PSA | New Rules take effect today

Just a quick Public Service Announcement, the new rules announced by the FTC for CAN-SPAM changes take effect today.

To recap the changes here are a number of good resources to review can be found here:

• EmailKarma.net: CAN-SPAM Rule Clarification
• The Internet Patrol: New CAN-SPAM Rules Effective This Month Require Single Action Opt-Out, Designated Senders, and More
• Shop.org: CAN-Spam Rules - What They Mean to Retailers
• Internet Law - New Rule Provisions for the U.S. CAN-SPAM Act

One Degree | Ensuring Your Email Complies with Relevant Laws

My latest OneDegree article is now available:

Ensuring Your Email Complies with Relevant Laws
OneDegree Today at 8:14 AM

By Matthew Vernhout

Your email campaigns are growing and you're having great success!

But did you realize that as your email marketing programs grow in complexity and reach, you need to follow the regulations mandated by the jurisdictions in which your clients and their mail servers are located? This is news to many marketers who are not used to following rules that fall outside of their immediate regional or national borders.

Full Article can be read here here.

CAN-SPAM Rule Clarification

Recently the FTC clarified a number of rules within CAN-SPAM (pdf).

Here is my understanding of these changes (please note this is not legal advice).

There are two major changes to note within these clarifications:

• Changes to the definition of a "sender." The new rule enforces the idea of a single designated sender, for messages with multiple advertisers. The designated sender is defined as the entity in the "From" line of the communication, clarifying the need to have multiple opt-outs within each messages. It also clarifies that only that designated sender need to provide an opt-out link, a valid postal address to satisfying the usual requirements within the Act (ex: subject line, headers, etc).
• Changes to opt-out requirements. The new rule stipulates the amount of complexity and information needed to be supplied by the recipient during an opt-out request. Most importantly, the opt-out process need only require that the recipient provide only their email address to unsubscribe. The opt-out process must not consist of more than a single webpage or an email reply from the recipient.

Minor Clarifications from the FTC include the following;

• A P.O. box or private mailbox has been confirmed as acceptable under the "valid postal address" requirement.
• The definition of "person" has been clarified to include the legal definition of "person," and expanded to include; corporations, groups, partnerships, nonprofits, and associations.

An Act Concerning Unsolicated Comercial Electronic Messages | Bill S-235

The Senate of Canada is currently reviewing the Bill S-235, referred to as the Anti-Spam Act, presented to the senate by Senator Goldstein. This is somewhat similar to CAN-SPAM except for the fact that this is an OPT-IN email marketing law (PIPEDA also deals with opt-in for PII), and the US law is focused on opt-out.

The most important information about bill S-235 deals with how it would make the sending of Unsolicited commercial email (UCE) messages to Canadian subscribers illegal. Consent must be granted Prior to sending email communications to your subscribers.

Illegal activities under S-235:

• Sending UCE
  
• Address Harvesting
• Phishing
  
• Inaccurate subject lines

While the mandatory pieces of information that will be required are;

• Valid contact information
  
• and a functional unsubscribe facility

It is important to note that, S-235 also creates serious penalties for people caught spamming including; up to 5 years in prison and fines of up to $1.5 million for repeat offenders.

This bill also empowers ISPs to take the necessary actions to effectively block spam messages and allow Canadians to seek damages from spammers in court.

Monitor the status of this bill, LEGISinfo.

In a later post I'll discuss some of the exemptions and items I feel need to be reviewed by Senator Goldstein.

Canadian Anti-spam Law on the way

On May 7th, 2008 The Senate of Canada had the First reading of Bill S-235, to be known as the Anti-Spam Act. Once I have time to fully digest this I'll post my thoughts on this, but to get you started the bill deals with four key items of note:

• Form and content requirements for commercial electronic messages
• prohibits address harvesting
• dictionary attacks
• and phishing.

Here is a link to the bill (PFD) that you can ready yourself. Please share your thoughts on this.

IAPP | Privacy After Hours event

Last night the IAPP hosted networking events in several different locations across North America, Europe and Australia. Luckily there was a local event here in Toronto that was easy to find and attend.

Meeting with several individuals that share the same concerns and experiences of your daily life is highly rewarding and gives you the opportunity to discuss the difference and the key privacy aspects your program or other relevant privacy related issues in your local market place.

One of the items that sticks out was the discussion around notice of collection source and notices of the sender... In Canada the Privacy legislation (PIPEDA) states that the sending party is required to;

• Clearly identify your organization
• Provide the ability to opt-out of messages
• Provide a link to your privacy statement
• Have the consent of the individual who's private information is being collected (email is considered private information - Meaning you need consent to send a person email)

Watch for the next IAPP meeting in a city near you, it's well worth the experience.

Learn more on how PIPEDA effects your email deployments can be found here.

Defining Spam - four ways

Mickey, ran this article today on the definitions of spam (as used by various anti-spammers), prompted by an ongoing discussion around the quality of several differnt blacklists being measured by DNSBL.com.

The four clasifications fall into these categories (identified by MickC);

Definition 1: “Mail that comes to my spamtrap addresses which was unasked for”. a.k.a. "unsolicited bulk email”

Definition 2: “mail which violates some legal standard”

Definition 3: “a source most blacklist users would identify as spam-source under the ‘Boulder Pledge’ or a similar notion.”

Definition 4: “mail my users (as a group) do not want.” or “mail that I do not want”.

For the full story and understanding of why these definitions are important to your email campaign read "Multiplying Goalposts", Posted on November 8th, 2007 by MickC

NZ: Unsolicited Electronic Messages Act

Today the New Zealand 'Unsolicited Electronic Messages Act' goes into effect.

Read this short checklist from Scoop:

Step 1- CONSENT - You need the consent of the email recipient in order to send them email messages:

• Express - Direct indication that it is okay to send messages
• Inferred - The person you wish to contact has not directly instructed you to send them a message, but it is still clear that there is a reasonable expectation that messages will be sent (i.e. purchase orders)
  
• Deemed - Someone conspicuously publishes their work related electronic address or mobile number (i.e. on a website, brochure or magazine). Unless otherwise indicted by the publisher
  

Step 2 - IDENTIFY - Commercial emails must always clearly identify the business responsible for sending the message and how they can be contacted.

STEP 3 - UNSUBSCRIBE - Commercial emails must contain a functioning unsubscribe facility.

Are you ready?

Q&A: Send to a friend and CAN-SPAM

Dear EmailKarma,

We’ve been having internal discussions regarding whether or not Send-a-Friend or Refer-a-Friend emails are subject to CAN SPAM laws. I tend to think they are, but am seeking confirmation, what’s your take?

********

Hello,

Please do not take this as legal advice only EmailKarma's interpretation. For legal interpretation of your specific case, EmailKarma recomends you engage your companies legal council for a full review of the SAF/RAF messages your sending.

CAN-SPAM gave us two distinct classifications of email; Commercial and Transactional. These two classes of mail are defined based on the purpose and content of the message. Based on the content of your SAF/RAF messages you will need to fit into one of these two classes.

Commercial; These messages are reasonably understood by a recipient to be selling or promoting a service or product. These must have the proper CAN-SPAM information included in them; Postal Address, web enabled unsubscribe, and subject lines and headers that are not misleading or deceptive.

Transactional; is defined as an email that facilitates an agreed-upon transaction or updates a customer in an existing business relationship. These may not contain false or misleading routing information, but otherwise is exempt from most provisions of the CAN-SPAM Act.

There are also multi-purpose messages that need to be considered and classified into one of the above categories. An example of a multi-purpose message would be your transactional bill of sale with an up sell offer on the next purchase. Based on the subject line, and the uppermost part of the message the you will need to decide how these are going to be treated under your sending policies. Having the transaction/billing details clearly mentioned in the subject line and the purchase information at the top of the message should earn you transactional status, but with an offer at the top of the same message your mail will most likely need to be classified as commercial.

If ever in doubt be CAN-SPAM Complaint, it's better to be safe then sorry.

Do you have a question for EmailKarma? Email them to contact or leave a comment.

What do you need to know about PIPEDA?

Personal Information Protection and Electronic Documents Act (PIPEDA) is Canada's Privacy Law designed for the protection of personal information in the hands of private sector organizations and provides guidelines for the collection.

PIPEDA is built on ten key privacy ideas;

1. Accountability of the organization
2. Identifying Purposes for which personal information is collected at or before the time the information is collected.
3. The knowledge and consent of the individual are required
4. The collection of personal information shall be limited to that which is necessary for the purposes identified by the organization
5. Limiting Use, Disclosure, and Retention. Personal information shall be retained only as long as necessary for the fulfilment of those purposes.
6. Personal information shall be as accurate, complete, and up-to-date
7. Personal information shall be protected by security safeguards appropriate to the sensitivity of the information.
8. An organization shall make readily available to individuals specific information about its policies and practises
   
9. An individual shall be informed of the existence, use and disclosure of his or her personal information and shall be given access to that information.
10. An individual shall be able to address a challenge concerning compliance with the above principles

For additional information and a Compliance Checklist check the PIPEDA Checklist.

New Zealand Unsolicited Electronic Messages Act March 2007

Mobilize mail, an ESP from New Zealand, has been discussing new laws that are starting in early September.

This posting provides a high level overview of the law and the touch points that will effect marketers sending to recipients located in NZ. This law is very similar to CAN-SPAM, but with an additional requirement for consent based (opt-in) mailing.

Key points for compliance that the act requires for compliance:

• Commercial electronic message must not be sent unless the receiver has first consented to receiving the message
• All commercial electronic messages must (unless agreed otherwise) include a “functional unsubscribe facility”
• All commercial electronic messages must include information which clearly identifies the person who authorizes sending the message and how that person can be contacted
• Address–harvesting software must not be used in connection with, or with the intention of, sending unsolicited commercial electronic messages.

Full context of the Unsolicited Electronic Messages Act 2007

CAN-SPAM

What do you know about CAN-SPAM? Are you compliant with the law?

It's easy - Here is what you need to know:

* It bans false or misleading header information. This means you must be accurate and identify the person who initiated the email (aka. the sender)

* The subject line cannot mislead the recipient about the contents or subject matter of the message.

* It requires that your email give recipients an opt-out method and you must honor the requests. Via an internet-based response mechanism that allows a recipient to ask you not to send future email messages, you must include the option to end any commercial messages from the sender.

* You have 10 business days to stop sending email to the requestor's email address.

* It requires that commercial email be identified as an advertisement and include the sender's valid physical postal address.

* Your message must contain clear and conspicuous notice that the message is an advertisement or solicitation and that the recipient can opt out of receiving more commercial email from you.

Find more CAN-SPAM info here.