A Moment of Privacy
Welcome to “A Moment of Privacy,” a newsletter brought to you by the Privacy and Data Security Practice Group at Proskauer Rose LLP.
“A Moment of Privacy” addresses one legal development each month in the area of privacy and data security law. We answer the questions our clients are asking, in a way that we hope gives practical information to our readers. If you send us your question, you may find your answer in an upcoming newsletter.
And now for this month’s question:
Q: I have been waiting for the FTC’s clarification on how the CAN-SPAM Act treats multi-advertiser e-mails, tell-a-friend campaigns and affiliate marketing programs for years. What did they finally say?
A: On May 12, 2008 the Federal Trade Commission issued its long-awaited final set of rules under the CAN-SPAM Act of 2003 (the “Act”). The rule:
n Modifies the term “sender” with respect to multi-advertiser e-mails;
n Clarifies the opt-out request process;
n Defines the term “person”; and
n Clarifies the meaning of “valid physical postal address” of the sender.
The accompanying report:
n Explains the FTC’s interpretation of the Act’s application to affiliate marketing programs and tell-a-friend campaigns.
The new rule will take effect on July 7, 2008.
The FTC’s modification of the term “sender” addresses the situation in which there is more than one advertiser in a commercial e-mail. Prior to this rule’s enactment, the Act, strictly read, required that each advertiser in a commercial e-mail was responsible for complying with the Act’s requirements. In other words, each advertiser was required to provide an opt-out mechanism, display a valid physical postal address, honor opt-out requests, and otherwise comply with the Act’s requirements.
This new rule allows one of the advertisers to assume the role of “sender” as defined by the Act, and therefore alleviate most of the compliance burden from the other advertisers.
Certain requirements must be met in order for one of multiple advertisers to be designated as the “sender” responsible for compliance with the Act, and, if such requirements are not met, the other advertisers could be held accountable. For that reason, from the perspective of the other advertisers, it is imperative that they secure a written agreement with the designated sender that includes contractual obligations on the sender to perform the required duties, and a strong indemnification provision protecting the other advertisers who are counting on the designated sender’s compliance with the Act. For details on what requirements must be imposed on the designated sender, see our recent blog post at Proskauer’s Privacy Blog.
Tell-A-Friend Campaigns and Affiliate Marketing Programs
Since the inception of the Act, advertisers have been confused about how the Act applies to their “tell-a-friend” campaigns and affiliate marketing programs.
Strictly read, the Act would make advertisers responsible in at least some instances for CAN-SPAM compliance with respect to e-mails that are sent to a person’s friend in connection with a tell-a-friend campaign. This would mean that the e-mails cannot be sent to a friend who has opted out of receiving commercial e-mails from the company. Also, the e-mails that are sent to the friend would have to include the company’s physical postal address and opt-out mechanism, accurate routing information, a subject line that is not misleading, and, in some cases, be identified as an ad. Depending on how a particular tell-a-friend campaign functions, it may be impossible for a company to ensure that these requirements are complied with.
The FTC’s report accompanying the rule makes the FTC’s interpretation of the Act’s application to tell-a-friend campaigns clear. First off, if a company offers to “pay or provide other consideration” (including coupons, discounts, awards, sweepstakes entries or the like) to a person in exchange for sending the commercial e-mail to his or her friend, the company will be responsible for the e-mail’s compliance with the Act.
Similarly, when a company offers consideration to someone in exchange for driving traffic to the company’s Web site or generating other forms of referrals (e.g., a marketing affiliate relationship), resulting in the transmission of the company’s e-mail message by the affiliate or its sub-affiliate, the company will be responsible for the CAN-SPAM compliance of the e-mails that are sent.
In contrast, where a company merely “urges” or “exhorts” a person to forward a message to a friend, without offering something of value in exchange, the company will not be responsible for the CAN-SPAM compliance of the e-mails that are sent.
For details on what constitutes “consideration,” see our recent blog post at Proskauer’s Privacy Blog.
This rule requires senders to allow recipients to opt-out of subsequent commercial e-mails in at least one of two ways; by: (1) replying to a specified e-mail address or (2) visiting a single Web page and selecting their opt-out preferences. Recipients cannot be required to pay a fee or provide any other information besides their e-mail address and opt-out preferences. For example, the recipient can not be required to log into her account or to submit her name, address, or any form of payment in order to opt-out.
The FTC declined to shorten or lengthen the amount of time senders have to process opt-out requests from its original ten-business day time frame (or, for wireless e-mail addresses, ten days).
For details on what can be required of an individual who wants to opt-out, see our recent blog post at Proskauer’s Privacy Blog.
The FTC added a definition of “person” to clarify that the CAN-SPAM Act applies to more than just natural persons, but also groups, associations and business entities. For details on the definition of “person,” see our recent blog post at Proskauer’s Privacy Blog.
Valid Physical Postal Address
Since the Act was enacted, legitimate e-mailers have been asking whether they can use a P.O. box to meet the requirement that a physical postal address be included in commercial e-mails. The final rule allows a sender to use his current street address, a P.O. box the sender has accurately registered with the United States Postal Service (USPS), or a private mailbox the sender has accurately registered with a commercial mail-receiving agency that is established pursuant to USPS regulations.
Have a question? E-mail Kristen J. Mathews at email@example.com.