CAN-SPAM Rulemaking (16 CFR Part 316)

This article covers the regulatory machinery the FTC built under its CAN-SPAM Act rulemaking authority — the codified definitions and tests in 16 CFR Part 316 — that sits beneath the plain-English seven rules in CAN-SPAM (US). It does not restate those rules; read that article first. Here the focus is how the FTC defined the terms that decide whether a message is covered, who the liable "sender" is, and how the edge cases (multi-advertiser mail, forward-to-a-friend, PO-box addresses) resolve.

Provenance and the three rulemakings

The Act (signed 16 December 2003, effective 1 January 2004) gave the FTC discretionary authority to define terms and issue implementing rules. The definitions arrived across several Federal Register actions:

Action	Date	What it did
ANPR	11 Mar 2004	Advance notice; solicited comment on "primary purpose" and the definitions
Primary Purpose Final Rule	19 Jan 2005 (70 FR 3110)	Codified the §316.3 primary-purpose criteria
NPRM (this article's source)	12 May 2005 (70 FR 25426)	Proposed §316.2 definitions of person, sender, valid physical postal address; proposed shortening opt-out to 3 business days; proposed fee prohibition; analysed forward-to-a-friend
Final Rule	21 May 2008 (73 FR 29654)	Adopted the definitions and fee prohibition; declined to shorten the 10-business-day opt-out

Note on the title. The source document is styled "Definitions, Implementation, and Reporting Requirements." The "reporting" refers to reports the Act directed the FTC to make to Congress (e.g. the Do-Not-E-mail registry study) — not any recordkeeping or reporting burden on senders. The NPRM states the rule imposes no new Paperwork-Reduction-Act collection on industry.

The codified rule structure

The current, adopted numbering of 16 CFR Part 316 differs from the NPRM's proposal because the proposed 3-business-day opt-out section was dropped:

Section	Subject
§ 316.1	Scope — implements 15 U.S.C. 7701–7713
§ 316.2	Definitions
§ 316.3	Primary purpose
§ 316.4	Warning labels for sexually oriented material
§ 316.5	Prohibition on opt-out fees / extraneous requirements
§ 316.6	Severability

§316.3 — the "primary purpose" tests (codified)

Coverage turns on primary purpose (see the plain summary in CAN-SPAM). The Rule reduces the statutory concept to mechanical tests. A message's primary purpose is deemed commercial if:

(1) Exclusively commercial content — the message consists only of the commercial advertisement or promotion of a commercial product or service.

(2) Commercial + transactional/relationship content (dual-purpose) — commercial if either:

• (i) a recipient reasonably interpreting the subject line would likely conclude the message contains a commercial advertisement or promotion; or
• (ii) the transactional or relationship content does not appear in whole or in substantial part at the beginning of the body of the message.

(3) Commercial + "other" content (content that is neither transactional/relationship nor commercial) — commercial if either:

• (i) the same subject-line test; or
• (ii) a recipient reasonably interpreting the body would likely conclude the primary purpose is commercial. Illustrative factors: placement of the commercial content at the beginning of the body; the proportion of the message that is commercial; and use of color, graphics, type size, and style to highlight the commercial content.

The message's primary purpose is transactional or relationship only if it consists exclusively of the five categories of transactional/relationship content (§316.3(c)):

1. Facilitate, complete, or confirm a commercial transaction the recipient previously agreed to enter into;
2. Provide warranty, recall, safety, or security information about a product/service the recipient used or purchased;
3. With respect to an ongoing subscription, membership, account, loan, or comparable relationship: notify of a change in terms/features; a change in the recipient's standing/status; or provide, at regular periodic intervals, account-balance information or other type of account statement;
4. Provide information directly related to an employment relationship or related benefit plan in which the recipient is currently involved, participating, or enrolled;
5. Deliver goods or services, including product updates or upgrades, that the recipient is entitled to receive under the terms of a previously agreed transaction.

The FTC's interpretive posture (from the NPRM analysis) is that these categories are read narrowly to prevent erosion of the opt-out protection:

• The "commercial transaction" in category 1 does not require an exchange of consideration — registering for a free service (e.g. event invitations) can be a commercial transaction the recipient agreed to. But an initial, unsolicited message that merely proposes a transaction is commercial, not transactional.
• A standard of reasonableness governs how many confirmation messages one transaction supports; hourly "confirmations" containing promotions would read as commercial.
• Category 3 account statements: billing/account statements sent at regular intervals qualify even if they contain some advertising — but if the advertising content overwhelms the transactional content, the dual-purpose §316.3(a)(2) test reclassifies it as commercial.
• A message sent by a third party with the employer's permission promoting the third party's own goods to employees is not transactional under category 4 — only genuine employment-relationship information qualifies.
• The FTC declined repeated industry requests to expand the categories (e.g. a blanket exemption for association-to-member mail, or business-to-business mail): the statutory test to modify the categories — that modification is necessary to accommodate changes in e-mail technology or practices — was not met. Association-to-member and B2B mail therefore get no special exemption; each message is classified on its content by the primary-purpose test.

§316.2 — the "sender" definition and multi-sender designation

The Act defines sender as a person who initiates a commercial message and whose product/service/website is advertised or promoted in it. Both "initiate" and "sender" can apply to more than one person in a single message.

The Rule (§316.2(m)) resolves the multi-advertiser problem. When more than one person's products or services are advertised or promoted in a single message, each such person is a "sender" — except that, if only one such person both meets the Act's "sender" definition and meets one or more of the following, only that person is the "sender" of that message:

1. The person controls the content of the message;
2. The person determines the electronic mail addresses to which the message is sent; or
3. The person is identified in the "From" line as the sender.

This lets multiple advertisers designate a single sender for compliance (functioning opt-out, valid physical address, opt-out honoring) instead of each having to provide separate suppression, addresses, and opt-outs — which commenters argued would force divulging customer lists to competitors and confuse recipients with multiple opt-out mechanisms and postal addresses.

Worked example (from the NPRM): sellers X, Y, Z are all advertised in one message and designate X as the single sender. This works only if among the three, only X controls the content, controls the recipient list, or appears in the "From" line — X may use third parties for the criteria it doesn't satisfy, but neither Y nor Z may satisfy any of them. (Compare the plain summary in CAN-SPAM.)

The "From" line and "materially false" headers. CAN-SPAM's ban on materially false/misleading header information (15 U.S.C. 7704(a)(1)) interlocks here: a "From" line need not carry the initiator's full legal name, but it must give the recipient enough information to know who is sending — a "From" of "John Doe" for a message from XYZ Company would not accurately identify the initiator. A "From" line is "materially" false when it impairs the ability of a recipient or an ISP/law-enforcement agency to identify, locate, or respond to the initiator.

§316.2 — "valid physical postal address"

The Rule (§316.2(p)) codifies what satisfies the Act's physical-address requirement (15 U.S.C. 7704(a)(5)(A)(iii)). A valid physical postal address is any of:

1. The sender's current street address;
2. A Post Office box the sender has registered with the U.S. Postal Service; or
3. A private mailbox the sender has registered with a commercial mail receiving agency (CMRA) established under USPS regulations.

The FTC accepted PO boxes and CMRA mailboxes because both have a physical presence recognized by the USPS, and because USPS registration verifies the renter's street address at signup — so allowing them "creates no greater risk that a sender will falsify information to thwart the purposes of the Act" than a street address does (a rogue sender can lie about a street address just as easily).

The 10-business-day opt-out — proposed 3, kept 10

The Act (15 U.S.C. 7704(a)(4)) bars initiating a commercial message more than 10 business days after receiving the recipient's opt-out. The Act let the FTC modify this period.

The NPRM proposed shortening it to 3 business days, reasoning that near-instantaneous opt-out processing is technically feasible (some senders and Go Daddy reported processing "within seconds") and that a shorter window better serves the Act's privacy purpose. Commenters split three ways (keep 10 / shorten / lengthen to 15–30 days for complex multi-party arrangements).

In the 2008 Final Rule the FTC declined to shorten the period — the 10-business-day requirement stands. For operational purposes this KB's numbers reflect the adopted rule: honor opt-outs within 10 business days, keep the mechanism working for at least 30 days after the message is sent. (See CAN-SPAM › Opt-out mechanics.)

§316.5 — no fees, no extraneous requirements to opt out

Neither a sender nor any person acting on its behalf may require the recipient to:

• pay any fee;
• provide any information other than the recipient's email address and opt-out preferences; or
• take any step other than sending a reply email message or visiting a single Internet web page,

as a condition of accepting or honoring an opt-out request. Requiring a recipient to visit multiple web pages, log in, or disclose personal data to unsubscribe is prohibited — it would "frustrate recipients' ability to exercise their opt-out rights." A preference menu is allowed only if it includes a global "opt out of all" option.

Forward-to-a-friend — resolved through "initiate," "procure," "routine conveyance"

CAN-SPAM has no explicit forward-to-a-friend provision; liability is derived from three interlocking definitions the Rule incorporates:

• initiate = to originate or transmit a message, or to procure its origination/transmission — but not actions constituting routine conveyance.
• procure = intentionally to pay or provide other consideration to, or induce, another person to initiate a message on one's behalf.
• routine conveyance = transmission, routing, relaying, handling, or storing through an automatic technical process for which another person has identified the recipients or provided the recipient addresses.

Applying these:

Scenario	Result
A recipient forwards a marketer's non-compliant commercial message to others	The forwarder can face liability as an initiator of that message
Seller offers consideration for forwarding — money, coupons, discounts, awards, sweepstakes entries, referral payments	Seller has procured the forwarding → seller is a sender/initiator and must ensure the forwarded message carries the opt-out and physical address and honors opt-outs
Seller merely provides a "click-here-to-forward" / "Tell-A-Friend" mechanism, no consideration	This is routine conveyance (the forwarder identifies the recipients); the mechanism itself is de minimis persuasion and does not "induce" → no CAN-SPAM liability for the seller

"Induce" is broader than "pay" (to lead on / influence by persuasion), but simply offering a forwarding button is not inducement. (The UK reaches a comparable result through the concept of "instigation" — see UK PECR.)

Aggravated violations (trebled exposure)

Committing an aggravated violation alongside a §7704(a) violation can subject a defendant to treble damages in an enforcement action. The Act (15 U.S.C. 7704(b)) lists four aggravated practices:

1. Automated harvesting of email addresses (address-scraping software);
2. Dictionary attacks — automated generation of addresses by combining names/letters/numbers;
3. Automated creation of multiple email accounts to send;
4. Relay or retransmission through unauthorized access to a protected computer (open relays/proxies, botnets).

The FTC declined to add new aggravated violations by rule. Commenters proposed adding hashbusting (random words inserted to defeat filters), manual address harvesting, inaccurate WHOIS, and the sale of open-proxy lists — the FTC found these were either already prohibited by other parts of the Act (e.g. hashbusting in a subject line already violates the deceptive-subject-heading ban; relaying via a virus already violates §7704(a)(1)(C)) or lacked evidence of substantially contributing to unlawful commercial email. It noted it would still challenge such practices under Section 5 of the FTC Act where appropriate.

Enforcement relief — no state-of-mind burden

Where a CAN-SPAM provision (or the Rule) contains a state-of-mind element, that element is waived when a state, the FTC, the FCC, or a state official/agency seeks a cease-and-desist order or an injunction to enforce compliance. Enforcers need not allege or prove the defendant's state of mind to obtain injunctive relief. (This codified the NPRM's proposed §316.4(b), which survived into the Act's enforcement framework.)

Practical takeaways for an ESP

• The primary-purpose tests are content tests, applied per message — an ESP cannot classify an account or a stream as "transactional" wholesale; dual-purpose mail with promotions above the fold is commercial and needs the full CAN-SPAM treatment.
• For multi-advertiser / affiliate / co-branded sends, make sure exactly one designated sender satisfies the control/addresses/From-line test and appears in the "From" line, or every advertiser becomes a sender with full obligations. See Customer Domain Authentication and Suppression-List Architecture for the operational side.
• Forward-to-a-friend features are safe as plain routine-conveyance mechanisms; the moment the platform or customer offers an incentive for forwarding, the originating brand becomes a sender of the forwarded mail.
• Any of the four aggravated practices in a customer's acquisition history is both a legal red flag and a deliverability catastrophe — tie this to Customer Vetting, Consent Methods, and Spam-Trap Incident Response.