Can-Spam put to the test

Late last year, the U.S. Court of Appeals for the Fourth Circuit limited the reach of both state and federal spam laws to e-mails that contain "material" falsity or deception. And last week, a federal district court dismissed a Can-Spam claim on the basis that the plaintiff, James Gordon--who was not a traditional ISP--did not suffer the type of injury envisioned by the law, and thus lacked legal standing to sue.

The court also signaled its intention to award attorney's fees. While the decision will likely have minimal effect on claims brought by traditional ISPs, it is sure to take the sails out of the cottage industry built around spam litigation.

Since its inception, Can-Spam has had a mixed reception. Still, it is tough to deny that it has spawned an entire cottage industry of litigation built around filing spam lawsuits. Antispam activist Mark Mumma presents one such example, as does spam fighter Robert Braver, and Gordon himself, the plaintiff in the ill-fated Virtumundo lawsuit decided last week.

These individuals pursued Can-Spam cases even though they did not run ISP-based businesses, or they only ran small, token ones. (Their spam lawsuits received more of their resources than their ISP businesses.) Many set up Web pages to showcase their lawsuits and encouraged others to pursue similar claims.

Can-Spam provides for enforcement by governmental entities such as the Federal Trade Commission, and in certain situations, states attorney general. The only private entities that can bring lawsuits under Can-Spam are providers of "Internet access services" which are "adversely affected." This was a critical issue in the Virtumundo case.

The plaintiffs (Gordon and his entity) alleged they received 13,800 improper e-mails and sought damages in excess of $20 million. The defendants challenged whether Gordon fell within the statutory definition of an Internet access service (IAS), and in particular, whether Gordon was "adversely affected."

While the court did not squarely resolve the IAS-definition issue (alluding that traditional ISPs were proper private plaintiffs under Can-Spam), it held that the plaintiffs were not "adversely affected" under Can-Spam and could not maintain the lawsuit. The court noted that the plaintiffs used a third party--Verizon--for Internet access, and pointed out that the plaintiffs did not suffer harm "beyond the consumer-specific burden of sorting through an in-box full of spam." The plaintiffs did not suffer harm "related to bandwidth, hardware, Internet connectivity, network integrity, overhead costs, fees, staffing or equipment costs."

After disposing of the Can-Spam claims based on lack of harm specific to Gordon, the court also dismissed the Washington state law claims. The court largely tracked the Mummagraphics ruling from last year which held that Can-Spam was intended to cover material deceptions in e-mails.

The plaintiffs argued that the "from lines" were misleading because they often referenced "a topic area or type of advertisement" (rather than a specific person) and because the domain names used by the defendants did not contain (identically) the sender's name. The court showed little tolerance for Gordon's hyper-technical arguments.

For Gordon, this decision will likely be devastating. The decision notes both that he is a party to 10 other cases in western Washington alone, and that he makes a living from spam lawsuit settlements. The viability of all of these cases is immediately called into question. More importantly, the court delivered Gordon a severe blow in the form of attorney's fees. Without a doubt, this aspect of the decision will force similar plaintiffs to think twice before filing suit.

Another question is how and whether this will affect claims brought by real ISPs. Smaller spammers may now argue that there was no "significant" harm felt by their e-mails alone. In most cases, this argument will not prevail--the ISPs retain experts who testify as to the incremental costs caused by each additional piece of spam. Of course, only time will tell.