NOTE: To use the advanced features of this site you need javascript turned on.

Home arrow H&B News arrow CAN-SPAM Update
CAN-SPAM Update Print E-mail

he Federal Trade Commission (“FTC”) recently issued its final Discretionary Rule (“Final Rule”) that interprets the CAN-SPAM Act of 2003 (“CAN-SPAM”).  CAN-SPAM is the federal law that regulates how marketers may send commercial email.  While the Final Rule retains many of the provisions first introduced in the proposed rule the FTC issued in May 2005, there are nevertheless some significant changes.  An executive summary and a more in-depth analysis follow. 


    The Final Rule sets forth several new compliance obligations as to how marketers may market their goods and services via email.  As such, we recommend that marketers take the following considerations into account when structuring and implementing their commercial email campaigns:
  • Prior to participating in a multi-party email campaign, marketers may wish to ensure that the emails are designed in a manner that properly designates a single party as the sender. 

  • Websites that contain “forward-to-a-friend” mechanisms should scrub the addresses of the potential recipients against the company’s do-not-email list if consideration is involved. 

  • Companies should review their opt-out procedures to confirm that they provide a simple and free way for individuals to decline the receipt of subsequent commercial email. 

  • If a post office box is listed as the email sender’s physical address, companies should verify that the registration was completed in a manner compliant with United States Postal Service (“USPS”) regulations. 

  • Companies should review any transactional or relationship emails that they transmit to ensure that the emails properly qualify for the exemption.


Multi-Party Emails

CAN-SPAM places the burden of compliance on the “sender” of a commercial email message.  CAN-SPAM generally defines a “sender” as a party that initiates the transmission of a commercial email containing promotional material about that party’s goods or services.  A sender must ensure that the email:  (1) contains a disclosure that the message constitutes advertising, (2) lists a valid physical postal address for the sender and (3) provides a method for the recipient to opt out of the receipt of future email. 

The FTC noted several classes of email where CAN-SPAM compliance is not necessary.

Based upon these requirements, emails that contain marketing material from more than one advertiser arguably create compliance obligations for all advertisers involved.  In other words, if an airline electronic newsletter contains advertising for hotels, the email would then have to list a physical address for each hotel.  Further, an opt-out request sent to the airline in response to the newsletter could apply to each hotel company as well.  

The Final Rule addresses this open question by resolving that it is possible in the multi-party advertiser email scenario for one advertiser to meet the compliance obligations of CAN-SPAM.  In that manner, the other advertisers are relieved from the need to also comply with the obligations of CAN-SPAM with respect to that email.

     To satisfy the obligations of CAN-SPAM, the advertiser designated as the sender of a multi-party email must: 

    (1) Originate or procure the transmission of a commercial email that advertises or otherwise promotes that party’s own goods, services, or Internet website in the message;

    (2) Identify itself in the “From” line of the email; and

    (3) Comply with all other applicable CAN–SPAM obligations, namely the requirements to provide a means for the recipient to opt out of any subsequent emails and list a physical street address in the body of the message.

NOTE:  If these three requirements are not properly met, for example if the sender’s physical postal address is not listed in the email, the FTC may assert that all parties are liable for the non-compliance. 

Forward-to-a-Friend Email

The Final Rule clarifies how CAN-SPAM applies to commercial forward-to-a-friend emails.  Commercial forward-to-a-friend emails are messages sent by one individual to another person that provide information about or recommend a company’s goods or services.  Typically, they are initiated via a mechanism contained on the website such as a hyperlink entitled “Send to A Friend.”   

Forward-to-a-friend emails present a special compliance issue in that the marketer has no control over what email address is placed in the “To” field.  The visitor to the website and not the company supplies the address of the intended recipient.  Nevertheless, the Final Rule emphasizes that the forward-to-a-friend emails, under certain circumstances, may be required to comply with CAN-SPAM. 

The FTC clarified that compliance for such emails is necessary if the website offers any form of consideration to encourage an individual to send the email to another person.  The FTC specified that consideration in this context may include the offering of money, coupons, discounts, awards, additional entries in a sweepstakes, or any other incentive to send the email.  If consideration is offered, the marketer must ensure that the potential recipient’s address is not listed on the company’s do-not-email list by scrubbing it against the list prior to transmittal.        

Opt-Out Requests

The Final Rule addresses how marketers must give individuals the opportunity to opt out from the receipt of subsequent commercial email.  Specifically, it requires marketers to provide individuals with an uncomplicated and effective method to make an opt-out request.  Marketers may not require individuals to take any other steps to register an opt-out request other than sending a reply email message or visiting a single web page. The FTC specifically pointed out that marketers may not charge a fee or require the submission of unnecessary personal information to effectuate an opt-out request. 

The FTC declined to shorten the period required to put an opt-out request into effect.  Therefore, marketers will continue to have 10 days to cease the transmission of email to an address after the receipt of an opt-out request. 

The FTC reiterated that opt-out requests do not expire.  Therefore, marketers may send commercial email to an address registered on a do-not-email list only after the individual subsequently consents or “opts in” to the receipt of additional email. 

Postal Addresses

CAN-SPAM requires commercial email to contain a valid physical postal address of the sender.  The Final Rule clarifies that a post office box will satisfy this requirement with one caveat:  registration for the post office box must comply with the applicable USPS regulations.  For example, USPS regulations require the registrant of a post office box to present two forms of valid identification when applying and specify all persons eligible to receive mail from it.  If these obligations were not met during registration, listing a post-office box in the body of the email would constitute non-compliance.    

Transactional or Relationship Messages

The compliance requirements under CAN-SPAM generally apply to commercial email – i.e., email that promotes a good or service.  CAN-SPAM contains an exemption from the majority of compliance obligations for email that qualifies as a “transactional or relationship” message.  Notably, senders of such messages are not required to provide recipients with an opportunity to opt out of future emails. 

The Final Rule clarifies how the exemption applies to certain categories of email.  The FTC declined to find that legally mandated notices, such as those that are required under the Gramm-Leach-Bliley or USA Patriot Act, copyright infringement notices, or market research requests automatically qualify as transactional or relationship email.  According to the FTC, that determination would depend on how much, if any, promotional material is contained in the email and where it is located in the body of the message.  Similarly, the FTC stated that it would assert that compliance is necessary when an employer sends a commercial email to a prospective employee prior to the acceptance of an employment offer.

The Final Rule addresses situations when the transactional or relationship exemption applies and then expires.  For example, the FTC explained that while a trade association or other membership organization may generally contact its members without complying with CAN-SPAM, the exemption is no longer valid once the relationship is terminated.  As such, compliance would be required for an email sent to a former member requesting that they rejoin the organization. 

The FTC noted several classes of email where CAN-SPAM compliance is not necessary.  For example, the FTC commented that debt collection notices are likely exempt.  Similarly, email sent to employees regarding special offers and discounts would not require compliance.


The FTC has brought numerous law-enforcement actions under CAN-SPAM.  As part of those efforts, the FTC frequently assessed large civil penalties and obtained injunctive relief for non-compliance.  The FTC is certain to bring enforcement actions under the Final Rule within a short period of time.  To avoid the threat of FTC scrutiny, marketers should immediately ensure that all commercial email campaigns satisfy the compliance obligations contained in the Final Rule. 


    We hope that you find this information useful.  Please contact us if you have any questions.

James A. Kaminski May 2008

< Prev