The following guidance has been developed to assist Schools and Centers in complying with the federal CAN SPAM law and to address privacy concerns arising from commercial, frequent, and/or discretionary e-mail communications. If you have comments or questions, please direct them to Penn’s Chief Privacy Officer at email@example.com. This guidance and any related information can be found on Penn’s Office of University Communications website (www.upenn.edu/pennnews) and Penn’s Privacy website (www.upenn.edu/privacy).
—Lori Doyle, Vice President of University Communications
E-Mail Communications Standards:
Guidance on Complying with Federal CAN SPAM Law
E-mail communications has evolved into a critical communication method for doing business in literally every industry. In higher education, we use e-mail communications to let students know about courses, dining services, cultural events, and emergencies—to name only a few. We communicate by e-mail with staff, faculty, alumni, contractors, research subjects and others on a variety of topics as well.
Certain types of e-mail communications have raised questions about privacy and system performance—particularly those that are commercial in nature. Recently, Congress enacted federal legislation (CAN SPAM) to address these concerns. This document highlights standards for certain e-mail communications distributed by your School or Center to be in compliance with the CAN SPAM law.
Scope and Applicability
In general, the standards below (“Standards”) must be applied when sending e-mail messages that are primarily commercial in nature.
It is also appropriate to consider applying the Standards in other situations that a recipient might wish to control, such as messages sent frequently and/or messages that are discretionary.
• “Commercial” Messages—Standards Required
The Standards below must be applied to e-mail communications whose primary purpose is “commercial.”1 This is the circumstance that directly ties to the federal legislation, CAN SPAM. While the term “commercial” is often difficult to apply in a higher education setting, the following guideposts can assist:
• Revenue generating versus routine academic, research, service, operational e-mail. While some e-mail communications at Penn advertise a commercial product or service, the vast majority do not. Certainly, the Standards need not be applied, nor are they appropriate, in e-mail messages to students from their professors regarding class assignments or other educational messages, or e-mail messages to staff from supervisors regarding new procedures impacting job functions or University operations. By contrast, the Standards would apply for example to e-mail messages advertising fee-based tickets to a sporting event or an arts and cultural event, provided those activities are revenue-generating. See below.
• Revenue-generating versus covering costs. The term “commercial” in general applies to promotions about revenue-generating activities, and not promotions to cover costs of an event. For example, if Penn is hosting a conference with a significant admissions fee beyond the actual costs associated with the conference, that will likely be considered “commercial” and trigger the Standards below. Similarly, the Standards apply if a clinical practice is promoting its fee-based services by e-mail. By contrast, if a group at Penn is holding a breakfast meeting and asks for a nominal contribution to cover the costs of the meal, that would not constitute a “commercial” activity. One way of analyzing this comparison is whether Penn would be competing against commercial, for-profit entities when offering the product, such as a professional conference.
• Fundraising versus commerce-related. E-mail messages promoting Penn fundraising activities generally need not meet the Standards, because fundraising is not directly about selling or promoting a commercial product or service.
• Communications that a recipient would be entitled to receive because of the relationship with the sender. The Standards exempt communications whose purpose is to facilitate, complete, or otherwise are related to a transaction that the recipient has previously agreed to. For example, they do not apply to messages to people who have purchased event tickets when the message is announcing that the event will take place in a different location. They also generally do not apply to messages to employees promoting employee-discounted programs.
• Hosted programs versus FYI e-mail messages from individuals not acting in a commercial capacity. The Standards below need not be applied in cases where an individual is sending isolated e-mail messages to friends or colleagues informing them of upcoming conferences and other events when the individual is not engaged in commerce.
(See Sample Scenarios below for more illustrations about what will and will not constitute “primarily commercial” communications).
• High Frequency and Discretionary Messages—Consider Applying Standards
As described, federal law does not regulate e-mail messages that are not “commercial.” However, Penn Schools and Centers should be mindful of privacy concerns that result from e-mail messages being sent with a relatively high degree of frequency.
It is therefore appropriate to consider applying the Standards to communications sent, for example, on a weekly or other relatively short periodic basis, even if not legally required. It is not appropriate to apply the Standards—in particular “opt-out choice”—to messages that are necessary to Penn’s operations.
Similarly, one should consider applying the Standards to messages that are not directly necessary to Penn’s academic, research, or service mission. While individuals’ viewpoints may vary regarding what is or is not directly necessary to Penn’s mission, Penn personnel should actively consider whether the message is sufficiently tangential, optional, voluntary, or discretionary to cause a recipient to wish to exercise some privacy controls, i.e., the right to opt-out of future such communications.
• Do not include false or misleading header, “from” line, subject heading or other information.
• Note or have it appear that the e-mail is an advertisement or a promotion. This can be as simple as having the email formatted in HTML, or noting in the footer that the consumer can unsubscribe from this advertisement or promotion, such as the “opt out” language provided below. Note that such identification is not necessary if the consumer has “opted in,” i.e., provided affirmative consent to receive such e-mail.
• Enable recipients and inform them of their ability to request the sender not to send any further commercial e-mail to them. Two available choices for the opt-out are through a return e-mail address or an internet-based unsubscribe.
• The opt-out (regardless of which opt-out choice is provided) must be operative for at least 30 days after the e-mail is sent and be clear and conspicuous. After 10 business days2 of receiving an opt-out, no further commercial e-mail may be sent to the recipient from the sender.
• The notice about the opportunity to opt-out should be clear about the scope of the opt-out. For example, a program-specific opt-out in a School should state clearly that the opt-out pertains only to communications from that program and/or that the recipient might still receive promotional communications from other programs in the School.
• Opt-out language should be based on the following:
We hope you enjoy receiving e-mail notices and updates from our office. If you do not wish to receive e-mail messages promoting commercial products or services from [office/program], please [reply to this e-mail and change the subject line to “Unsubscribe.”] [e-mail us at______].
Optional: Your choice to “opt-out”/“unsubscribe” pertains to e-mail communications sent by [office/program] only. To opt-out of communications by other [offices/programs], please contact those [offices/programs] directly.
• If you are communicating via an e-mail list purchased from another source, make sure that you coordinate with the list owner so that you are abiding by the terms of the opt-out. For example, it is not sufficient to state that a recipient can opt-out of communications from a certain School, and then have opt-outs sent to the list owner and not shared with the actual School for applying in future communications.
• Include a valid physical postal address of the sender. Consider including a telephone number or e-mail address for questions or comments as well. If you do, make sure that the person receiving such calls or messages is aware of the policies and procedures for processing opt-out requests and responding to questions.
If you have any questions or comments regarding these standards, please contact Lauren Steinfeld, Penn’s Chief Privacy Officer, at (215) 573-3348 or firstname.lastname@example.org.
1. An Academic Department sends an e-mail inviting students and faculty from Penn, Drexel and other area schools to attend a dinner with a prominent speaker. The department charges $25 for the dinner to cover meal and administrative costs. The Standards need not be applied because is it not revenue-generating.
2. A continuing education program charges $1,500 for a one day seminar. The fee more than covers costs and the program competes with outside organizations. The Standards apply because the program is revenue-generating.
3. The Computer Connection maintains a list of e-mail addresses of students who have purchased computers from a particular manufacturer. The Computer Connection wishes to send an e-mail message to those customers regarding changes to the terms of the warranty from that manufacturer. The Standards need not be applied because the recipient is entitled to that message based on the relationship with the sender.
4. The Athletics Program sends an e-mail advertising a football or basketball game, each of which are revenue-generating. The Standards apply because the communication is primarily commercial in nature.
5. A School Human Resources Department wishes to send an e-mail message to School staff regarding a change in terms for an employee benefit program. The Standards need not be applied because the message is not commercial and because the recipient is entitled to that message based on the relationship with the sender.
6. A faculty member at a School is also a member of a board of a professional association. She wishes to send an e-mail to certain close colleagues about a conference of interest provided by the professional association. The Standards need not apply, as the sender is not acting in a commercial capacity.
1 Some e-mail messages will have multiple purposes, some commercial and some not. In such cases, the Standards should be applied if a recipient reasonably interpreting the subject line or the body of the message would likely conclude that the primary purpose of the message is commercial. A significant factor includes the placement of content at the beginning of the message. Other factors include the proportion of the message dedicated to commercial content, and how colors, graphics, type size and style are used to highlight commercial content.
2 Note that the FTC is considering shortening the 10-day period to 3 business days.
Almanac, Vol. 52, No. 4, September 20, 2005