CAN-SPAM Rulemaking (16 CFR Part 316)

Whether CAN-SPAM covers a particular message, who is legally its "sender", and whether a forward-to-a-friend button creates liability are all settled by rules the Federal Trade Commission (FTC) wrote under the Act. Those rules are codified in 16 CFR Part 316.

They define the terms that decide whether a message is covered and who the liable sender is. They also resolve the edge cases: mail that advertises several companies, forward-to-a-friend features, and postal addresses that are PO boxes.

Start with CAN-SPAM (US), which summarizes the Act's seven main rules in plain English. Those rules are not repeated below.

How the rules were made

The CAN-SPAM Act was signed on 16 December 2003 and took effect on 1 January 2004. It gave the FTC discretionary authority to define its terms and to issue rules that implement it. The FTC published the definitions in several Federal Register actions:

What "reporting requirements" in the title means. The source document is titled "Definitions, Implementation, and Reporting Requirements." The reporting in that title refers to reports the Act required the FTC itself to make to Congress, such as the study of a Do-Not-E-mail registry. It does not refer to any recordkeeping or reporting burden on senders. The NPRM states that the rule imposes no new information collection on industry under the Paperwork Reduction Act.

How the rule is organized

The adopted numbering of 16 CFR Part 316 differs from the numbering the NPRM proposed, because the proposed section on a 3-business-day opt-out was dropped:

The primary-purpose tests (§316.3)

Whether the Act covers a message depends on its primary purpose (summarized in CAN-SPAM). The Rule turns that concept from the Act into mechanical tests. A message's primary purpose is deemed commercial if:

(1) The content is only commercial. The message consists only of the commercial advertisement or promotion of a commercial product or service.

(2) The content is commercial plus transactional or relationship content (dual-purpose). The message is commercial if either:

• (i) a recipient reasonably interpreting the subject line would likely conclude that the message contains a commercial advertisement or promotion; or
• (ii) the transactional or relationship content does not appear in whole or in substantial part at the beginning of the body of the message.

(3) The content is commercial plus "other" content, meaning content that is neither transactional or relationship content nor commercial. The message is commercial if either:

• (i) the same subject-line test is met; or
• (ii) a recipient reasonably interpreting the body would likely conclude that the primary purpose is commercial. Factors that illustrate this include placing the commercial content at the beginning of the body, the proportion of the message that is commercial, and the use of color, graphics, type size and style to highlight the commercial content.

A message's primary purpose is transactional or relationship only if it consists exclusively of the five categories of transactional or relationship content in §316.3(c):

1. Facilitate, complete or confirm a commercial transaction that the recipient previously agreed to enter into;
2. Provide warranty, recall, safety or security information about a product or service the recipient used or purchased;
3. For an ongoing subscription, membership, account, loan or comparable relationship: notify the recipient of a change in terms or features, or of a change in the recipient's standing or status; or provide account-balance information or another type of account statement at regular periodic intervals;
4. Provide information directly related to an employment relationship or related benefit plan in which the recipient is currently involved, participating or enrolled;
5. Deliver goods or services, including product updates or upgrades, that the recipient is entitled to receive under the terms of a previously agreed transaction.

In its NPRM analysis, the FTC reads these categories narrowly, so that they do not erode the opt-out protection:

• The "commercial transaction" in category 1 does not require an exchange of consideration. Registering for a free service, such as event invitations, can be a commercial transaction the recipient agreed to. But an initial, unsolicited message that merely proposes a transaction is commercial, not transactional.
• A standard of reasonableness governs how many confirmation messages one transaction supports. Hourly "confirmations" that contain promotions would read as commercial.
• Under category 3, billing and account statements sent at regular intervals qualify even if they contain some advertising. If the advertising overwhelms the transactional content, however, the dual-purpose test in §316.3(a)(2) reclassifies the message as commercial.
• A message that a third party sends to employees with the employer's permission, promoting the third party's own goods, is not transactional under category 4. Only genuine information about the employment relationship qualifies.
• The FTC declined repeated industry requests to expand the categories, for example with a blanket exemption for mail from associations to their members, or for business-to-business (B2B) mail. The Act allows the categories to be changed only when a change is necessary to accommodate changes in email technology or practices, and the FTC found that this test was not met. Mail from associations to their members and B2B mail therefore get no special exemption. Each message is classified on its content by the primary-purpose test.

Who the sender is when a message advertises several companies (§316.2)

The Act defines a sender as a person who initiates a commercial message and whose product, service or website is advertised or promoted in it. Both "initiate" and "sender" can apply to more than one person in a single message.

The Rule resolves the case of several advertisers in §316.2(m). When the products or services of more than one person are advertised or promoted in a single message, each of them is a "sender". There is one exception: if only one of them both meets the Act's definition of "sender" and meets one or more of the following criteria, only that person is the "sender" of the message:

1. The person controls the content of the message;
2. The person determines the electronic mail addresses to which the message is sent; or
3. The person is identified in the "From" line as the sender.

This lets several advertisers designate a single sender to handle compliance: a working opt-out, a valid physical address, and honoring opt-outs. Otherwise each advertiser would have to provide its own suppression, address and opt-out. Commenters argued that this would force advertisers to reveal customer lists to competitors, and would confuse recipients with several opt-out mechanisms and postal addresses.

Worked example from the NPRM. Sellers X, Y and Z are all advertised in one message, and they designate X as the single sender. This works only if, of the three, only X controls the content, controls the recipient list, or appears in the "From" line. X may use third parties for the criteria it does not meet itself, but neither Y nor Z may meet any of them. The same example is summarized in CAN-SPAM.

The "From" line and "materially false" headers. This rule connects to CAN-SPAM's ban on materially false or misleading header information (15 U.S.C. 7704(a)(1)). A "From" line does not need to carry the initiator's full legal name, but it must give the recipient enough information to know who is sending. A "From" of "John Doe" on a message from XYZ Company would not accurately identify the initiator. A "From" line is "materially" false when it impairs the ability of a recipient, an internet service provider (ISP) or a law enforcement agency to identify, locate or respond to the initiator.

What counts as a valid physical postal address (§316.2)

The Rule defines, in §316.2(p), what satisfies the Act's requirement for a physical address (15 U.S.C. 7704(a)(5)(A)(iii)). A valid physical postal address is any of:

1. The sender's current street address;
2. A Post Office box the sender has registered with the U.S. Postal Service (USPS); or
3. A private mailbox the sender has registered with a commercial mail receiving agency (CMRA) established under USPS regulations.

The FTC accepted PO boxes and CMRA mailboxes for two reasons. Both have a physical presence recognized by the USPS, and USPS registration verifies the renter's street address at signup. Allowing them therefore "creates no greater risk that a sender will falsify information to thwart the purposes of the Act" than a street address does, since a rogue sender can lie about a street address just as easily.

The 10-business-day opt-out: 3 days proposed, 10 kept

The Act (15 U.S.C. 7704(a)(4)) bars initiating a commercial message more than 10 business days after receiving the recipient's opt-out. The Act allowed the FTC to change this period.

The NPRM proposed shortening it to 3 business days. Its reasoning was that near-instant opt-out processing is technically feasible, since some senders and Go Daddy reported processing opt-outs "within seconds", and that a shorter window better serves the Act's privacy purpose. Commenters were split three ways: keep 10 days, shorten the period, or lengthen it to 15–30 days for complex arrangements involving several parties.

In the 2008 Final Rule, the FTC declined to shorten the period. The 10-business-day requirement stands. Apply the adopted rule: honor opt-outs within 10 business days, and keep the opt-out mechanism working for at least 30 days after the message is sent. See Opt-out mechanics in CAN-SPAM.

No fees or extra steps to opt out (§316.5)

Neither a sender nor any person acting on its behalf may require the recipient to:

• pay any fee;
• provide any information other than the recipient's email address and opt-out preferences; or
• take any step other than sending a reply email message or visiting a single Internet web page,

as a condition of accepting or honoring an opt-out request. Requiring a recipient to visit several web pages, log in, or disclose personal data to unsubscribe is prohibited, because it would "frustrate recipients' ability to exercise their opt-out rights." A preference menu is allowed only if it includes a global "opt out of all" option.

Forward-to-a-friend features: initiate, procure and routine conveyance

CAN-SPAM has no specific provision on forward-to-a-friend features. Liability follows from three related definitions that the Rule incorporates:

• Initiate means to originate or transmit a message, or to procure its origination or transmission, but not actions that are routine conveyance.
• Procure means intentionally to pay or provide other consideration to, or induce, another person to initiate a message on one's behalf.
• Routine conveyance means the transmission, routing, relaying, handling or storing of a message through an automatic technical process for which another person has identified the recipients or provided the recipient addresses.

Applied to forwarding, these definitions give the following results:

"Induce" is broader than "pay": it means to lead on or to influence by persuasion. Simply offering a forwarding button is still not inducement. The UK reaches a comparable result through the concept of "instigation" (see UK PECR).

Aggravated violations and treble damages

A defendant who commits an aggravated violation in addition to a §7704(a) violation can face treble damages in an enforcement action. The Act (15 U.S.C. 7704(b)) lists four aggravated practices:

1. Automated harvesting of email addresses (software that scrapes addresses);
2. Dictionary attacks: generating addresses automatically by combining names, letters or numbers;
3. Automated creation of multiple email accounts to send from;
4. Relay or retransmission through unauthorized access to a protected computer (open relays or proxies, and botnets).

The FTC declined to add new aggravated violations by rule. Commenters proposed adding hashbusting (random words inserted to defeat filters), manual address harvesting, inaccurate WHOIS information and the sale of open-proxy lists. The FTC found that these practices were either already prohibited by other parts of the Act or lacked evidence that they contribute substantially to unlawful commercial email. For example, hashbusting in a subject line already violates the ban on deceptive subject headings, and relaying through a virus already violates §7704(a)(1)(C). The FTC noted that it would still challenge such practices under Section 5 of the FTC Act where appropriate.

Injunctions do not require proof of state of mind

Where a CAN-SPAM provision or the Rule contains a state-of-mind element, that element is waived when a state, the FTC, the Federal Communications Commission (FCC), or a state official or agency seeks a cease-and-desist order or an injunction to enforce compliance. Enforcers do not need to allege or prove the defendant's state of mind to obtain injunctive relief. The NPRM proposed codifying this as §316.4(b), following sections 7706(e) and (f)(2) of the Act. The adopted Rule contains no such provision, and today's § 316.4 is the warning-label rule, so the waiver rests on the Act itself.

Practical takeaways for an email service provider (ESP)

• The primary-purpose tests are content tests, applied to each message. An ESP cannot classify a whole account or stream as "transactional". Dual-purpose mail with promotions above the fold is commercial and must meet every CAN-SPAM requirement.
• For sends that are multi-advertiser, affiliate or co-branded, make sure that exactly one designated sender meets the test (it controls the content, determines the addresses, or is named in the "From" line) and appears in the "From" line. Otherwise every advertiser becomes a sender with full obligations. For the operational side, see Customer Domain Authentication and Suppression-List Architecture.
• Forward-to-a-friend features are safe when they are plain routine conveyance. As soon as the platform or the customer offers an incentive for forwarding, the brand that originated the message becomes a sender of the forwarded mail.
• Any of the four aggravated practices in a customer's acquisition history is both a legal red flag and a severe deliverability problem. Check for them in Customer Vetting, Consent Methods and Spam-Trap Incident Response.