If your email publishing or marketing program meets a few very basic rules, CAN-SPAM will likely not impact you at all:

• Don't "harvest" email addresses from the Internet or generate them via a "dictionary" process for commercial mailing purposes.
• Don't send commercial email via a computer for which you don't have proper authorization to use.
• Don't falsify or obscure the header information in your commercial email messages — always use a valid From: address and an accurate, non-misleading Subject: line.
• Include a valid postal mailing address and a functioning opt-out mechanism in every commercial email message you send.
• Don't continue to send email to a recipient who has opted-out of your list.
• If you send adult content (i.e., sexually explicit material), use a warning label of that fact in your subject line.

As an ethical email publisher or marketer, you're likely already following these terms; they're simply good email practices. We also recommend several others in this FAQ. Note that responsibility for enforcing CAN-SPAM lies with the Federal Trade Commission, and that private individuals or Internet Service Providers are not empowered to file lawsuits based on it.

Please also note, of course, that Lyris and NeoRed are not legal experts, and we offer the information below with no implied or express warranties; it is for informational purposes only. Because CAN-SPAM is so new, there are not yet any examples of its application to actual cases and real-world situations. We therefore encourage all of our clients, customers, and Web site visitors to speak with their own legal advisors to understand how email legislation may apply to their businesses in particular.

To whom does law apply?

CAN-SPAM applies to two primary groups:

• Senders
  Any person or entity using hosting services to deliver commercial email would be considered a Sender per the CAN-SPAM Act's terms
• Recipients
  Members of email lists run hosting services are Recipients.

What does law prohibit and require?

CAN-SPAM prohibits four major activities or actions:

• False or misleading transmission information, such as From: or Reply To: headers that are technically accurate but misrepresentative of the message's true origins
• Deceptive subject headings that mislead the recipient as to the true nature of the message's content
• Email transmission after objection; that is, sending a message to a recipient more than 10 days after the recipient has opted-out of the list.
• Address harvesting and dictionary attacks, in which commercial email is sent to addresses that were collected from the Internet without permission or that were compiled by automated means.

CAN-SPAM requires two key actions:

• Inclusion of an opt-out process and postal mailing address. Every commercial email message must include a valid mechanism for opting-out of future communication from the Sender, as well as the Sender's valid physical postal mailing address. In addition, if a message is sent without "affirmative consent" (e.g., an opt-in relationship), the message must identify itself as an advertisement.
• Warning labels for adult content, such that Recipients who have not provided affirmative consent are advised in the subject line that the message contains sexually explicit material.

Who is responsible for enforcing the law?

The Federal Trade Commission (the FTC, or "Commission" in CAN-SPAM's legalese) is ultimately responsible for enforcement of the CAN-SPAM Act, and may bring suit against those who violate it. In addition, the Attorneys General of each State have some powers of enforcement with respect to violations of the law affecting their respective states. Note that private individuals and Internet Service Providers (ISPs) are not permitted to file lawsuits directly.

What can happen to a Sender who violates the law's terms?

CAN-SPAM levies financial penalties of $250 per violation, up to a maximum of $2,000,000 for repeated offenses; this amount can also be increased to $6,000,000 for repeated, willful violations. Note that per the law's terms, only the Federal Trade Commission and the State Attorneys General may bring suit against a person or entity that allegedly violates the CAN-SPAM Act.

How to prepare for CAN-SPAM compliance

What does the law say about communications from multiple groups or divisions of my company - that is, if a person joins Division A's list, is it acceptable for Division B to send her email?

The CAN-SPAM Act doesn't address this question directly, but our counsel has concluded several points from it. First, if Division A holds itself out as "A" rather than "Division A of Company X," and/or Division B does the same thing, it's probably not safe to transfer mailing lists between them. Divisions that hold themselves out as separate companies will be deemed separate companies for the purpose of the statute. Second, if Division A intends to transfer its list to Division B, it would be well-advised to advise its subscribers at the time of their subscriptions that their email addresses may be shared with Division B. Third, if Division A subsequently receives an opt-out notice from a list member, it cannot share that email address with Division B after 10 days if the two divisions are deemed separate; likewise, if Division A and Division B are deemed part of the same whole, Division B cannot send a message to the unsubscribed list member after 10 days from the opt-out notice.

What does the law say about communication of different types - that is, if a person signs up for my email newsletter, is it also ok for me to send an email promotional offer?

CAN-SPAM does not speak to this issue at all, so the best advice we can offer is to manage your list members' expectations and try not to surprise them. We try to do this in our own marketing: for example, when we created a new corporate HTML newsletter, we realized that some of our existing list members might object to the new format - even though the content was similar. We invited those members to subscribe to a new list that would continue to receive text-only communications.