Subject: [Asrg] 6. Proposals - Legal - News Article "California Bans Spam"

From: Bill Pease <[email-masked]>
Date: Wed, 24 Sep 2003 11:52:39 -0700

The assertion that CA has "banned all unsolicited email with no loop 
holes" is clearly incorrect.  This new statute contains at least two 
substantial loopholes that are sure to be exploited, plus some real 
technical problems.

Here is the key statutory text:
"Unsolicited commercial e-mail advertisement means a commercial e-mail 
advertisement sent to a recipient who meets both of the following criteria:
    (1) The recipient has not provided direct consent to receive
advertisements from the advertiser.
    (2) The recipient does not have a preexisting or current business
relationship with the advertiser"

Here are the loopholes:
1) The definition of direct consent is weak and will be difficult to 
audit/verify, so many questionable list building techniques will 
conceivably qualify:
"Direct consent means that the recipient has expressly consented to 
receive e-mail advertisements from the advertiser, either in response to 
a clear and conspicuous request for the consent or at the recipient's 
own initiative."
This does not require double opt-in, nor does it even require "positive 
action" by the consent giver. If I provide my email to participate in a 
transaction, or to obtain a service, and text indicating I will also be 
added to an email list is displayed in the vicinity, this tacit form of 
opt-in can easily be construed to constitute "direct consent."

2) The preexisting business relationship exemption presents a much 
bigger threat to the effectiveness of the CA statute.
"Preexisting or current business relationship...means that the recipient 
has made an inquiry and has provided his or her e-mail address, or has 
made an application, purchase, or transaction, with or without 
consideration, regarding products or services offered by the advertiser."
As written, any purchase from or inquiry to any provider that I have 
ever made authorizes them to email me - even if the marketer obtained my 
email address via e-pending or other methods and not by my own provision 
- as long as their message contains a functioning opt-out method.

3) There are also additional problems posed by keying the statute's 
restrictions to messaging to "California email addresses."  The types of 
information required to ascertain whether an email address qualifies as 
a CA address are generally unavailable to most email list managers:
"California e-mail address means any of the following:
(1) An e-mail address furnished by an electronic mail service
provider that sends bills for furnishing and maintaining that e-mail
address to a mailing address in this state.
(2) An e-mail address ordinarily accessed from a computer
located in this state.
(3) An e-mail address furnished to a resident of this state."

Date: Tue, 23 Sep 2003 18:50:42 -0400
From: Yakov Shafranovich <[email-masked]>
To: ASRG list <[email-masked]>
Organization: SolidMatrix Technologies, Inc.
Subject: [Asrg] 6. Proposals - Legal - News Article "California Bans Spam"

This just popped up on SlashDot and other places. The State of
California has banned all unsolicited email with no loop holes and
allows providers, the state and receivers to sue for $1,000 / email
message. Law becomes effective on January 1st, 2004 and may be an
important testing group for a federal law. For more information see:

http://yro.slashdot.org/yro/03/09/23/2035204.shtml
http://www.internetnews.com/IAR/article.php/3079701
http://nytimes.com/2003/09/23/business/23CND-SPAM.html

The text of the law is available at:

http://info.sen.ca.gov/pub/bill/sen/sb_0151-0200/sb_186_bill_20030911_enrolled.html

_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: Kee Hinckley <[email-masked]>
Date: Wed, 24 Sep 2003 15:30:12 -0400

At 11:52 AM -0700 9/24/03, Bill Pease wrote:
>This does not require double opt-in, nor does it even require 
>"positive action" by the consent giver. If I provide my email to 
>participate in a transaction, or to obtain a service, and text 
>indicating I will also be added to an email list is displayed in the 
>vicinity, this tacit form of opt-in can easily be construed to 
>constitute "direct consent."

As much as I'd love confirmed opt-in to be a requirement, the fact is 
that too many subscribers just don't get it.  It's not going to 
happen (do you require it of your customers?).  This is certainly the 
strongest opt-in statement I've seen in legislation, and orders of 
magnitude ahead of the federal laws, which all specify opt-out.  I 
don't think it's going to get any better.

>ever made authorizes them to email me - even if the marketer 
>obtained my email address via e-pending or other methods and not by 
>my own provision - as long as their message contains a functioning 
>opt-out method.

E-pending is an interesting issue, and I'd certainly like to see a 
law disallowing the sale or transfer of email addresses--but I'm not 
holding my breath.  Do you truly think that any anti-spam law would 
not have a "pre-existing business relationship" clause?  After all, 
otherwise you're saying that you can send all the mail you want to 
them, but they aren't allowed to reply.

>restrictions to messaging to "California email addresses."  The 
>types of information required to ascertain whether an email address 
>qualifies as a CA address are generally unavailable to most email 
>list managers:

That's been true of every state law.  After all, California can't 
pass a law outlawing the spamming of out-of-state addresses by 
out-of-state spammers.  What else can they do?  I haven't heard of 
any other state laws being shut down for this reason.  Is there any 
reason you believe this case would be any different?

I'm seriously considering finding a lawyer interested in taking an 
anti-spam case on a contingency basis and moving my mail server to 
California.  I'm bouncing 100+ messages a minute on my server.  Even 
if we take out the lists which bounce three times and then remove the 
address, and the viruses, and the joe-jobs, I think I've got plenty 
of junk there to provide a nice income for a while.
-- 
Kee Hinckley
http://www.messagefire.com/         Next Generation Spam Defense
http://commons.somewhere.com/buzz/  Writings on Technology and Society

I'm not sure which upsets me more: that people are so unwilling to accept
responsibility for their own actions, or that they are so eager to regulate
everyone else's.

---

From: Yakov Shafranovich <[email-masked]>
Date: Wed, 24 Sep 2003 16:07:05 -0400

Kee Hinckley wrote:
> that too many subscribers just don't get it.  It's not going to happen 
> (do you require it of your customers?).  This is certainly the strongest 
> opt-in statement I've seen in legislation, and orders of magnitude ahead 
> of the federal laws, which all specify opt-out.  I don't think it's 
> going to get any better.
> 

Having a set of standard protocols and formats for exchanging consent 
can provide usefull tools for an audit trail. In theory, an audit trail 
providing a record of a consent exchange transaction using these formats 
and protocols, might be an effective method for proving opt-in. BTW, the 
consent framework is available at:

http://www.solidmatrix.com/research/asrg/asrg-consent-framework.html

Yakov