FTC Announces CAN-SPAM Act Rulemaking

March 11, 2004. The Federal Trade Commission (FTC) published a notice in the Federal Register requesting comments, and setting comment deadlines, regarding various regulations and reports required by the CAN-SPAM Act.

The Congress passed S 877, the "Controlling the Assault of Non-Solicited Pornography and Marketing Act of 2003", also known as the "CAN-SPAM Act of 2003", late last year. On December 16, 2003, President Bush signed the bill. It became Public Law No. 108-187.

Several provisions in the CAN-SPAM Act instruct the FTC to write regulations implementing the Act. Other provisions require the FTC to prepare reports for the Congress. This notice requests public comments to assist the FTC in writing these regulations, and preparing these reports.

Subsection 3(2)(C) of the CAN-SPAM Act provides that "Not later than 12 months after the date of the enactment of this Act, the Commission shall issue regulations pursuant to section 13 defining the relevant criteria to facilitate the determination of the primary purpose of an electronic mail message."

The Act designates five categories of messages as "transactional or relationship messages" that which are exempt from the provisions of the Act. Subsection 3(17)(B) of the CAN-SPAM Act then provides that "The Commission by regulation pursuant to section 13 may modify the definition in subparagraph (A) to expand or contract the categories of messages that are treated as transactional or relationship messages for purposes of this Act to the extent that such modification is necessary to accommodate changes in electronic mail technology or practices and accomplish the purposes of this Act."

The Act allows recipients to opt out of receiving further commercial e-mail and provides senders 10 business days to process opt out requests. But, the Act also allows the FTC to modify this. Specifically, Subsection 5(c)(1) of the CAN-SPAM Act provides that "The Commission shall by regulation, pursuant to section 13--
  (1) modify the 10-business-day period under subsection (a)(4)(A) or subsection (a)(4)(B), or both, if the Commission determines that a different period would be more reasonable after taking into account--
    (A) the purposes of subsection (a);
    (B) the interests of recipients of commercial electronic mail; and
    (C) the burdens imposed on senders of lawful commercial electronic mail;".

The Act defines certain practices, such as e-mail address harvesting and dictionary attacks as aggravated violations. Subsection 5(c)(2) then provides that the FTC may "specify additional activities or practices to which subsection (b) applies if the Commission determines that those activities or practices are contributing substantially to the proliferation of commercial electronic mail messages that are unlawful under subsection (a)."

Subsection 13(a) of the CAN-SPAM Act provides that "The Commission may issue regulations to implement the provisions of this Act (not including the amendments made by sections 4 and 12). Any such regulations shall be issued in accordance with section 553 of title 5, United States Code." (Parentheses in original.) That is, the FTC must follow the Administrative Procedure Act.

Subsection 13(a) of the CAN-SPAM Act provides that "Subsection (a) may not be construed to authorize the Commission to establish a requirement pursuant to section 5(a)(5)(A) to include any specific words, characters, marks, or labels in a commercial electronic mail message, or to include the identification required by section 5(a)(5)(A) in any particular part of such a mail message (such as the subject line or body)." (Parentheses in original.)

The FTC's notice also seeks comment on four reports to Congress required by the CAN-SPAM Act.

Section 9 of the Act requires the FTC to write a report on establishing a nationwide Do Not E-Mail Registry. It is due by June 16, 2004.

Section 11(1) of the Act requires the FTC to write a report on establishing a system for rewarding those who supply information about CAN-SPAM Act violations. It is due by September 16, 2004.

Section 11(2) of the Act requires the FTC to write a report setting forth a plan for requiring commercial e-mail to be identifiable from its subject line. This report is due by June 16, 2005.

Section 10 of the Act requires the FTC to write a report on the effectiveness of the CAN-SPAM Act. It is due by December 16, 2005.

The FTC notice states that public comments regarding the National Do Not E-mail Registry are due by March 31, 2004. Comments regarding all of the other regulations and reports are due by April 12, 2004.

See, Federal Register, March 11, 2004, Vol. 69, No. 48, at Pages 11775-11782. See also, FTC release.