REPOSTED from E-Mail Precisley

You are in complete control of how long customers should and will maintain their online relationship with you.

 

Some marketers stack the deck by pre-checking fields that sign a customer up to receive e-mail, such as during the purchase process. Some prefer to make customers check a box to opt-in.  Others acquire names and just add them to their mailing list with without any advance notice or consent from the consumer.  So what's the right thing to do?

 

The first thing to consider is legal compliance.  Remember though, just because it’s legal doesn’t mean it's right.  Think about this for a moment, would you stand in the middle of Times Square and yell insults at people?  Expressing your opinion in that way is legal, but it won't garner you any friends.  In the US opt-in is not required.  It is legal to make people opt out, but is it the right thing to do? 

 

The answer to that question is philosophically steeped in the definition of the relationship the marketer wants to have with their customers.  The relationship needs to be about mutual respect and a reciprocal value proposition. For example:

• IF, the marker clearly and conspicuously discloses that by entering an e-mail address the customer will begin to get relevant and targeted information about their respective services, opt-out might be fair.
• IF, the marketer does a good job explaining what the benefits are of the e-mail and then honors them, opt-out might be fair.
• IF, the registration form clearly states that the customer needs to uncheck a box, opt-out might be fair. 
• IF, there is a link to the privacy policy that explains what happens to their PII and how they can change that information or limit who it is shared with is next to the registration form, opt-out might be fair.

On the other hand, in the EU and many other countries, opt-out is not legal.  Permission is required to send commercial e-mail.  But, if the marketer doesn’t adhere to the principles above, their customers will probably opt-out or stop responding anyway.

  

Whether names are acquired via opt-out, opt-in, or double opt-in really don’t matter (assuming you are legally compliant).  Regardless of what type of permission you have the responsibility to maintain the trust and respect of your customers ultimately falls on your shoulders.  It is critical to be:

• Transparent about your data collection/use
• Respectful of your customers’ preferences
• Timely and relevant with the content you send them

The fallacy of the opt-out strategy is that it will yield a larger customer database.  The myth of an opt-in policy is that the customer is willingly expecting your next e-mail.  The reality is that the customer gets the final say.  They will flourish, become dormant, complain or just leave if you don’t live up to your end of the bargain.

 

Rick Buck

VP privacy and ISP relations, CIPP

e-Dialog

One of the biggest topics in organizations today is the need and desire to grow their subscriber list.  Most companies believe that the bigger the list they have, the greater chance they have to sell more stuff.  More stuff sold + more revenue = happy companies.

Some organizations take the hard road and build their list organically and spend money and resources on properly activating and creating brand advocates in their subscriber base.  They recognize that the size of their list is not as important as the overall lifetime value of their subscriber.  These organizations often have pressure internally to grow faster by out of touch executives with unrealistic expectations on subscriber growth.  In most cases though, these companies follow the good path to growth and are prosperous in the long run.

Then, every once in awhile there are organizations that take the easy road.  They use so many different channels, spend a ton of money on third parties that promise the world who often are using the same 50 Million Opt In, Can-Spam compliant list to try and bring in as many subscribers as they can.  These organizations say they are interested in quality, but often mask that with a “yea butt” statement of “we still need to get to X million subscribers by X date”.  Activation, welcome and engagement strategies are thrown out the window and the focus becomes on getting their X subscribers to buy stuff so their investment is not wasted. 

Sit back for a minute and think of acquiring a single or 5 million new subscribers as a party that you are hosting.  You certainly would not invite anyone over to your party unless you had cleaned up your house, got the hors d'oeuvres, the drinks, music etc.   When your guests arrive, do you open the door and let them stand there or do you give the tour of where everything is so that they can enjoy themselves.  As more and more people hear about how great your party is, folks will want a piece of the action and convince you to invite their friends.  Eventually it will lead to a bunch of riff raffs wanting in which will eventually ruin it for everyone.

Before you put some super aggressive acquisition plan together, ensure that your house is in order and you are ready to greet your guests. One of my colleagues and fellow bloggers here, Matt Vernhount says is beautifully: “It’s not the size of your list, its what you do with it”

Invest time and money to the more important part of acquisition.  You and your subscribers will be glad you did.

The recession has made citizens more attentive to scams, especially those that promise easy money or frighten people about the banking system.  This accelerates the already large regulatory agenda of the US Federal Trade Commission (FTC), whose role as a “civil prosecutor” includes regulating and enforcing protections from online offers, advertising and email marketing.  Congress is also stepping up, and two major initiatives around privacy protection and the role of the FTC are in active play.

Partnering with all of us in the email industry, and watching to make sure we self-regulate well, remains a key component of the FTC’s plans, says Lois Greisman, Director, Division of Marketing Practices for the FTC Bureau of Consumer Protection, who joined the second annual DMA/Email Experience Council legislative update webinar on May 19th.  “Our goal is to stop fraud and scams as quickly as possible, to shut down offenders, and, where appropriate, seize assets and reimburse consumers,” she said in the webinar.

The recording of the full event isfree for DMA/eec members: 

The US CAN SPAM Act of 2003, which regulates permission practices for email marketing, continues to be a key anti-fraud tool for the FTC.  Greisman noted several successes in prosecuting spammers and other deceptive practices and said enforcement continues to be a major priority.  “CAN SPAM has worked well to level the playing field among legitimate online marketers,” she said.  She also added that she was not aware of any active proposal by the FTC or Congress to expand or change the law.

However, there are two active proposals of new legislation that could have significant impact on email marketing and the email industry as a whole.

1. Online Privacy Protection Bill: 

A “Discussion Draft” of a bill to require notice and consent to any individual PRIOR to collecting or using personal information was released in early May in the US House of Representatives from Representatives Rick Boucher (D-VA)and Cliff Stearns (R-FL).  Industry and consumer groups alike are not happy with the draft, including the DMA.  Although it may seem at first that the so-called Boucher Bill was just about online behavioral advertising conducted by large marketers; it turns out that it’s very broad and far-reaching on privacy and data security.   In the webinar, Jerry Cerasale, VP, Government Relations for the DMA, gave a very good overview of coverage, exceptions and terms of notice.  Basically, it impacts nearly all kinds of “first party” senders as well as any other company that has access to that data as a “third party.”  It proposes coverage of an extensive list of “unique and persistent” personal data on consumers.

“One potentially bad impact this could have on the email industry concerns the scope of covered data, including email address, IP address, and other unique, persistent identifiers,” says Tom Bartel, CIPP, vice president,  Receiver Services at Return Path, a panelist in the webinar.  “If the exceptions for transactional and operational purposes and for service providers are not effective and clear, this bill could interfere with many industry collaborations.  This includes IP-based reputation systems – data that determines if email messages reach the inbox or not.  It may also impact the operation of Feedback Loops provided to email senders by mailbox providers like Yahoo! and Hotmail.  These feedback loops are a key component in how the industry keeps bad actors out of the email ecosystem.”  

Both Representatives Boucher and Stearns have indicated a willingness to work with industry and have requested comments on the bill,  The DMA has already commented, Cerasale said.

2. Expansion of FTC Powers: 

Congress is also considering significantly expanding the powers of the FTC as part of the Wall Street Reform and Consumer Protection Act (HR 4173).    There is not a corresponding bill in the Senate, although Cerasale said in the webinar that one may be introduced later this year.   

Part of the proposed regulation would give the FTC “unbridled authority” to create rules around “unfair or deceptive acts or practices” for many industry sectors.  Cerasale expressed concern about this, and said that more checks and balances are needed.  It is also unclear how this expansion will impact emerging technologies like social or mobile, he said.  

Another part of the proposed bill increases the FTC’s enforcement powers to seek civil penalties. “That may be helpful in catching spammers and other abusers of email marketing,” said Rick Buck, CIPP and VP, ISP Relations and Privacy at e-Dialog in the webinar.   “Marketers who feel they are exempt from prosecution because they are legal under CAN SPAM may be following the letter of the law, but not the spirit.  I encourage everyone to go beyond the legal requirements and aim to provide email experiences that are welcome and engaging to subscribers.”

The FTC’s Greisman said only that, “We welcome any support from Congress that helps the agency be more effective and efficient.”  There are some “tools that we lack which Congress may grant us the power to use,” she said.

A third element to this proposed legislation is on responsibility/liability of the delivery provider (broadcast vendor, ESP, MTA Vendor) if their clients do not follow CAN SPAM or other regulations.  “This aiding and abetting aspect is very concerning,” said Dennis Dayman, VP, Privacy & Online Security at Eloqua,another panelist in the webinar.   “Blurring the lines between purveyor and sender may place an undue penalty on others in the ‘chain of responsibility’ for all brands involved in online advertising or other online acquisition efforts, like third party email senders and publishers,” Dayman said.

Greisman also reported in the webinar that there is no significant update on the behavioral targeting protection guidelines that the FTC has had out for comment for over a year. “Nothing will happen without input from industry,” she said.  Since the mandate from the FTC has been, “self regulate or else,” the webinar panelists gave a number of suggestions for marketers to follow best practices, including:

1. Ensure transparency in disclosure and notice of permission and use of data
2. Be very clear about opt out vs. opt in.  CAN SPAM requires only an opt-out, but that is the “bare minimum,” Buck advises.
3. Update your Privacy policy and provide prominent links
4. Audit your data usage practices
5. Be clear on use of data in all web forms and at the point of collection/sign up.

Marketers and everyone in the email industry can support the FTC, Greisman said.  She suggests:

1. File a complaint. When those complaints are also referred by the DMA, they are particularly helpful, Greisman said.
2. Make sure your opt out mechanisms are working.  (E-dialog’s Buck recommends checking this at least annually, and preferably monthly.)
3. Be clear about the sender and the advertiser relationships.  (Return Path’s Bartel recommends first party senders consider “framing” the content from third parties or advertisers and clearly distinguish between editorial (original content) and advertising.)
4. Keep data clean, particularly around new sources.  (Eloqua’s Dayman also recommends care around affiliates’ use of data.)

The legislative update webinar was sponsored by Eloqua, E-Dialog and Return Path, with technology sponsor GoToMeeting. The recording of the full event is free for DMA/eec members.  More details on these and other legislative issues important to digital and direct marketers is in the DMA’s quarterly government affairs newsletter, Politically Direct.

(The Deliverability Forum is a series of interviews I hosted with industry leaders and luminaries over the past few months.  It came to closure last week and I have shared the final post with takeaways and highlights from the Bronto blog.)

It is with a bit of ennui that I must close this series.  Many thanks to everyone who contributed to the blog posts over the last few months and gave their uncensored opinions around what they find valuable, in need of change or what interesting developments are in the pipeline.  As we began, so we will end - you may not have direct access to these industry leaders but I hope the conversations I've shared have given you insight into the minds of those who have direct influence over the email industry from a sender's and receiver's perspective.  And thank you for the comments and readership thus far.

If you missed any of the blog posts, they are laid out below in chronological order with a high level summary of the post and my takeaways for you as a reader to glean from the interview.  Also, I've included a "definition" section at the bottom of this post if there are any acronyms that you might be uncertain about.  Please scroll down to access it.

The Players:

The FTC (post) describes in the US government's own voice how spam is regulated and counteracted.  Ethan Arenson, the FTC Spam Coordinator, spells out the very serious consequences of not being CAN-SPAM compliant and where to go for their exacting interpretation of what exactly is required of all commercial mailers.  It also shows the government's willingness to help curb the problem of unwanted email by enforcing industry standards such as authentication in a non-legal but best standard way.

My take: While most commercial emailers are compliant with the law (especially if using an ESP such as Bronto), it remains in your best interest to stay cognizant of the law and have someone you trust and can defer to when you're not sure if what you're doing is legal.  Also, the FTC regularly updates the Act's provisions so make sure to stay abreast of the latest rules that are voted in by the FTC commissioners.  We are talking about law here with real civil and criminal consequences if broken.  You don't want to find yourself being accused of a federal crime wherein ignorance of the law won't hold much water!

Pivotal Veracity's (post) President and CEO, Deidre Baird, explains the importance of both authentication and user engagement.  Pivotal Veracity is neither an ISP nor an ESP, but rather a deliverability intermediary services company with deep expertise around content and email disposition.  Also, Pivotal Veracity is a partner of Bronto.  As the interview mentions, without a conscious eye towards the emerging shift in ISP deliverability patterns, specifically around user engagement and authentication, you'll find your program in trouble.

My take: As AOL puts it, "send relevant email to people that want to receive it!"  Are you doing everything you can from an infrastructure standpoint to ensure your email doesn't attract negative hits when being scanned and determined for acceptance by the ISPs?  And, once delivered, is the email being received well by your recipients?  If you can't categorically answer in the affirmative to both of those questions, you have some major homework to do or else risk your mail being deemed irrelevant and sent off to the bulk folder or bounced back.  Both cost money.

Razorfish (post) chimed in from a email content and strategy perspective.  Whitney Hutchinson, Group Director, Strategy and Account Services, sums it up nicely by hitting on these key points: engage your recipients with appropriate creatives, have a holistic marketing approach for the relationship management and take into account the "stacking effect" which is a result of the newly emergent communication technologies available to market to recipients through.  Email is now one of many.

My take: While email is now just one piece in a wide breadth of technologies (i.e., Twitter, Facebook, LinkedIn, Google Wave, SMS, etc.), it is still the most important and most trusted conduit of content that recipients most engage with consistently over time.  It has proven itself as a reliable protocol, even older than the internet itself (history)!  But, recipients have become increasingly savvy with its adoption so making your content stand out amongst the sea of email users get is at the vanguard of a successful marketing program.

ReturnPath's (post) President, George Bilbrey, still believes email is the "killer" app.  ReturnPath, while not an email sender or receiver, hosts a suite of services ranging from ESP to ISP products and plays a significant role with its liaison relationship between both senders and receivers.  He poignantly breaks down the exacting metrics ISPs use to measure user engagement (i.e., open rates, click rates, spam complaints, panel votes, etc.) along with the idea of domain reputation.  ReturnPath is a partner of Bronto.

My take: Authenticate, watch your complaints and make sure your domain reputation is healthy.  Yahoo! and AOL have already moved over to using domain reputation as a determining factor for deliverability - so to even ignore those two at this point with their combined estimated 142.4 million unique inboxes is perilous.  ISPs are fighting off spam and user interpreted unwanted email; don't let your mail take on these smarmy characteristics.

Cloudmark (post) occupies a very distinct space in the email industry as being a provider of anti-phishing, spamming, virus and other threat vector services to ISPs only.  Jamie Tomasello, Abuse Operations Manager, posits that authentication doesn't actually imply good mail but rather mail that is verified as coming from the declared source.  Interestingly, she adds that user engagement is not a net positive measurement - you can have negative user engagement as well depending on what the user does with your mail that is perceived by the ISPs and companies such as hers when it's not wanted.  Permission is tantamount.

My take: Bronto and many other responsible ESPs require permission based marketing as the only source of email addresses senders can email to.  Why?  Because it shows the true intent of the recipient to actually want your email; they've taken an action that is clear and deliberate to let the sender know they want the email.  By assuming recipient desire and emailing recipients who haven't given permission is casting a large net that will cause deliverability issues.  Think about it.  When was the last time you marked an email as spam or deleted it when you didn't knowingly sign up for it?  That's what I thought.

LashBack (post) rounded up the series as the final contributor with James O’Brien, Director of Marketing.  LashBack is dedicated to monitoring unsubscribe requests, suppression list abuse and whether an unsubscribe mechanism exists.  This directly ties into CAN-SPAM compliancy as well as being inline with email marketing best practices - when a recipient communicates to you they don't want your email anymore, you should honor this request without question or judgment.  Also, LashBack is putting together the first Email Compliance Summit which should be highly anticipated by senders and ESPs who want to stay on the cutting edge of unsubscribe policy.

My take: With the unsubscribe mechanism being one of several ways a recipient can directly and easily communicate intent with the email sender (others being complaints lodged with the respective ISP or direct email to the sender's role accounts), it is a very useful metric to measure the impact your mail is having on recipients.  Are you sending too much?  Too frequently?  Not targeted enough?  It's the job of the marketer to find that sweet spot where relevancy, recency and frequency are met with the recipients to not drive them to unsubscribe from your mail.

Definitions:

• CAN-SPAM: Controlling the Assault of Non-Solicited Pornography And Marketing Act of 2003 is the law the federal US government enacted to combat spam and other unwanted and malicious email.

• FTC: Federal Trade Commission is the arm of the federal government in charge of enforcing and maintaining the CAN-SPAM Act.

• ISP: Internet Service Provider of which the largest B2C ISPs are Yahoo!, Hotmail/Live, Gmail and AOL.  Email provider or receiver.

• ESP:  Email Service Provider such as Bronto.  Email senders.

• SPF: Sender Policy Framework is a type of email authentication that is path based and validates the sending entity.

• DKIM: DomainKeys Identified Mail is a type of email authentication that is encryption based, validates the content of a message hasn't been tampered with while in transit and can be tied back to a sending domain.

I hope that the Deliverability Forum and this wrap up have helped you with your deliverability programs.  Still have questions?  Comment below and let's keep the conversation going.

Chris Wheeler
Director of Deliverability at Bronto
@ChrisAWheeler

Note: This post was originally published on The Email Zoo on August 17, 2009.

-----

The White House just sent me spam.

As a guy in the email industry, I don't toss the S-word around lightly. However, that was my immediate reaction when an email from "David Axelrod, The White House" landed in my inbox last week.

Now, let me be clear. From a CAN-SPAM perspective, this was not spam. It was unsolicited, but not illegal. The CAN-SPAM Act of 2003 does not require mailers to prove opt-in; instead they must provide the ability to opt-out. Also, political emails are exempt (<--This may be debatable).

That being said, CAN-SPAM is the legal framework. It does not comment on "best practices" or even more basic, "doing what is right." Some people who received this email from "David Axelrod, The White House" clearly were not happy. I don't know the background on Major Garrett, but he seemed less then happy (or maybe he was just stirring the political pot). As Fox News says, "...you decide." 

Besides the fact that this clip is entertaining - no matter what side of the aisle you are on - it brings up some interesting questions:

• Did the White House rent a list or used forwarded email addresses?
• **How - if at all - will they address this issue? Send an apology email? Issue a formal press release? Will Obama talk about it?
• Are the email rules different for the government?
• Does anyone care that they are not following sound email marketing best practices (see comments below)?

**Since this report/video was released last week, the White House has responded: "White House will change e-mail rules" A quick critique of why this email failed from a design perspective:

 

1. From Name:. I don't know who "David Axelrod, The White House" is. I had to google him. Okay, now I "remember" - he's the Senior Advisor to President Obama. Who would take the time to look that up? Also, all I can see in my gmail inbox is "David Axelrod, The..." Verdict? Delete/Spam.

2. Subject Line: "Something worth forwarding" looks, smells, and tastes of spam. It might as well have said, "Send $1,000,000 to the Central Bank of Nigeria." Verdict? Delete/Spam.

3. Length/Copy: Lots of text, lots of scrolling. No call to action above the fold. Nothing to entice me to read beyond my initial scan. Verdict? Delete/Spam.

4. "Please don't reply": I wrote about this back in my Bronto days: http://blog.bronto.com/2008/11/21/donotreadthispost/. Blasting out an email to me and then telling me I can't reply is not engagement. Verdict? Delete/Spam.

----

Did you receive the same email in your inbox last week? Did you have similar thoughts? Did you read it or delete it? Did you mark it as spam or junk? Did you have the same reaction to the content as I did? How about the video clip?

DJ Waldow Director of Community, Blue Sky Factory

Not sure how to go about this today without embarrassing a company, but I feel the need to make a point today about unsubscribing, list management, and Can-Spam.

In the past few days, Kodak or kodakgallery.com started to send emails to one of my own personal spamtrap@ addressees that is not used for anything, but harvesting of email address off my personal website. This means obviously that I wouldn't use it to sign up for accounts, newsletters, etc using that email address. I just have it sitting out their on the Internet waiting to be scraped up by some spammer. 

So, Kodak sends me this email which basically says they have sent emails in the past or I have had some sort of interaction with this in the past and that I have an account with them which I do NOT nor do I see any other emails from them in my spamtrap database. This is the online version of that email

Now, what is upsetting is not the fact that they probably bought some list from a spammer or someone used that address to sign-up somewhere on their site and they didn't bother to confirm it really was me, but the fact that when I unsubscribed or ATTEMPTED to it didn't follow Can-Spam rules.

As some of you should already know, the final Can-Spam rules ensures that senders provide an easy, straightforward way for recipients to unsubscribe from unwanted email communications. Must only require unsubscribers to enter their email address and associated opt-out preferences – cannot ask unsubscribers to log in to access their accounts first. 

Guess what Kodak did?

At the bottom of their email there isn't anything there really to let me know how to remove this address of their list without hassle. No links to a preference site to see my supposed account or no way to one click unsubscribe myself. All that was there was some attorney's fine print about shipping charges, a way for me to update my email address to new one by logging into some non-existant account i don't have, help section which provides me no help, and a link to their privacy policy. 

Per Can-Spam folks, the FTC.gov’s web site states:

“(1) an e-mail recipient cannot be required to pay a fee, provide information other than his or her e-mail address and opt-out preferences, or take any steps other than sending a reply e-mail message or visiting a single Internet Web page to opt out of receiving future e-mail from a sender”

What does that mean?

 

• A link or Reply-To unsubscribe process must exist in every email sent and these unsubscribe processes must remain functional for at least 30 days following an email campaign
• The Reply-To send-an-email opt-out request must remove the address within 10 business days.
• If choosing a link to unsubscribe, the link must either immediately unsubscribe the user on click or, alternatively, lead only to a single page that contains a simple one-page one-click unsubscribe form. Remember this one as I will bring it up again.
• The unsubscribe form must consist of a simplified one-step form

Examples of unsubscribe forms that are not CAN-SPAM 2008 compliant:

• Clicking a link in an email that leads to a form that asks the recipient to verify their address, then emails instructions on how to ‘change’ or ‘update’ your subscription.
• Asking for a login or password before proceeding to remove the user.
• Advertising for your products or services on the unsubscribe form
• Using any kind of multiple step or multiple page process to complete the unsubscription

When I finally did some searching, I found in their privacy policy a way to create a choice for myself and remove this email address from it. They sent me an email to the address stating that it would take two (2) weeks to remove me from their lists it says. Two weeks? What about now? So what are my issues overall here?

 

• Understand your email address and database relations if you buy a list or ensure your message isn't speaking out of turn like this one which states I have an account with them. I don't have an account with them.
• They attempted to treat this message like a transactional one which doesn't require an opt-out per Can-Spam, but should have had one since I have no relationship with them or at best made it easier to make a choice. Ensure that in ALL classes of email like transactional or marketing that you have AN easy way to unsubscribe the target. Don't make them go through your privacy policy to find a way to make their choices be known. To me this is a marketing email as this point. Needs to be FULLY Can-Spam compliant.
• Remove the person immediately vs. the two (2) weeks they are promising me. In Can-Spam, you have ten (10) business days to remove the person. If recall correctly, two (2) weeks is fourteen (14) days? So since this is a marketing email to me, then they would be non Can-Spam compliant?
• Suppress such email accounts that have spamtrap in them. Talk to FreshAddress or your ESP to ensure they remove such blatant addresses from your database. We do here at Eloqua, but we also call you out on it :)
• Don't make the person have to put in an email address that will send them another email to be suppressed.

Like I said, my intent is not to embarrass them here, but to make all realize that many of you still don't have a good grasp on the rules, regulations, and also in many cases an understanding of what your relationship is with an email target.

-Dennis
Eloqua 

Don't Just Send, Deliver!

It's not the first time this has happened to me, but it still surprises me every time. I send an unsubscribe request by email as instructed in the email I received, and then it bounces back to me because of a spam filter. Here is the latest:

Delivery failed:
421 This server implements greylisting, please try again in 236 seconds

----- Original message -----
Message-Id: <1F669FC8-C55A-42C8-843E-E2548DF7CC61@xxxxxxxxxxx.com>
From: Joshua Baer
To: unsubscribe@walkersresearch.com
Content-Type: text/plain; charset=US-ASCII; format=flowed
Content-Transfer-Encoding: 7bit
Mime-Version: 1.0 (Apple Message framework v935.3)
Subject: Unsubscribe
Date: Sat, 18 Jul 2009 10:10:50 -0500
X-Mailer: Apple Mail (2.935.3)

Please unsubscribe me

----- End of message -----

It's an easy mistake to make, but one that email marketers should be aware of and prevent. You don't want to send your unsubscribe requests through a standard email system with a standard spam filter because they can catch legitimate unsubscribe requests and block them as spam.

Not only is this a bad customer experience, but it can get you busted by the FTC for violating CAN-SPAM. Your obligation is to honor unsubscribe requests. Getting caught in your spam filter is not a good enough excuse to avoid responsibility.

To make things worse, the very word "unsubscribe" is a common spam term in filters. SpamAssassin will increase the score of your email just for including it.

So what's a marketer supposed to do? This is one reason for sending unsubscribe requests to a web page or to an email address directly at your email server, rather than using the instinctive <unsubscribe@example.com>. Any address @example.com is likely to be going through the corporate spam filter. By using an address that goes directly to the mail server such as <listname-unsub@lists.example.com> you're probably going to bypass the default spam filters that would be applied.

How else do you handle this with your email?

Joshua Baer
Chief Evangelist, Datran Media
Founder & CEO, OtherInbox

You can follow @deliverability on Twitter here

From the Washington Post :

Alan Ralsky, a 64-year-old Michigan man that federal investigators say was among the world's top spam kingpins, pleaded guilty on Monday to running a multi-million dollar international stock fraud scam powered by junk e-mail.
Ralsky...and his son-in-law and chief financial officer Scott K. Bradley, 38, also of Michigan, pleaded guilty to conspiracy to commit wire fraud, money laundering and to violate the CAN-SPAM Act.

--snip--

Also pleading guilty in connection with the Ralsky case are:

John S. Bown, 45, of Fresno, Calif., the chief technology officer for the spamming operation. He faces up to 63 months in prison and a $75,000 fine.

William C. Neil, 46, of Fresno, who built and maintained a computer network used to transmit junk e-mails as part of the conspiracy. Neil is looking at as much as 37 months in prison and a $30,000 fine.

James E. Fite, a 36-year-old from Culver City, Calif., a contract spammer, who hired others to send spam. Fite is facing up to two years in prison and a $30,000 fine.

All five defendants are scheduled to be sentenced on Oct 29, 2009.

For further information, Laura Atkins has a post on her blog with links to other news sources.

Bottom line? CAN-SPAM, while rarely enforced, is still the law and if you knowingly and willfully break it, eventually you'll be caught. Let this portend, along with the other cases over the years, to anyone sending legitimate email that you don't ever want to end up in the same league (or court) as spammers so listen to your email staff and/or advisers when they lecture about the law!

The Email Senders and Providers Coalition (of which I am the co-chair of  the Technology committee) announced today that all members must support MD5 suppression lists by the end of the year. Most ESPs support this already, but there are still some laggards.

Download the full document at http://www.espcoalition.org/042309encryption.php

When the CAN-SPAM act was passed in 2004, it created a new requirement for email marketers to share suppression lists with other companies who do marketing on their behalf. Suppression lists are email addresses of consumers who have clicked on the unsubscribe link. Many companies just share these lists in plain text, which is very insecure and is frequently abused. Spammers steal these lists and send them more email!

Using MD5 to encrypt the email addresses before they are shared protects against spammers abusing them. This was one of the main reasons why I created UnsubCentral - to create a safe, central repository for securely exchanging suppression lists and complying with the CAN-SPAM act.

What does this mean for you?

If you are an Email Marketer

Talk to your email service provider about it! Make sure that you are securing your suppression lists with MD5 and that you are not exposing your users to extra risk and yourself to unnecessary liability. Just because your ESP supports MD5 does not mean that they use it by default. In fact, most ESP's require that you ask them to turn it on.

Talk to your affiliates about it! Make sure that any affiliates who send email on your behalf know that this issue is important to you and that they need to be prepared to accept MD5 suppression lists from you.

If you are an Affiliate Marketer

Make sure you are ready to accept MD5 suppression lists. Make sure your email software or email service provider accepts MD5 suppression lists for your mailings. If your mailing software doesn't support it, you might find it helpful to use this free desktop application from UnsubCentral that lets you compare to MD5 files on your hard drive.

If you are an Email Service Provider

Make sure you support MD5 suppression lists for one-time upload, permanent upload, and for download. This means that a list owner should be able to upload an MD5 encoded file of email addresses into your system as permanent unsubscribes or just to suppress against one single mailing. It means that a list owner should be able to easily download an MD5 encoded suppression list of all the unsubscribes their list has received through your system.

Educate your customers about why they should use MD5 and how it can help protect their subscribers from spam and themselves from legal liability and deliverability challenges. By using MD5 instead of plain text, you make it less likely that a suppression list will get abused and your sending reputation gets tarnished.

How does this affect deliverability?

Lashback tracks unsubscribe compliance by IP address and if your customer's suppression files end up in the wrong hands it will reflect poorly on your IP address reputation. Lashback's UnsubScore is one component of Return Path's Sender Score - so getting a blackmark from them could affect your deliverability at many ISPs.

AFP reports that two US senators declared war on spam on Thursday. Senator Olympia Snowe, a Republican from Maine, and Senator Bill Nelson, a Democrat from Florida, introduced legislation aimed at curbing unsolicited text messages on mobile devices.

The m-SPAM Act of 2009 is intended to crack down on what the senators described as a "growing nuisance for millions of wireless customers."

Apparently, they plan to link mobile phone numbers in the Do Not Call Registry to SMS spam as well. There isn't much more, but you can find it here.

Thanks to Josh Janicek from UnsubCentral for bringing this to my attention!

The Supreme Court of the United States has declined to hear the most recent, and final, appeal to have the originally imposed sentence of jail time and precedence over commercial spamming reinstated from the State of Virginia. In regards to email deliverability, this probably won't have any direct effect on spam volume since the federal CAN-SPAM law intervenes in the absence of any tougher state laws, but it does set the groundwork for framing new anti-spam laws around avoiding free speech protection.

The Washington Post posted an article discussing this in more detail. Also, you can view the SCOTUS docket for the case here.

We might be seeing a change in email or marketing rules here in the United States soon and I'm talking more restrictive ones.

Recently a customer of mine called me challenging whether or not their attorney was right in requiring their marketing department to include ADV in the subject line of their U.S. based emails.

Now, in my off the top head of knowledge I knew it was NOT a requirement to have ADV in the subject line based on Can-Spam, but I went ahead and emailed a few trusted colleagues the question just to see what their thoughts where on the use of it. In 2005, the FTC gave a report to congress on whether the use or requirement of ADV in the email subject line was a good or bad idea. In this report it was voted NOT to include it as a requirement. http://www.ftc.gov/opa/2005/06/adv1.shtm

When my colleagues responded, one of them added this, "Look into Can-Spam Sec 5(a)(5)(A)(i) and (B). "clear and conspicuous identification that the message is an advertisement or solicitation" is required unless there is prior affirmative consent. There is not specification on what constitutes "clear and conspicuous identification" which says there is not a standard format for doing this".

when another colleague responded he also reminded us of some changes in the FTC to come and that also in the report to Congress FTC Commissioner Leibowitz heavily suggested the use of ADV in the subject line. "In his dissenting statement, Commissioner Leibowitz said, “Requiring commercial e-mail to be labeled is not a panacea but, as the CAN-SPAM Act clearly recognizes, there is no single bullet theory for solving the spam problem. An ADV labeling requirement could be a modest tool to empower consumers to filter and sort commercial e-mails – to read them later, evaluate them individually, or delete them in bulk if they choose – and for that reason I respectfully dissent from the majority and urge Congress to consider a labeling requirement.” Again, the Commission voted to submit the 2005 report was 4-1 with Leibowitz dissenting.

So here's the interesting part in all this, on February 27, 2009, President Obama announced his intent to nominate Jon Leibowitz as Chairman of the Federal Trade Commission.

Just two weeks prior to the announcement, the new chairman also warned media companies and marketers that the FTC's new privacy protection guidelines could be their last chance to avoid regulation. "As the Report points out, targeted advertising can benefit consumers, subsidize free content, and promote a robust online market. But the concomitant online tracking and data collection, coupled with inadequate notice to consumers about what information is collected and how it is used, raise critical privacy concerns. How companies collect, combine, disclose and dispose of this data has serious ramifications for consumers." 

What does this mean for us in the email world here in the U.S.? Will we see stricter rules on email permissions, labeling, handling, and a step up in Can-Spam violation prosecutions if you don't do it right.

This also means then we could be seeing possible regulations on how behavioral marketing is performed. We could be seeing a fundamental shift in current U.S. law to one the MIGHT resemble how the European Union (EU) protects it's consumers with default opt-in choices on email, cookies, etc

How will react to changes from the FTC when it comes to permission or requirements on email, advertising and cookies? How does your company measure up to the self-regulations I just blogged about.

Folks, start looking at this stuff now. Starting auditing you companies data flows and permissions. I would suggest you start creating committees in your company that consists of decision makers from each department that's in charge of customer data. Everything from IT, sales, and marketing. These committees should be discussion at a minimum how you secure your data and handle consumer permissions. These groups should be the people who store the data for you, back-up the data, obtain the data, transfer the data, use the data, touch the data in any way (including third parties). They should meet weekly to discuss changes to your systems or process to understand the impact it will have on consumers and your company or even future self or required regulations.

I know a few email/privacy coalitions and alliances are watching this one carefully. Maybe your company should be as well.

-Dennis

Eloqua

Don't Just Send, Deliver!

Thanks to Jim Campbell of the Email Sender and Provider Coalition (ESPC) for the highlights.

5 Years After CAN-SPAM

Are we better off for having the CAN-SPAM law in effect? At best, marginally so. But no law could have stopped the real spam problem that inundates us today and promises to get ever-worse. 

By Larry Seltzer

eWeek

December 9, 2008 

URL: http://www.eweek.com/c/a/Security/5-Years-After-CANSPAM/  

The CAN-SPAM (Controlling the Assault of Non-Solicited Pornography and Marketing) Act of 2003 was controversial from the start. I think it's fair to say that nobody thought it would solve the spam problem, but many (such as this guy) thought it could help.

Has it solved the spam problem? No, of course not. Has it helped? Yes, marginally.

It has helped in two ways: First, there have been a few prosecutions under the law, basically of high-profile spammers who were also being prosecuted under other fraud-type offenses. CAN-SPAM is, in such cases, at least some leverage for prosecutors. But that's a very small benefit.

The other big thing that CAN-SPAM did was to set rules for businesses to follow in order to do mass-mailings. These were the most controversial part of CAN-SPAM because they were opt-out instead of opt-in. This is why critics said, and continue to say, CAN-SPAM "legalized spam." But it did also require that those businesses make opt-out provisions explicit in communications and to observe them, and this is an improvement over the past.

Many will say (and yes, I have seen your complaints) that some businesses don't follow through on these opt-out requests, but the real spam problem was never this sort of business. The spammers sending the overwhelming majority of the spam out there are not even pretending to comply with these laws.

So what can be done? I spoke with Greg Shapiro, CTO at Sendmail, the prototypical mail server company. He advocates for sender authentication and domain reputation checks. I've been on this bandwagon for years, although my recent realization that Webmail-based spam undermines it has dimmed my enthusiasm, and Shapiro acknowledges these problems. They need to be addressed through proper network etiquette, which means that ISPs and other mail providers, including Webmail providers, need to rigorously monitor outbound mail through filters and network pattern analysis to look for spamming behavior before it leaves their network.

These aren't perfect measures by any means, not that I have better suggestions. In fact, I assume that Webmail providers are doing what they can now to enforce "network etiquette" within the bounds of cost and other considerations. The real problem they have is that their CAPTCHA tests for account signup can be hacked and scripted so that attackers can create enough accounts to live within the bounds of network etiquette.

Years ago I even toyed with the idea of replacing SMTP altogether and dismissed the idea as impossible, no matter how great the benefit. Now it seems that the benefit wouldn't be so great after all. (Good thing they didn't listen to me ...)

So Shapiro and I talked about what might replace the CAPTCHA. One possibility is a variation on the old PGP (Pretty Good Privacy) scheme. PGP advocates are anxious to point out that their system provides solid enforcement of identity, so that you can prove that messages are from whom they purport to be from and that they have not been tampered with. But PGP is, almost by design, difficult to work with.

Imagine a new class of e-mail account, a verified account, sort of like EV-SSL, which provides enhanced verification of identity for SSL applicants and a visual feedback, in the form of the green address bar, for Web sites. In this case, before getting one of these accounts, a user would have to get a digital certificate from a trusted certificate authority. There might be many of these, as there are with SSL certificates, or there might be just one: There was some talk years ago about the 

U.S.post office getting into this business. Anyway, stick with me on this.

To get one of these new accounts, you have to present your certificate to the e-mail provider, who might also act as a go-between to obtain it for you. Every message is signed by some hash of that certificate, which therefore must either reside on your computer or be network-accessible in a secure way.

The result is a PGP-like system where individual senders can be uniquely identified. If enough users adopt this system, then recipients can start to use it for reliable whitelists and blacklists.

I know I've ignored a ton of technical stuff, but assume I've solved the technical problems. There remain huge problems of privacy, ease of use and so on. What identity information should the certificate authority require from me, an ordinary Internet user? It must be strong enough to ensure identity, yet not onerous enough to violate privacy or be too troublesome to bother with. If I lose my certificate, I'll need to reprove my identity to the CA in order to get my certificate reissued.

To make sense, does the system require that all users get no more than one certificate? There's a good argument for this, although it ends some aspects of anonymity, since no matter what address I use I can be identified, if not by name, then as a particular unique individual whose public key may be identical to one used by other e-mail addresses.

I could go on with the problems that such a system presents; as with replacing SMTP, even if you could make it happen technically it won't happen because people would rather put up with the problem than deal with the solution.

Five years after CAN-SPAM, the spam problem is, in many ways, much worse. CAN-SPAM is not at fault, nor could a "better law" have done any better. As long as there is money to be made by sending e-mails, rules won't get in the way of the spammers.

-Dennis

Eloqua

Don't Just Send, Deliver!

Now some of you just probably said, I thought Canada had one already!?

Canada has always had their privacy regulation "Personal Information Protection and Electronic Documents Act" (PIPEDA) which typically controlled how someone could use your email address, but they never have had a law that made it illegal to send spam in Canada.

Bill S-202 Introduced by Senator Yoine Goldstein would crack down on spam by prohibiting the sending of commercial emails to Canadians without their prior consent. The bill would also ban practices such as email harvesting, ban phishing attacks, and would require all commercial email messages to have a clear subject line, accurate contact information, an easy way to unsubscribe. It would also give Internet Service Providers (ISP) with the authority to block, filter and refuse spam messages - even deny service to those who have been convicted under the new law or thinks the messages that might be sent could be prohibited under the new law. Businesses who also knew they were being promoted by spam would also be liable unless they took action to stop the messages or notify authorities.

Exemptions would be made for charities, political parties, polling firms and businesses that have a pre-existing relationship with an email user. These groups would still be required to allow users to opt out of further message.

Penalties range from a fine of up to $500,000 (or two years in jail), to a fine of up to $1.5 million (or five years in jail) for repeated offences. Additional fines equal to the profits from a spamming operation could also be imposed. Those harmed by spam would also be empowered to seek damages from the perpetrators in court.

What's interesting about this was the that Facebook just used the U.S Can-Spam act to prosecute a Canadian spammer.

-Dennis

Eloqua

Don't Just Send, Deliver!

Spam doesn't just happen in email. Facebook just won a lawsuit against Adam Guerbuez for almost a billion dollars. It's unlikely that he can pay even a small portion of that, but we'll take every win against spammers that we can get.

Top Firms Fumble Opt Outs: Return Path

Nov 18, 2008 1:51 PM, By Ken Magill

More than 10 years since e-mail became a viable sales-and-marketing channel, many of the best-known marketers in the U.S. handle opt-outs poorly, according to a study released today by deliverability firm Return Path.

Granted, the study was of just 45 companies, but it was of 45 mostly household names, such as Wal-Mart, Staples, Sears, Disney, the New York Times, Kraft, Fisher Price, BMW, Expedia, Hertz and Marriott.

According to Return Path, 20% of those surveyed sent more e-mail after acknowledging the unsubscribe, which is not against the law, but does have the potential to tarnish the companies’ brands and their e-mail reputations. Consumers who have opted out are far more likely to report additional e-mail as spam, putting the marketer at greater risk of getting messages blocked by ISPs or diverted into would-be recipients’ spam folders.

Even worse, five of the firms continued sending e-mail more than 10 days after the unsubscribe request, a violation of the Can Spam Act.

Also, just two of the marketers offered subscribers the ability to change their preferences, such as the frequency of messages they receive. And just five companies offered an e-mail change-of-address option.

“There’s a huge opportunity in the opt-out process that I was surprised so few marketers are leveraging as fully as they could,” said Bonnie Malone, director of strategic services for Return Path. “And the fact that some marketers were mailing after that 10-day window was rather shocking. These are not small companies, these are well-known brands. And that’s not a new rule. It’s been around for several years now.”

The federal Can Spam Act requires marketers to honor e-mail opt-outs within 10 days or risk fines.

According to Malone, the experience a subscriber has when opting out of an e-mail program can be as important as the experience they had opting in. After all, she said, just because they don’t want any more e-mail doesn’t necessarily mean they’re no longer a customer.

“If that last impression is negative, you may lose them altogether as a customer,” she said. “Even if they don’t maintain a subscriber relationship with you, you want it to be as positive as possible from a branding experience, if nothing else. The end [of the e-mail relationship] is just as important as the beginning.”

Besides making the opt-out process pleasant, she said, marketers could offer an exit survey to spot shortcomings in their programs and fix them.

“Surveying can help you find out how valuable your e-mails are to them or if there are frequency issues,” she said.

Malone added that anecdotally, she has found that most marketers are keenly aware of their e-mail shortcomings but are struggling with IT issues.

“I’ve spoken to a number of marketers who voiced concern over their IT practices,” she said. “They know they have IT system challenges in their organizations and they’re admitting: ‘We know we have some shortcomings and we aren’t able to synchronize data as smoothly and as quickly as we’d like,’” she said.

“It’s something that many companies are still trying to figure out from a data perspective, especially when you have a multichannel company,” Malone added. “They may have been in the retail business for 100 years, but online is their newest channel, and they’re still going through growing pains there.”

http://directmag.com/email/news/1118-return-path-study/

-Dennis
Eloqua

Don't Just Send, Deliver!

I know we probably don't want to hear it, but I recently blogged over at OtherInbox that from a consumer's perspective it's probably better and safer to update their email address to a bogus one instead of unsubscribing if that option is available. Why? Because most software will overwrite the old email address with the new one when updating an email address, leaving no trace of the old email address.

When unsubscribing, most software will mark the user as unsubscribed and add their email address to a suppression list. Many times that suppression list will be shared with other companies in plain text. And then the suppression lists get abused and the consumers receive more spam. From the consumer's perspective, they are less likely to receive spam by changing their email address to a bogus one instead of unsubscribing.

It would stink for marketers if lots of consumers did this. It would hurt list hygiene and would cause us to get higher bounce rates.

I'm glad to see the ESPC and MAAWG pushing to adopt MD5 as a best practice for sharing suppression lists. I hope we'll see more affiliate networks and email service providers supporting MD5 in the near future.

In my various columns and blogs, taking care of the basics in your email marketing program is one of my recurring rants. At the top of my pet peeves list is usually the unsubscribe process - make it easy stupid.

I was reminded of this by a question submitted to the San Francisco Chronicle's Computing Q&A column earlier this week:

Q: Ever since I made a donation online to one of the presidential candidates, I've received daily e-mail from the campaign. I realize this will continue only for a couple months until the election, but it would be really nice not to see these messages. What's the best way to banish them?

Now you can chuckle at this most basic question that as industry participants seems almost unfathomable that someone can’t figure out how to unsubscribe from an email. But the fact is, if you spend any time looking at emails you will find that a very large number of companies actually make it hard for people to unsubscribe. They hide the link. They obfuscate the language. Or they are not yet compliant with the recent CAM-SPAM rules and require you to give up your first born in order to get off their lists.

Companies that still think that opt outs are a bad thing are either clueless, or perhaps have such bad email programs they feel they have to make it hard or their list will dwindle in size.

Now here is an example of unsubscribe language and link from a recent email I received:

You are receiving this e-mail because you have opted-in to receive information about new products, special offers, and newsletters from Company X. If you would prefer not to receive e-mails from Company X, please click here:

I want to opt-out. (hyperlinked)

I usually argue for a straight forward “Unsubscribe” link and encourage companies to include a reminder of how, why and when people were opted in as a reminder. But this example above is pretty clear and I’m guessing even the person who asked the question to the San Francisco Chronicle columnist could have figured out how to unsubscribe from this email.

Take another look at all of your emails. Are they idiot proof (not that subscribers are idiots) – but meaning is there almost no chance that someone couldn’t find or figure out how to unsubscribe from your emails? For a great test send your emails to your parents, grandparents or least tech savvy friends and see if they can quickly and easily unsubscribe.

Would love to hear from readers if you have any examples of horrendous or really good unsubscribe practices and language.

Make it easy to unsubscribe - or pay the price.

So, some of you law followers have heard that the Virginia Supreme Court on Friday overturned the conviction of a notorious AOL spammer, the first spamming defendant to be convicted of a felony, saying the states junk e-mail law is too broad and violates the First Amendment (freedom of speech) when it comes to non-commercial email.

Read the actual decision here: http://www.courts.state.va.us/opinions/opnscvwp/1062388.pdf

Instead of me giving you my opinion, you should check out a few that I think are good and reflect my thinking.

Declan McCullagh
http://news.cnet.com/8301-13578_3-10040522-38.html

John R. Levine
http://weblog.johnlevine.com/Email/jaynesreverse.html

-Dennis
Eloqua

Don't Just Send, Deliver!

Thanks to Justin Weiss, Associate Counsel, of the ESPC for the underlines.

URL: http://directmag.com/disciplines/email/0801-navigating-new-spam/

Though the Federal Trade Commission's clarifications to the Can Spam Act issued earlier this year generally were aimed at simplifying its requirements for everyone involved, the result hasn't been all that simple for direct marketers.

In fact, the rulings can be extremely tricky for DMers to understand, according to Trevor Hughes, executive director of the E-mail Sender and Provider Coalition.

“Just like radio marketing, just like TV marketing, just like direct mail marketing, the legal aspects associated with e-mail marketing are not for amateurs anymore,” he says.

For example, in concluding that people can't be required to pay a fee, provide information other than their e-mail address and opt-out preferences, or take any steps beyond sending a reply e-mail or visiting a single Web page to opt out of receiving future e-mails from a company, the FTC put many DMers' e-mail preference centers and retention efforts in violation of the law.

Marketers can no longer place a Web page in front of an opt-out page to make a retention offer. They're also prohibited from requiring a password to ensure that the address holder is actually making the request.

Moreover, DMers can't force people to give information, such as a reason for opting out.

Under the FTC's clarifications, marketers can make retention pitches to would-be unsubscribers, and they can offer people an opportunity to get less mail, but it all must be done on the same page as the one providing the opt-out function.

“It's got to be a single page, and that's not an ubiquitous practice in marketing,” Hughes says.

Meanwhile, the ruling on multiple advertiser mailings — by which a single sender can be designated as the one that must honor opt-outs — is also more complicated than it seems, but not as complicated as the issue the FTC addressed.

Prior to the FTC's revisions, a multiple-advertiser e-mailer such as an affiliate marketer that grouped several offers in a single e-mail would theoretically have to import suppression files of all the people who had opted out from each of the advertisers in the message. The affiliate marketer in turn — again theoretically — would also have to pass back a suppression file to the advertisers of all the people who'd opted out of its mailing.

“That's fine when it's just one advertiser in the message,” Hughes says. “But when it's two or three or four, it quickly becomes untenable. It wasn't a workable situation to pass a whole bunch of suppression files and get back a bunch of suppression files.”

To fix this problem, the FTC ruled multiple-advertiser mailers can designate a single sender as long as the sender meets the definition stipulated in Can Spam as one that “initiates a commercial electronic message in which it advertises or promotes its own goods, services or Internet Web site [and] is identified uniquely in the ‘from’ line of the message.”

Says Hughes: “Now a list owner can say to advertisers, ‘We take the hit on the opt out.’”

However, the “from” line must be from the designated sender, not any of the other advertisers in the mailing. Also, the opt-out mechanism must go back to the sender in the “from” line.

And because of Can Spam's definition of “sender,” the designated sender must also advertise in the message, even if it's via a list-rental agreement, says Hughes. “Otherwise [that firm] can never qualify as a sender.”

But he adds: “The Can Spam Act doesn't say what to advertise or that your advertisement must be the most prominent. It just says you have to advertise.”

So Hughes believes copy such as “This message is brought to you by Acme Marketing. To learn more about our company and the services we offer, please click here,” with a link back to the sender's site, would suffice.

In any case, he recommends consulting experts.

“While the Can Spam rules are relatively clear, they can become incredibly complicated depending on the context in which you're doing your marketing,” he says. “As a result, you've got to have somebody who knows what he's talking about look at your stuff.”

-Dennis
Eloqua

Don't just send, Deliver!

Justin Weiss of the ESPC and IAPP, one of the foremost experts on CAN-SPAM that I know, just published an article in the IAPP PrivacyTracker about the implications of the latest CAN-SPAM rulings by the FTC. If you're looking for a little more detail than the popular summary, this is the document for you.

Click here to download the PrivacyTracker CAN-SPAM article by Justin Weiss

Justin Weiss from the ESPC sent out a reminder that the CAN-SPAM Final Rule that was published in the federal register 45 days ago takes effect today.

His recommendations:

Do make sure that your unsubscribe mechanisms are compliant with the new “single-page” unsub or reply email standard, and that you are not asking consumers to provide anything other than the email address and unsubscribe preferences to accomplish the opt-out.

Also make sure that you’re scrutinizing forward-to-a-friend campaigns to account for the new guidance on this topic.

A recent post on the Email Marketing Roundtable list asked for clarification about how unsubscribe landing pages work under the updated CAN-SPAM regulations.

This led to an interesting thought. Is it permissible to put at CAPTCHA on an unsubscribe page?

CAPTCHA are usually a series of letters that the user is asked to type in to prove that they really a human and not a web spider. List owners are concerned about anti-spam and anti-phishing software that "follows links" and could accidentally unsubscribe a user. But there are some legitimate reasons why an automated unsubscribe would happen, such as if someone used Lashback's unsubscribe button. And a conservative reading of the FTC regulations would seem to prohibit CAPTCHA since it says that the only thing the user can be required to do is provide their email address.

Thoughts?

Scott Richter has agreed to pay $6 million dollars to MySpace in an arbitrated agreement. MySpace claims that Scott's company using phishing tactics to get into unsuspecting users' MySpace accounts and spam them. Scott says he is happy with the ruling and looking forward to putting this behind him.

Scott's company previously paid Microsoft $7 million dollars in a separate issue. MySpace was recently awarded $233 million dollars in a suit against Sanford Wallace.

I haven't received an email from the Washington Post in at least a year, although I did give them my email address a long time ago. Then out of no where, I get an email for their DC Scout Weddings. Now, I have no idea why they thought I would be interested in weddings in Washington, DC. I am already married and I don't live in DC. But even if I was about to get married in DC, I still would have considered this spam because I did not expect to get messages like this as a result of creating an account to read the news on the WashingtonPost.com website.

I was wondering why they sent me this and so I took a closer look. Then I noticed that they have an invalid From address of simply, "washingtonpost.com" - it is not a valid email address. So any replies to this message will bounce.

Finally, I scroll to the bottom and click on the unsubscribe link, which takes me to the following page which is not CAN-SPAM compliant under the recent FTC CAN-SPAM regulations because it requires a password in order to unsubscribe:

(cross-posted from the OtherInbox blog)