Inbox Inspector Worksheet
Cyber Law & Digital Ethics FTC Compliance Guide
Inbox Inspector: CAN-SPAM Act of 2003
Mastering the legal boundaries of commercial email & digital consumer protection
Name:
Date:
Period: Score: /35
Statute Overview: Enacted by Congress in 2003, the CAN-SPAM Act (Controlling the Assault of Non-Solicited Pornography And Marketing Act) establishes US national standards for commercial email. Enforced primarily by the Federal Trade Commission (FTC), it gives consumers the right to stop unwanted commercial emails and imposes strict civil penalties on deceptive senders.
1 Part 1: The 7 Core Pillars of Compliance (14 pts)
Match rules to violations & identify statutory metrics
Statutory Rule Codes:
[A] No false or misleading header info
[B] No deceptive subject lines
[C] Identify message as an ad
[D] Include valid physical postal address
[E] Provide clear, conspicuous opt-out
[F] Promptly honor opt-outs
[G] Monitor third parties working for you
1. Subject reads "Order Invoice #441", but body promotes diet pills.
Rule:
2. A company hires an agency that spams; company claims zero fault.
Rule:
3. Footer lists a website link only; no street or registered PO box.
Rule:
4. "From:" reads "support@irs.gov", but routing leads to offshore spam.
Rule:
5. To opt out, users must pay a $1 fee or complete a 15-min survey.
Rule:
Processing Window:
Within how many business days must a sender honor an opt-out request?
(FTC timeline)
Opt-Out Longevity:
For how many days post-transmission must the opt-out mechanism stay live?
(Minimum active days)
2 Part 2: Message Classification & Legal Scope (8 pts)
Determine if full CAN-SPAM commercial rules apply
CAN-SPAM distinguishes between Commercial Messages (primary purpose: advertise or promote a product/service) and Transactional/Relationship Messages (facilitate an existing transaction or account notice). Transactional emails cannot use false routing, but are exempt from opt-out and physical address rules.
Email A: An online bank alerts a customer: "Your password was successfully updated today. If you did not make this change, contact security immediately."
Commercial Transactional
Legal Justification:
Email B: A software company emails a free trial user: "Your trial ends in 3 days! Upgrade now to Pro with coupon code SAVE40 for 40% off your annual plan."
Commercial Transactional
Legal Justification:
Email C: An ecommerce seller sends a shipping notice: "Package #9012 has shipped via FedEx. Delivery scheduled for Thursday by 5:00 PM."
Commercial Transactional
Legal Justification:
CAN-SPAM Act of 2003 (15 U.S.C. §§ 7701-7713) • Student Compliance Manual Page 1 of 2
Audit Lab: Inbox Investigations & Legal Penalties
FTC Case Officer Simulation
3 Part 3: Compliance Audit — Spot the Violations (10 pts)
Identify 2 distinct CAN-SPAM violations in each email
From: Federal Security Desk promo@deals-direct-now.biz
To: recipient@email.com
Subject: CRITICAL ACCOUNT WARNING: Action Required Immediately
Congratulations Valued Customer!
You have been pre-approved for an exclusive luxury cruise getaway to the Bahamas. Claim your 75% voucher before midnight!
To unsubscribe, please write to our PO Box or log into your account settings.
Violations Identified (Email 1):
Violation 1 & Statutory Rule Violated:
Violation 2 & Statutory Rule Violated:
From: Velocity Athletic Shoes promotions@velocitygear.com
To: recipient@email.com
Subject: Flash Sale: 40% Off Running Shoes This Weekend!
Gear Up For Fall Marathons!
Check out our brand new Velocity Pro Sprint line. Premium cushioning at unbeatable prices. Free shipping on orders over $50.
Velocity Shoes Inc. • www.velocitygear.com
Unsubscribe: Click here and pay a $0.99 database removal fee.
Violations Identified (Email 2):
Violation 1 & Statutory Rule Violated:
Violation 2 & Statutory Rule Violated:
4 Part 4: Legal Liability & Enforcement Scenario (8 pts)
Affiliate marketing & statutory penalties
Case Brief: Pulse Supplements LLC hired an independent affiliate agency, LeadBlast, to promote its energy drink. To maximize commissions, LeadBlast scraped email addresses from public web pages and sent 45,000 deceptive promotional emails claiming the drink cures chronic fatigue. Pulse claimed: "We didn't write or send the emails, so we have no legal liability under CAN-SPAM."
1. Is Pulse Supplements LLC shielded from legal responsibility because an agency sent the emails? Explain the FTC's legal standard.
2. Financial Penalties & Lawsuits: What is the maximum civil penalty per illegal email, and can individual recipients personally sue the spammer under federal CAN-SPAM?
5 Part 5: Policy Debate — Opt-Out vs. Opt-In (3 pts)
US Policy vs. European GDPR
The US CAN-SPAM Act uses an "Opt-Out" framework (businesses can email anyone without prior consent until they unsubscribe), whereas Europe's GDPR enforces an "Opt-In" model (prior affirmative consent required). What is one major advantage and one disadvantage of the US approach for consumers and commerce?
Federal Trade Commission Act & CAN-SPAM Enforcement Manual • Classroom Resource Page 2 of 2
