Legal Definitions - Who can sue under the CAN-SPAM Act?

The CAN-SPAM Act, which stands for the Controlling the Assault of Non-Solicited Pornography And Marketing Act, is a federal law that establishes rules for commercial email messages and gives recipients the right to stop unwanted emails. It also outlines who has the legal authority, known as "standing," to file a lawsuit when these rules are violated.

Generally, two main categories of entities can sue under the CAN-SPAM Act:

• Governmental Entities: This includes federal agencies and state legal officers. Specifically, the Federal Trade Commission (FTC), certain other federal agencies, and state attorneys general have the power to bring lawsuits to enforce the Act. These governmental bodies act on behalf of the public interest to curb illegal spamming activities.
• Internet Access Service (IAS) Providers: These are companies that provide the fundamental infrastructure and services allowing people to connect to and use the internet. For an IAS provider to sue, they must demonstrate that they have been "adversely affected" by a violation of the Act. Courts interpret this requirement strictly, often looking for evidence of direct harm such as increased operational costs, network congestion, or damage to their systems that is uniquely suffered by an internet access provider. Merely providing email accounts or hosting services might not be enough if the provider relies heavily on third parties for the underlying technical infrastructure and direct internet connectivity. Courts typically look for providers who own and operate significant technical or hardware components of the internet access service themselves.

Here are some examples illustrating who can sue under the CAN-SPAM Act:

• Example 1 (Governmental Entity): A marketing company based in one state sends millions of commercial emails with deceptive subject lines and no clear opt-out mechanism to consumers across several other states. The Attorney General of one of the affected states discovers this widespread violation impacting its residents.

  How it illustrates the term: In this scenario, the State Attorney General has the standing to sue the marketing company. They are a governmental entity empowered by the CAN-SPAM Act to protect the public interest and enforce the law against deceptive and unsolicited commercial email practices affecting their state's citizens.

• Example 2 (Qualifying Internet Access Service Provider): A large telecommunications company, which owns and operates extensive fiber optic networks and data centers to provide internet and email services to millions of residential and business customers, experiences a sustained and massive influx of spam originating from a specific spamming operation. This spam overloads their email servers, consumes significant network bandwidth, and forces the company to invest millions in new filtering technology and hire additional staff to manage the increased load and protect their customers.

  How it illustrates the term: This telecommunications company would likely have standing as an Internet Access Service Provider. They directly provide internet access and email services, own the core infrastructure, and are demonstrably "adversely affected" by the spam through substantial operational costs and network strain that are unique to their role in providing internet access. They can show a direct, causal link between the spam and their specific harm.

• Example 3 (Entity Unlikely to Qualify as an Internet Access Service Provider): An individual runs a popular online community forum and, as a convenience, offers free email accounts to forum members. However, this individual uses a large, third-party cloud service provider (like Google Workspace or Microsoft 365) for the actual email hosting, server management, and internet connectivity. Forum members complain about receiving a high volume of spam in these email accounts.

  How it illustrates the term: The individual running the forum would likely not have standing to sue under the CAN-SPAM Act as an "internet access service" provider. While they offer email accounts, they do not own or control the underlying technical infrastructure, servers, or direct internet access services. They rely entirely on a third-party provider for these core functions. Courts typically interpret "internet access service" very strictly, requiring a more direct and substantial role in providing the actual internet access, often involving a significant hardware or technical component, and a unique adverse effect beyond the general nuisance of spam.