VerticalResponse Email Marketing Blog for Small Business

CAN-SPAM, Canadian-style!

Last October, the Fighting Internet and Wireless Spam Bill (aka Bill C-28), the Canadian equivalent of the US CAN-SPAM act of 2003, came under fire as it faced strong lobbying from local businesses, who are looking to add amendments to the law and delay its formal implementation. This is part of an ongoing legal battle as the Bill, formerly known as the Electronic Commerce Protection Act (or Bill C-27) before its prorogation in 2009, had already faced similar criticism and debate before finally being passed by Parliament in December 2010.

You would think anti-spam legislation shouldn’t be a cause for such controversy, so to help understand the situation better and avoid having to sift through all the legalese involved, here’s a quick snapshot of the email dos and don’ts north of the border.

CAN-SPAM (US)	Bill C-28 (Canada)
Similarities
No false headers or subject lines Valid postal address Unsubscribe requirement Cannot alter transmission data Cannot perform address harvesting or send to harvested addresses Liability for brands who knowingly allow spam to be sent on their behalf
Differences
Applies to email only. Addresses Spam only. Opt-out; you can technically mail any person at least once. Private Right of Action (PRA) available only to ISPs.	Covers "Commercial Electronic Messages" (CEM) including Email, SMS, Instant Messages and Social Media postings. Addresses broad range of Internet issues including spam, spyware, phishing, etc. Primarily Opt-In; Permission Based in writing, valid for two years only. Private Right of Action (PRA) available to anyone such as individuals, businesses, etc. Replies must go to an address that is monitored. May not use “no-reply” addresses.

Chief among concerns for the lobbyists is the current Bill’s requirement to obtain consent “in writing,” which they argue isn’t necessary as electronic or verbal consents should be enough, like in most countries. Also, the form requirements on commercial emails ask for a website address, even though many businesses are not yet online. Additionally, each group has their own concerns that apply only to their own business types (financial, industrial…), so this could take some time before all parties agree on a compromise and the law finally goes into effect. Final regulations and interpretations of the bill are currently slated for early 2012, when there will be further definition about the need to the date and source of opt-in information. 

So, while we wait for all the legal wrangling to subside, here are some guidelines to preemptively avoid being flagged by the cyber-mounties:

• Establish a baseline policy for all digital communications with subscribers.
• Review the latest email policies to ensure compliance, as Bill C-28 regulations are more aggressive than the US-based CAN-SPAM ones.
• Know that penalties can be as high as 1 million CAD per violation for individuals, and 10 million CAD per violation for organizations.
• Move away from an opt-out (pre-checked) to an opt-in (not pre-checked) box on subscription forms.
• Segment your subscribers based on expressed preferences, observed behaviors, and demographics.
• Use preference centers so that subscribers can choose the timing and frequency with which they receive emails.
• Capture when and where your subscribers signed up, especially if you are collecting sign ups by hand.
• Never purchase or rent lists, or do email appends.

VerticalResponse has a strict anti-spam policy. All customers are required to adhere to the CAN-SPAM regulations. By adhering to VR’s strict Opt-In requirement for all email sent from our application this ensures compliance with nearly all global email marketing laws and guidelines. 

Are you aware of any other international email regulations? Do they make sense to you? Do you believe these types of laws help companies such as yours run their business or, on the contrary, hinder them? Share away in the comments!

Resources: 

• Michael Geist’s blog, Canada Research Chair in Internet and E-commerce Law at the University of Ottawa, Faculty of Law
• Canada's Anti-Spam Legislation
• Email Spam Legislation by Country

Related posts:

• Was the White House Spamming?
• Is It Spam?
• UK Spam Law - Attention all UK-Based Companies

 

Posted by My Truong.

My Truong, is the Marketing Programs Manager at VerticalResponse. Connect with him on Twitter @PtitMy.

Was the White House Spamming?

You may have heard the brouhaha about the Obama administration sending an email marketing campaign out to millions of recipients last week regarding the health care reform. During a press conference Fox News reporter Major Garret asked why the White House is sending unsolicited email to people who have not opted-in to receive email from the administration. Apparently he got one of these emails with the subject line reading "Something Worth Forwarding".

Funny enough, I'm on this list, and I didn't get this email. I'm on all candidate lists so I could monitor what they were doing during the election. However, this particular email came from "David Axelrod" who is one of the President's advisers. I have received emails from him in the past, so it's strange that I didn't get this one.

So as it turns out, the White House responded that they are going to redo their email rules and only send email to people who request it. An Obama spokesperson said:

“We are implementing measures to make subscribing to e-mails clearer, including preventing advocacy organizations from signing people up to our lists without their permission when they deliver petition signatures and other messages on individual’s behalf.”

So are they suggesting that people are being signed up without their permission? It looks like it. According to the White House this list has been mailed to before but maybe not about this subject. Was it the content that got people angered? Who knows, but in any event I think the White House made a series of mistakes during this entire process.

Who is David Axelrod Anyway?

In my opinion their first mistake was to send an email with such highly volatile content and have it NOT come from the President himself. Yes, I know he's Barack's Senior Adviser, but he's not Barack.  I signed up to get emails from Barack Obama not David. Had I received the email from Obama, there is a good chance I would have opened it. I don't know why the administration uses other names.

Why Is It So Difficult to Send Email to Those Who Want It?

The second mistake is that the White House should keep track of who they can send email to and who they shouldn't. It's a pretty easy task to do. Then they don't risk upsetting their constituents and they won't have a PR nightmare (like it has become.)

Why the Deceptive Subject Line?

According to CAN-SPAM, the subject line should relate to the content of the email. The subject line "Something Worth Forwarding" crosses the line and does not really describe the email content.

Politicians Get a Free Pass in CAN-SPAM

Since CAN-SPAM regulates "commercial email", politicians kind of have a free pass when it comes to email marketing. Under the CAN-SPAM law they can pretty much send to the lists of people that sign up as well as lists of people that don't. Should they? In my opinion, no. They should be sending email to those who want it. It's better for their "brand".

Make sure you're looking at who is on your list and who you're sending email to. If you don't do it correctly (as the White House proved) you could damage your brand that you work so hard to maintain.

What are your thoughts on this?

Is It Spam?

We recently sent an email marketing campaign about a webinar we hosted with the folks over at Google Apps. Soon after we sent the email, an angered customer of VerticalResponse emailed me telling me how disappointed they were that we were "soliciting something that wasn't from our company" and that is spam.

I replied that we aren't soliciting anything, we're not asking for money (the webinar was free) and we were not getting paid by Google. In fact I told them that there are a ton of Google Apps that are free. I told them that we use Google Apps and we just think that our customers can benefit from knowing about how they can use these products with VerticalResponse.

Then I found this from the Spamhaus Project:

Spam is an issue about consent, not content. Whether the UBE message is an advert, a scam, porn, a begging letter or an offer of a free lunch, the content is irrelevant - if the message was sent unsolicited and in bulk then the message is spam.

So we emailed our users about something we were doing, with Google, that they could benefit from for free. I think that's pretty far from the 100's of spam messages I get in my inbox that I never signed up for. So I told this customer if they were so offended they could unsubscribe.

P.S. I noticed this customer got a huge ratio of spam complaints on one of their mailings...now who is the spammer? ;-)

CAN-SPAM - New Updates to Federal Law

I asked our ISP Relations & Deliverability Manager George Sukara to update me on some new CAN-SPAM rulings that just happened this past week (and break it down in plain English for all of us.)

1) POSTAL ADDRESS - Valid Physical Address can include a PO box or Mail Stop, as long as the USPS recognizes it. This might be an obvious one but it used to be a gray area, now it's not.

2) PERSON is now defined not just as a human, it can also be a corporation, non-profit, etc. This is who is responsible for CAN-SPAM compliance when sending a commercial email. So business entities, as well as regular folks are now responsible for CAN-SPAM compliance in regards to all commercial email they send.

3) DESIGNATED SENDER RULE - This applies to you if you include any advertising or partners in an email. If you don't include your company name "in the email" with a link to access your site, your advertisers are responsible for CAN-SPAM compliance even if your name is in the From Label. This mainly applies to companies who send coupons or offers on behalf their partners.

For example: Company A sends an email to their list with a special offer from Company B. In the email, Company A must have some information that advertises their own service, and some way for the recipients to access their site.

If Company A does not include some kind of ad for their own company inside the email, then Company B being advertised within the email would be responsible for all CAN-SPAM compliance.

IMPORTANT NOTE: If you're advertising in another company's email marketing campaign, make sure they put something about their services with a link to their site. You don't want to be on the hook for their CAN-SPAM compliance.

Also, CAN SPAM states (again) that all commercial emails:

• Must have a working reply-to address or other web based opt-out mechanism (which must also be conspicuous) for the company listed in the From Label
• Can't be false or misleading
• Can have no deceptive subject lines
• Must comply with the SEXUALLY EXPLICIT label

4) UNSUBSCRIBE - Unsubscribes must not be complicated, nor can it require some kind of purchase, or taking a survey. The only thing you are allowed to ask for in an unsubscribe is an email address and the user's email preferences.

As usual we'll keep you informed on most of the CAN SPAM updates, just be sure you follow the simple the rules above and you'll be AOK.    

You Know You're a Spammer If...

VerticalResponse users are not spammers. You all upload lists of people that agreed to get email from you at one point or another in some way. It may have been an opt-in form, it may have been when they handed you their card to contact them at a trade show. So how would you know if you are a spammer? I've taken a stab at poking fun at some real world spammers.

You know you're a spammer if:

• You bought a CD of 250 million email addresses for “only $29.95!”
• You sell Viagkra or Ciialliis
• You have a Nigerian Uncle who needs $1 Million FAST!
• You email your same list 5 times a day.
• You refuse to let anyone (including the Feds) find you by your postal address.
• You’ve figured out the by mailing people from “Paypal” you can ask them to “verify their credit card number” by entering it in the field below.
• Your subject line says “Are we on for our meeting?” and your content reads “All New Online Drugstore – 50% off!”
• You work at a company that makes canned, jellied meat.

Ok, this is what a 6 hour plane ride gets you all, me being silly. Just for fun, got any to add?

UK Spam Law - Attention all UK-Based Companies

The UK has updated  the Companies Act 1985 to the Companies Act 2006 and has some additional requirements for email and websites. All companies that send email from the UK need to put your registered address in the footer (instead of just a valid company address) along with your company registration number and place of registration. 

So an example footer might be:

VerticalResponse UK Division
5 Little Surrey Rd.
London, UK GHS-579

VerticalResponse UK is a company registered in England and Wales with company number 1ABF79863

There hasn't been a ton of press about this but this site has an article on the law and a site called Out-Law.com has some great information but you have to register (it's free).

If any UK customers have any more information on this please comment!

Reap the Benefits of Opt-out Forms

Question of the day for our users? Why aren't more of you taking advantage of our opt-out forms?

Here's the deal: An opt-out form simply gives you a consolidated way to manage those who unsubscribe from your email marketing campaigns.

Take this small quiz:

• Do you have an unsubscribe link somewhere on your site that goes into some database and you really aren't sure where?
• Do recipients call you and ask you to take them off your list? (I know, gasp!)
• Are your unsubscribes in places OTHER than your VerticalResponse account?

If you answered "yes" to any of these questions then you need to be aware of what the Free Opt-out form can do for you - put all of your unsubscribe data in one simple-to-download space.

Here are five compelling arguments in favor of opt-out forms:

1. Complying with the Federal Law - Honoring unsubscribe requests from your email marketing campaigns has always been a good business practice, but the CAN-SPAM Act of 2003 made it the law. Opt-out forms provide an easy, automated way for companies to update their unsubscribe list in real-time.
2. Set-up takes minutes - With our wizard-based system, you can create your very own web form. Then, simply copy and paste a few lines of code into your website and watch the opt-out form instantly appear.
3. Unsubscribe management - VerticalResponse opt-out forms allow you to manage unsubscribe databases with a minimum of fuss. Customers can unsubscribe directly from your website, or they can contact your office or call center to remove themselves from your list. You or they can simply type in the email address and they won't get another email. It's that easy.
4. 24-7 Access - VerticalResponse keeps your unsubscribe data constantly updated and grants you access to this information at all times. Best of all, if you need to take the data with you or share it with someone else, you can easily download all of your unsubscribes into an exportable file in minutes.
5. It's FREE - Need we say more? No one wants users to unsubscribe, but it just happens, even to the best of us. So stop the madness! A VerticalResponse opt-out form is an easy way to stay on top of the data and on the right side of the law.

FTC Nails Kodak and ICE.com for Violation of CAN-SPAM

It was bound to happen. It seems like the FTC has been wanting to nab a few legit email marketers violating the CAN-SPAM law. Last week they did it, they charged Kodak (formerly Ofoto) and ICE.com, two companies that VerticalResponse has approached in the past about retaining us for their email marketing needs.

The story? Kodak Imaging Network sent over 2 million messages and didn't have an unsubscribe mechanism or a postal address included in their emails. The outcome? They had to pony up over $26,000 in penalties. Ouch.

ICE.com's story was different. They sent an email marketing campaign to 6,000 people who had previously unsubscribed. Their penalty was a "cool" $6500.

So there you have it. If you use almost any ESP like VerticalResponse, you're ok, we ensure that you have a postal address and that the unsubscribe mechanism works indefinitely (not just the required 30 days).  We also ensure that you don't email someone who has unsubscribed using our mechanism.

(Oh, and thanks to Christopher for such a nice comment about how I had mistakenly published it was 10 days instead of 30, either way VR has you covered.)

Why "Do Not Email" Registries Can Be Dangerous

Last week in DM News, Ken Magill reported a story that shows the precise reason why email registries don't work: they can be a target.

I'll recap it for you if you don't have time to read the whole story. Here's what the company featured in the story, Blue Security, does:

• People who don't want email subscribe to a "do not intrude registry" from Blue Security.
• Blue Security assesses where spam is coming from from desktop software on a registrant's computer.
• Blue Security finds the opt-out/unsubscribe on the spammer's website and automatically bombards the servers with requests.
• The spammer's servers are bogged down potentially slowing them from spamming.

Here's what happened:

• The spammer got mad!
• Said spammer then compared all of the requests to be removed with their internal list and specifically pulled those addresses out.
• The spammer emailed the list with this excerpt:  "You are receiving this email because you are a member of Blue Security," the message reads, in part. "Due to the tactics used by Blue Security, you will end up receiving this message, or other nonsensical spams 20-40 times more than you would normally."
• The attack took Blue Security down for some time.

In this case the spammers were specifically trying to target and attack the registry even if they didn't do it by hacking into the databases. This story illustrates another point for exactly why registries can be dangerous.

Got a comment? Let's hear it!

Child Protection Registries...Quiet for Now

Even though we are still saddled with those in Michigan and Utah, it looks like other potential child protection registries are dead in the water. Bills in Georgia, Connecticut, Iowa, Wisconsin and Hawaii seem dead or dormant as of a week ago.  Read more on this story on each of these bills from Ken Magill, Direct Magazine.

For our previous post on Michigan and Utah registries go here. We'll continue to keep you updated as things change.