Illinois Wesleyan: IT Services: Bulk e-mail guidelines

Guidelines for University Bulk e-mailings

In addition to the provisions of the University's IT Usage Policy, federal and many state legislatures have enacted laws regulating the preparation, sending, and handling of unsolicited commercial e-mail. All individuals who prepare and/or send unsolicited commercial e-mail using University resources, including those using the services of third parties, and third parties themselves, must comply with both federal and state regulations.

This web page describes the provisions of the federal "CAN-SPAM Act of 2003" and includes tips on how to comply. This information is NOT legal advice. To obtain legal advice, please contact the university attorney.

What is unsolicited commercial e-mail?

For the purposes of anti-spam legislation, an unsolicited commercial e-mail is an electronic message with the primary purpose being the advertising or promotion of a product or service. Transactional or relationship messages, such as Illinois Wesleyan Announcements, and messages requested or consented to by the recipient, are not considered commercial e-mail.

Examples of unsolicited commercial e-mail included those pertaining to fund raising, or other advertising, where the recipient has not opted-in, or otherwise asked previously to receive such a message.

Who at Illinois Wesleyan is covered by anti-spam regulations?

Anyone who prepares or sends unsolicited commercial e-mail using University resources, including those using third party services, are covered by at least the Federal CAN-SPAM Act, and by the state laws of the recipient location.

What are the penalties for not complying with anti-spam regulations?

The law provides for statutory damages of $250 per message up to $2 million. A willful or knowing violation of the law may result in triple statutory damages. In addition, Internet service providers may file civil actions for recovery of damages.

My department needs to send unsolicited commercial e-mail. What do we need to do?

You should consider consulting these links for information regarding relevant regulations.

Summary of federal laws
Summary of state laws

In addition, if you intend to use a third party to send e-mail from an @iwu.edu address, you must contact the office of Information Technology. Any third party company sending e-mail on the University's behalf must have it's mail servers listed in the spf record of the University's DNS. If these servers are not listed in our DNS, they will likely be bounced as SPAM.

Please refer to the table below to determine if your message is in compliance with regulations for sending unsolicited commercial e-mail messages.

Requirement	Compliant examples	Non-compliant examples
Message must contain clear and conspicuous notice that it is an advertisement or solicitation.	"Notice: This message is a solicitation for...." "Announcing a new service."	"A message for you." "For your interest"
Message must contain honest (non-deceptive) subject line	"Solicitation" "Advertisement" "New service offering"	"Open this message now." "Urgent message... You must act now."
Display a clear and conspicuous notice of the opportunity to decline to receive future e-mail from the sender.	"Notice: You may choose not to receive future e-mail from us. To do so, please follow this procedure..."	A message that does not contain the required notice.
Contains a valid physical postal address of the sender.	The physical address for the sender of this messages "123 Anystreet, Hometown, USA" "Sender's postal address: 123 Anystreet, Hometown, USA"	Missing or invalid postal address of the sender.
Return e-mail addresses must be valid and functioning for not less than 30 days after transmission of the original message, or... a functioning opt in/opt out choice must be available.	The "from" field contains an active e-mail address that has assigned responsibility for reading. Or... A functioning opt in/opt out function is made available.	An inactive or fake e-mail address like donotreply@iwu.edu or... Lack of assigned responsibility to read the e-mail box, or... Lack of functioning opt in/out function or... Failure of the return e-mail address to accept mail within the required 30 days after the message was sent.
Sender must not send additional e-mail to a recipient who has objected to receipt of additional e-mail.	Once an objection is filed, no further e-mail is sent to the recipient.	Failure to honor recipient's objection
Senders must no release e-mail address to third parties after an objection has been filed by a recipient.	E-mail addresses proposed for release to third parties, are scrubbed of addresses for which an objection has been filed.	Failure to "scrub" e-mail list of individuals who have filed objections.
Senders may not send e-mail to an address that has been "harvested", "lifted", or discovered by automated means, or otherwise obtained from a web site without the consent of the e-mail address owner.	Senders do no send e-mail to addresses obtained by the indicated methods.	Sending messages to e-mail addresses obtained by the indicated methods.

Substantial portions of these guidelines were adapted from the Northeastern University July 2004 Summary of Federal and State anti-spam regulations