-ADULT") at the beginning of the subject line.
A Louisiana bar rule (Rules of Professional Conduct,
Rule 7.2(b)(iii)(B)) was
amended in November 2001 to require attorneys who advertise via unsolicited
e-mail targeted at potential clients to use a subject line that states "This
is an advertisement for legal services."
Maine
Maine enacted legislation in May 2003 that requires
unsolicited
commercial
e-mail to contain a
label ("ADV:" or "ADV:ADLT") at the beginning of the
subject line,
and include the sender's name and valid e-mail address and
opt-out
instructions; opt-out requests must be honored. Such messages may not use a
third party's Internet address or domain name without permission, nor contain
falsified routing
information. The law applies to messages sent to two or more recipients
within the state.
Maryland
Under a Maryland law enacted in May 2002, it is illegal to send a
commercial
e-mail message that uses a third party's domain name without permission; that
contains false or missing
routing information;
or with a false or misleading
subject line.
The law applies if a message is sent from within Maryland; if the sender knows
that the recipient is a Maryland resident; or if the registrant of the domain
name contained in the recipient's address will confirm upon request that the
recipient is a Maryland resident.
Michigan
Unsolicited
commercial
e-mail messages must include the sender's legal name, street address, domain
name, and valid return
e-mail address, along with an
opt-out
mechanism; a label
("ADV:") must appear at the beginning of the
subject line.
These provisions apply if a message is sent through an e-mail service provider
that the sender knows or should know is located in Michigan, or to an e-mail
address that the sender knows or should know is held by a Michigan resident.
In addition, unsolicited commercial e-mail messages sent through Michigan
providers or to Michigan residents may not misstate the point or origin or
routing information.
The law also prohibits the distribution and possession of software designed to
falsify routing information.
Minnesota
A Minnesota law enacted in May 2002 prohibits
commercial
e-mail that uses a third party's domain name without permission, contains
false routing
information; or has a false or misleading
subject line.
Such messages must contain
opt-out
instructions and contact information.
Unsolicited
commercial e-mail messages must contain a
label ("ADV:" or
"ADV-ADULT") at the beginning of the subject line. The law applies to messages
sent to Minnesota residents through facilities located in Minnesota.
Missouri
A Missouri law enacted in June 2000 requires
unsolicited
commercial
e-mail messages to contain
opt-out
instructions and contact information. Additional provisions enacted in July
2003 prohibit false or misleading
subject lines,
require a label
("ADV:" or "ADV:ADLT") at the beginning of the subject line, and require
senders to honor opt-out requests.
Nevada
In July 1997 Nevada became the first state to enact spam legislation. As
amended in 2001 and 2003, Nevada law provides that it is illegal to send
unsolicited
commercial
e-mail unless it is
labeled "ADV" or "ADVERTISEMENT" at the beginning of the
subject line,
and includes the sender's name, street address, and e-mail address, along with
opt-out
instructions. Nevada law prohibits all unsolicited e-mail that contains
falsified routing
information; that is sent with the intent to disrupt the normal operation
or use of a computer, Internet site, or e-mail address; or that is reasonably
likely to cause such disruption. The state also prohibits the distribution of
software that is designed to falsify routing information.
New
Mexico
New Mexico enacted legislation in April 2003 requiring that
unsolicited
commercial
e-mail messages contain a
label ("ADV:" or "ADV:ADLT")
at the beginning of the
subject line,
and opt-out
instructions at the top of the message body.
North Carolina
Legislation approved in June 1999 makes it illegal to send
unsolicited
bulk
commercial
e-mail containing falsified
routing information,
if the sender thereby violates a
provider's
policies. The
law applies to e-mail sent into or within the state.
North Dakota
A North Dakota law enacted in April 2003 prohibits the sending of
unsolicited
commercial
e-mail messages that contain a false or misleading
subject line,
use a third party's domain name without permission, or misrepresent the point
of origin or routing
information. All commercial e-mail messages must include an
opt-out
mechanism. In addition, unsolicited commercial messages must contain a
label ("ADV" or
"ADV-ADULT") at the beginning of the subject line. The law applies to messages
sent from outside the state if the sender knows that the recipient is a North
Dakota resident, or if that information is available upon request from the
registrant of the domain name contained in the recipient's e-mail address.
Ohio
An Ohio law approved in August 2002 requires
unsolicited
commercial
e-mail messages to contain the sender's name, address, and e-mail address,
along with opt-out
instructions, and requires senders to honor out-out requests; these
requirements do not apply to messages sent based upon a "direct referral" from
another person. It is illegal to forge the sender's address or other
routing information
in commercial e-mail messages. The law also enables a
provider to sue
a sender of commercial e-mail for violating the provider's
policies if (1)
the sender had actual
notice of such policies, or (2) the policies were posted on the provider's
web site and were communicated electronically to the sender's computer.
Oklahoma
An Oklahoma law approved in June 1999 and amended in April 2003 makes it
illegal to send an e-mail message that contains false or missing
routing information,
or to distribute software designed to falsify such information.
Unsolicited
commercial
e-mail messages must include a
label ("ADV:" or
"ADV-ADULT:") at the beginning of the
subject line,
and must contain
opt-out instructions. Such messages may not contain a false or misleading
subject line, nor use a third party's Internet address or domain name in order
to make it appear that the third party sent the message. A court may exercise
personal jurisdiction over a nonresident who sends a message to or through the
network of a provider located in Oklahoma.
Oregon
Oregon approved legislation regulating unsolicited commercial e-mail in
September 2003. (A summary of this legislation is being prepared.)
Pennsylvania
Under Pennsylvania laws approved in June 2000 and December 2002,
unsolicited
commercial
e-mail may not use a third party's domain name without permission or include a
false or misleading
subject line, and must include a valid
reply address and
an opt-out
mechanism. Sexually explicit unsolicited commercial e-mail must contain a
label
("ADV-ADULT") at the beginning of the subject line. In addition, falsification
of routing
information in unsolicited e-mail is unlawful, as is the distribution of
software designed to facilitate falsification of routing information.
Rhode Island
Under legislation approved in July 1999, it is illegal to send
unsolicited
bulk e-mail with
falsified routing
information using a Rhode Island
provider in
violation of the provider's
policies, or to
distribute software designed to falsify routing information. A separate law
requires unsolicited
commercial
e-mail messages to include
opt-out
instructions and contact information, and opt-out requests must be honored; it
is illegal to send unsolicited commercial e-mail using a third party's domain
name without permission or containing false routing information. This law
applies to messages sent from a computer located in Rhode Island and to
messages sent into the state, if the sender had reason to know that the
recipient was a Rhode Island resident or the recipient had previously
submitted an opt-out request to the sender.
South Dakota
Legislation approved in February 2002 prohibits sending
commercial
e-mail that misrepresents or obscures its point of origin or
routing information,
or contains a false or misleading
subject line.
The law applies if a message is sent from within South Dakota; if the sender
knows that the recipient is a South Dakota resident; or if the registrant of
the domain name contained in the recipient's address will confirm upon request
that the recipient is a South Dakota resident.
Unsolicited
commercial e-mail messages must contain a
label ("ADV:" or "ADV:ADLT")
at the beginning of the
subject line.
Tennessee
Under legislation approved in June 1999,
unsolicited
bulk
commercial
e-mail messages must include
opt-out
instructions and contact information, and opt-out requests must be honored.
Certain messages must contain a
label ("ADV:" or "ADV:ADLT")
at the beginning of the
subject line.
The law applies to e-mail that is delivered to a Tennessee resident via a
provider's
facilities located in Tennessee. The distribution of software designed to
falsify routing
information is also prohibited. (Use "without
authority" is
defined to include sending unsolicited bulk e-mail in violation of a
provider's policies,
although the statute does not provide any consequences for such use.)
Texas
Texas enacted legislation in June 2003 requiring that
unsolicited
commercial
e-mail messages include a
label ("ADV:" or
"ADV: ADULT ADVERTISEMENT") at the beginning of the
subject line,
and a functioning return e-mail address for
opt-out
requests, which must be honored. The law prohibits unsolicited commercial
messages with falsified
routing information.
False, deceptive, or misleading subject lines are prohibited in all commercial
e-mail messages, as is the unauthorized use of a third party's domain name.
Utah
Legislation enacted in March 2002 applies to
unsolicited
commercial
e-mail and unsolicited sexually explicit e-mail that is sent through a
provider in
Utah or to a resident of Utah. Such messages must disclose the sender's name
and physical address, and the point of origin of the message; and must include
a label ("ADV:" or
"ADV:ADULT") at the beginning of the
subject line,
along with opt-out
instructions. The law also prohibits the falsification of
routing information
in such messages.
Virginia
Legislation approved in March 1999 makes it illegal to send
unsolicited
bulk e-mail
containing falsified
routing information, if the sender thereby violates a
provider's
policies, or to
distribute software designed to falsify routing information. A court may
exercise personal jurisdiction over a nonresident who uses a computer or
computer network located in Virginia. The law was amended in April 2003 to
increase the penalties for sending a high volume of messages containing
falsified routing information.
Washington
Under a Washington state law enacted in March 1998 and amended in May 1999,
it is illegal to send a
commercial
e-mail message that uses a third party's domain name without permission; that
contains false or missing
routing information;
or with a false or misleading
subject line.
The law applies if a message is sent from within Washington; if the sender
knows that the recipient is a Washington resident; or if the registrant of the
domain name contained in the recipient's address will confirm upon request
that the recipient is a Washington resident.
West Virginia
A law enacted in March of 1999 makes it illegal to send
unsolicited
bulk e-mail
messages in violation of a
provider's
policies that
use a third party's domain name without permission, misrepresent the point of
origin or other
routing information, have a false or misleading
subject line, or
contain sexually explicit materials. Each message must include the sender's
name and return e-mail address, along with the date and time it was sent. It
is also illegal to distribute software designed to falsify routing
information. The law applies if a message is sent from a computer located in
West Virginia, or if the sender knows or has reason to know that the recipient
is a resident of West Virginia.
Wisconsin
In June 2001 Wisconsin enacted a statute that requires
unsolicited
commercial
e-mail messages that contain obscene material or depict sexually explicit
conduct to include the
words "ADULT ADVERTISEMENT" in the
subject line. A
separate Wisconsin statute prohibits e-mail harassment (Wis.
Stat. § 947.0125), but does not appear to apply to most unsolicited bulk
or commercial e-mail.
Wyoming
A Wyoming law approved in March 2003 (effective July 1, 2003) prohibits
commercial
e-mail that uses a third party's domain name without permission, includes a
false or misleading
subject line, or misrepresents its point of origin or other
routing information.
It is unlawful to assist in the transmission of such messages, which
apparently includes operating an
open relay.
The law applies to messages sent from outside Wyoming if the sender knows that
the recipient is a resident of Wyoming or a jurisdiction with a similar law,
or if that information is available upon request from the registrant of the
domain name contained in the recipient's e-mail address.
| 
