Spam Law Test

Cleansing our inboxes of spam was supposed to get easier following passage of the nation's sweeping antispam law, the Controlling the Assault of Non-Solicited Pornography and Marketing (CAN-SPAM) Act. The law, which celebrates its first anniversary in January, requires (among other things) that recipients be allowed to opt out of being included in a marketing mailing list, simply by clicking a link on an e-mail notice from the marketer. In addition, the CAN-SPAM Act establishes harsh penalties for senders whose e-mail messages fail to meet its requirements.

Testing the Law

Few people seriously expected CAN-SPAM to discourage the prolific no-name offshore spammers. However, in a test in which we signed up for and then attempted to opt out of receiving marketing e-mail from 100 heavily trafficked U.S. Web sites, we were surprised to discover that when we tried to unsubscribe, several of the best-known sites--among them Amazon.com--continued to send us e-mail after the ten-day grace period that the law allows had expired.

Overall, we were unable to stop e-mail from 15 of the sites (or from their partners) without resorting to calling their media-relations representatives. Our investigation also revealed that the spam law's sometimes vague language makes it difficult for users to stop getting unwanted e-mail.

The CAN-SPAM Act stipulates that all marketing e-mail messages must include both an easy-to-locate opt-out link and the sender's postal mail address. The law also requires that commercial e-mailers--as well as their marketing partners--honor opt-out requests within ten days of receiving them.

To test how well the business community at large is complying with CAN-SPAM, we visited the Web pages of 100 leading firms in various industries, including retail, travel, media, and financial services. Using a unique e-mail address at each site, we signed up for at least one newsletter offered there. As soon as the e-mail started to flow, we unsubscribed from all the lists.

The results weren't entirely disappointing: 78 of the companies sent messages that adhered to CAN-SPAM requirements, and honored our requests to stop receiving e-mail. Seven other companies sent us messages that lacked a physical postal address, but they did honor our opt-out request.

The addresses we used to sign up with the other 15 companies, however, continued to receive e-mail long after we tried to unsubscribe from the mailing lists. Two of the firms associated with those inboxes failed to include an opt-out mechanism in their e-mail; a third had an opt-out link that didn't work. Eight others continued to send us e-mail more than ten business days after we exercised their opt-out option; and we received e-mail from marketing partners of another four sites. (See the complete list of the companies we signed up with, our methodology, and our test results.)

When we asked companies about our difficulty in opting out, the responses varied. For example, Amazon.com, which continued to send e-mail after our opt-out request, acknowledged the error. A spokesperson blamed a technical aberration, which the company tells us has since been corrected.

Similarly, Internet Broadcasting Systems, which partners with television stations to publish local news Web sites, said that its failure to include an opt-out link with its Career Tips newsletter (a weekly e-mail) was an oversight. The company has since added such a link to the newsletter, which we received when we signed up for mail from Boston's ABC affiliate, WCVB-TV.

The Fog of CAN-SPAM

Our experience with several of the Internet businesses that continued to send us e-mail after we notified them that we wanted to unsubscribe illustrate the sometimes confusing aspects of CAN-SPAM. For example, we had no trouble opting out of the newsletter we had requested at the travel site SideStep--but then two weeks later we began to receive a second newsletter that we had never signed up for.

SideStep spokesperson Kristen Evans said the company had erred in sending the second newsletter, owing to a glitch introduced during a site upgrade. Recently, SideStep made unsubscribing from its mailings easier, with a new Web page you reach when you click the opt-out link in a message.

David Sorkin, a professor at the Center for Information Technology and Privacy Law in Chicago's John Marshall Law School, says that it's unclear whether SideStep violated CAN-SPAM by sending us the second newsletter after we unsubscribed from the first one. "There are still many aspects of CAN-SPAM that are very much gray," Sorkin says.

Crying Uncle

Meanwhile, our experience with FreeLotto.com was typical for the sites where signing up for e-mail produced scores of messages from third parties. To be eligible for the daily prize drawings held at FreeLotto.com, we had to agree to receive marketing e-mail from FreeLotto's parent company, PlasmaNet, and other marketing partners. But despite our repeated use of opt-out links in messages from FreeLotto, PlasmaNet, and their partners, we continued to get mail four weeks after unsubscribing.

When we contacted PlasmaNet, a spokesperson told us that we hadn't opted out correctly. To unsubscribe from all PlasmaNet-related e-mail, the spokesperson said, we should visit PlasmaNet's Web site and update our marketing preferences there. We followed these instructions; but at press time some two weeks later, the account we used for PlasmaNet was still receiving about 12 e-mail messages a day, down from a peak of 60 a day.

Address Unknown

Every firm that didn't include a physical postal address in its e-mail messages said it considered itself exempt from CAN-SPAM because of a provision in the law that has become the subject of debate.

For example, Tribune Interactive marketing services manager Rebecca Prazak says the company's weekly Metromix entertainment newsletter is exempt from the postal-address requirement because it is editorial, not commercial e-mail--even though it does include ads. But Anne Mitchell, president of the Institute for Spam and Internet Public Policy, an Internet public policy advisory group, says that a newsletter with ads that generate income could be construed as commercial e-mail and for this reason should include the snail-mail address. (Full disclosure: PC World's newsletters, which contain advertising, include both an opt-out link and a postal address.)

Disagreements over what types of e-mail CAN-SPAM governs aren't uncommon, say lawyers at the Federal Trade Commission, one of the agencies responsible for enforcing the law. Many conflicts stem from a provision that exempts "transactional" or "relationship" e-mail--for example, messages that confirm online purchases, recall products, or relay information of interest to members of an organization--from most of the law's terms.

The CAN-SPAM Act explicitly permits transactional messages to include advertising.

A Confusing Law

"Based on the queries I've received from marketers, some e-mail senders are finding it challenging to understand how the act applies to their messages," says Michael Goodman, an FTC lawyer.

The FTC planned to issue, in December 2004, rules defining when the primary purpose of an e-mail message is commercial versus transactional. Goodman says that this should help marketers more clearly understand when and how a newsletter (such as the ones we received that omitted a postal address) must comply with CAN-SPAM.

The Bigger Picture

While CAN-SPAM has given Internet service providers and state and federal authorities new tools to prosecute illegal spammers--some of whom have already gone to jail or paid substantial fines--its impact on spam overall has been minimal. According to e-mail security firm MX Logic, in October 2004 only 4 percent of all unsolicited commercial e-mail complied with the law, and 80 percent of all e-mail traffic was spam--up from 60 percent at the beginning of the year.

"CAN-SPAM has been a complete failure when measured against the porn, prescription drug, and Nigerian bank scam e-mails that still make it into our inboxes," says Jim Nail, principal analyst at Forrester Research.

Some observers say that antispam laws in the United States have only driven the worst abusers of commercial e-mail overseas. In fact, Internet security firm Sophos found that the proportion of global e-mail originating in China and Hong Kong rose from 6 percent in February 2004 to 12 percent just six months later. Korea's share during the same period shot up from 6 percent to 15 percent.

Sorkin says that minor missteps by businesses like Amazon and SideStep are not the real cause of spam.

"The problem is with the unscrupulous," Sorkin says. "But if Amazon can't comply 100 percent of the time, I suspect other reputable companies are struggling."

As hopes fade that laws can reduce the burgeoning levels of spam, other approaches are moving to center stage. In January 2004, Microsoft chairman Bill Gates predicted that technology would win the battle against spam by 2006. Our fingers are crossed.

Testing the CAN-SPAM Act

Using a unique e-mail address for each Web site, we signed up to receive newsletters and other marketing materials from 100 sites identified by ComScore Media Metrix and Nielsen/Netratings as being among the most visited Web destinations. We then tried to unsubscribe, using opt-out links in the e-mail we received. Below is a list of the sites, organized by category.

Adult (4)

• Adult FriendFinder
• AEBN (Adult Entertainment Broadcast Network)
• BrainPass.com (Peter North)
• MILFhunter.com

Business/Finance (9)

• CoolSavings
• Forbes.com
• JPMorgan Chase
• LendingTree
• MSN Money
• Netscape Money & Business
• PayPal
• Skype Technologies
• Yahoo Finance

Entertainment (16)

• Disney Online
• Eight Days (Hot or Not?)
• Electronic Arts Online
• GameSpy.com
• Intermix Media (GameRival)
• Miniclip.com
• Moviefone
• Musician's Friend
• PopCap Games
• RealNetwork.com (Real.com)
• RealNetworks (Gamehouse.com)
• Shockwave.com
• Sony USA
• Viacom Online (MTV.com)
• Warner Music Group (www.wmg.com)
• Yahoo Launch

Free Stuff (4)

• FreeFlatScreens.com
• FreeiPods.com
• Publishers Clearing House (PCH.com)
• YourGiftCard.com (Free-Bracelet.com)

General News (10)

• ABCNews.com
• CNN.com
• Discovery.com
• IBS Network (TheBostonChannel.com)
• Knight Ridder Digital
• MSNBC.com
• New York Times Digital
• Tribune Newspapers (Tribune Interactive)
• USAToday.com
• Yahoo News

Health (8)

• Drugs.com
• Drugstore.com
• EDiets.com
• EMedicine
• MSN Health
• Trimlife.com
• Walgreens.com
• WebMD

Lotteries/Sweepstakes/Gambling (9)

• Casino City
• Dreamamint (3Turtles.com)
• FreeLotto
• IGlobalMedia Entertainment (PartyBingo.com)
• IWon.com
• Jackpot City Casino
• LuckySurf.com
• Starluck Casino Online
• Uproar Network (Uproar)

Retail (20)

• Amazon.com
• American Greetings (AG.com)
• EBags
• EBay
• Hewlett-Packard (HP.com)
• L.L. Bean
• Next Tag
• Oldnavy.com
• Overstock.com
• Sears.com
• Shopping.com
• Snapfish
• Target.com
• Ticketmaster.com
• VersionTracker.com
• VistaPrint
• Walmart.com
• Whenu.com
• Yahoo Shopping
• Zappos.com

Sports (9)

• CBS SportsLine.com Sites
• College Sports Television (CollegeSports.com)
• ESPN.com
• FoxSports.com
• MLB.com
• NASCAR.com
• NBA Internet Network
• NFL.com
• Sports Illustrated (SI.com)

Travel (9)

• CheapTickets
• Expedia
• Hotels.com
• Orbitz
• Priceline.com
• SideStep
• Southwest.com
• Travelocity.com
• TripAdvisor

Weather (2)

• AccuWeather.com
• Weather Channel (Weather.com)

The Results

Following are the Web sites that either failed to stop the flow of e-mail to our inbox within ten days of our unsubscribe request (the grace period specified in the CAN-SPAM Act) or included no postal address in their e-mail.

Companies that continued to send us e-mail ten days after we opted out:

• Amazon.com
• BrainPass.com (Peter North)
• FreeLotto
• IWon.com
• MILFhunter.com
• NFL.com
• SideStep
• Viacom Online (MTV.com)

Companies that stopped sending e-mail but failed to stop mail from marketing partners:

• Jackpot City Casino
• Uproar Network (Uproar)
• Weather Channel (Weather.com)
• YourGiftCard.com (Free-Bracelet.com)

Companies that didn't include an opt-out link in their e-mail:

• American Greetings (AG.com)
• IBS Network (TheBostonChannel.com)

Company whose opt-out link did not work:

• GameSpy.com

Companies that honored our unsubscribe request but didn't include a postal address in their e-mail:

• College Sports Television (CollegeSports.com)
• Eight Days (Hot or Not?)
• FoxSports.com
• Moviefone
• PopCap Games
• Sports Illustrated (SI.com)
• Tribune Newspapers (Tribune Interactive)