Privacy and Security Alert: The FTC Approves Long-Awaited CAN-SPAM Discretionary Rule
5/13/2008
More than two and a half years have passed (and over 150 comments received) since the Federal Trade Commission (FTC or the “Commission”) issued its discretionary Notice of Proposed Rulemaking (NPRM) under the Controlling the Assault of Non-Solicited Pornography and Marketing Act of 2003 (“CAN-SPAM” or the “Act”). On May 12, 2008, the FTC announced that the Commission has approved by unanimous vote the final Discretionary Rule (“final Rule”) under CAN-SPAM.
The final Rule specifically addresses four topics, including modifying the definitions of the terms “sender” and “person,” and tightening restrictions on what companies can and cannot require of e-mail recipients who opt-out of future e-mails.
The final Rule clarifies some of the requirements of CAN-SPAM by:
- setting forth the specific types of entities to which the Act applies by adopting a broad definition of the term “person”1;
- modifying the definition of the term “sender” to allow multiple entities advertising or promoting their products, services, or web sites in a single e-mail message to designate one sender of the message in the “from” line of the e-mail that will be solely responsible for honoring opt-out requests made by recipients of the message;
- adopting a modified definition of “valid physical postal address” that allows senders to include in their commercial e-mails a private mailbox or post office box that has been accurately registered pursuant to United States Postal Service regulations; and
- prohibiting the imposition of a fee, any requirement to provide personally identifiable information other than an e-mail address, or any other obligation as a condition for accepting or honoring a recipient’s opt-out request.
Additionally, in the Statement of Basis and Purpose (SBP) accompanying the final Rule, the Commission explains its determination not to expand the definition of a “transactional or relationship message,” or reduce the 10-business-day period for processing recipients’ opt-out requests. Among other things, the NPRM had proposed a change to the current 10-day opt-out period and suggested that the FTC may shorten the opt-out period to three business days. The SBP indicates that the overwhelming response from commenters described operational challenges that would make it overly burdensome to comply with a three-day opt-out and thus the Commission retained the 10-day opt-out. The SBP also discusses the Commission’s determination not to designate additional “aggravated violations” related to commercial e-mails beyond those already provided under the Act, and its views on the Act’s applicability to “forward-to-a-friend” e-mail marketing campaigns in which someone either receives a commercial e-mail message and forwards the e-mail to another person, or uses a Web-based mechanism to forward a link to or copy of a Web page to another person. While the Commission pointed out that CAN-SPAM’s application to “forward-to-a-friend” messages is a highly fact-specific inquiry, it did state that the application of the Act will likely rest on whether the seller has offered to pay or provide other consideration to the forwarder. Specifically, if the seller does, in fact, offer something of value in exchange for forwarding a commercial message, the seller will be required to comply with the Act’s requirements for a sender, such as the opt-out requirement.
The provisions of the final Rule will become effective 45 days after the date of publication in the Federal Register. According to FTC Spam Coordinator Sana Chriss, Federal Register publication is expected on or around May 16, 2008. A copy of the SBP is available on the FTC’s web site here.
Endnotes
1“Person” is defined as “any individual, group, unincorporated association, limited or general partnership, corporation, or other business entity.”
For assistance in this area, please contact:
Cynthia Larose
(617) 348-1732
CLarose@mintz.com
or any member of your Mintz Levin client service team.
