CAN-SPAM Compliance Audit

Description

2004E X C L U S I V E R E P O R TCAN-SPAM B2C COMPLIANCE AUDITDuring the first six months of 2004, Arial Software secretly audited the federal CAN-SPAM Act compliance of 1,057 organizations with a prominent online presence including many Fortune 500 companies and various popular Internet firms. This was accomplished by subscribing to the email newsletters and subscription offerings of each organization using a unique email address, then tracking their actual email practices and noting various privacy and CAN-SPAM compliance attributes.The results of this study are revealed in this report, which represents the mostcomprehensive business-to-consumer (B2C) CAN-SPAM compliance audit ever conducted.a r i a lS O F T W A R E©2004 Arial Software. All Rights Reserved. For more information please contact us at [e-mail] or via phone at 307.587.13382004 B2C CAN-SPAM Compliance Audit2004 B2C CAN-SPAM Compliance AuditBy Arial Software (www.ArialSoftware.com)During the first six months of 2004, Arial Software secretly audited the federal CAN-SPAM Act compliance of 1,057 organizations with a prominent online presence including many Fortune 500 companies and various popular Internet firms. This was accomplished by subscribing to the email newsletters and subscription offerings of each organization using a unique email address, then tracking their actual email practices and noting various privacy and CAN-SPAM compliance attributes.The results of this ...

Informations

• Publié par: Phuwyug
• Nombre de lectures: 545
• Langue: English

Extrait

E X C L U S I V E R E P O R T

CAN-SPAM
B2C
COMPLIANCE
AUDIT

During
the
first
six
months
of
2004,
Arial
Software
secretly
audited
the
federal
CAN-SPAM
Act
compliance
of
1,057
organizations
with
a
prominent
online
presence
including
many
Fortune
500
companies
and
various
popular
Internet
firms.
This
was
accomplished
by
subscribing
to
the
email
newsletters
and
subscription
offerings
of
each
organization
using
a
unique
email
address,
then
tracking
their
actual
email
practices
and
noting
various
privacy
and
CAN-SPAM
compliance
attributes. The
results
of
this
study
are
revealed
in
this
report
,which
represents
the
most comprehensive
business-to-consumer
(B2C)
CAN-SPAM
compliance
audit
ever
conducted.

a r i a l S O F T W A R E ©2004
Arial
Software
.All
Rights
Reserved
.For
more
information
please
contact
us
at
[e-mail]
or
via
phone
at
307.587.1338

2004 B2C CAN-SPAM Compliance Audit

2004 B2C CAN-SPAM Compliance Audit By
Arial
Software
(www.ArialSoftware.com) During
the
first
six
months
of
2004
,Arial
Software
secretly
audited
the
federal
CAN-SPAM
Act
compliance
of
1,057
organizations
with
a
prominent
online
presence
including
many
Fortune
500
companies
and
various
popular
Internet
firms.
This
was
accomplished
by
subscribing
to
the
email
newsletters
and
subscription
offerings
of
each
organization
using
a
unique
email
address,
then
tracking
their
actual
email
practices
and
noting
various
privacy
and
CAN-SPAM
compliance
attributes. The
results
of
this
study
are
revealed
in
this
report,
which
represents
the
most
comprehensive
business-to-consumer
(B2C)
CAN-SPAM
compliance
audit
ever
conducted. Note:
This
report
may
be
posted
,quoted
or
distributed
as
long
as
credit
is
given
to
Arial
Software
and
a
hyperlink
is
placed
to
www.ArialSoftware.com.
(See
the
reprint
guidelines
at
the
end
of
this
report
for
more
details.) 66% of Online Businesses Violate CAN-SPAM, But Few Send Spam The
most
relevant
finding
of
this
study
is
that
only
one-third
of
online
businesses
send
emails
that
are
CAN-SPAM
compliant.
The
other
two-thirds
remain
in
violation
of
CAN- SPAM,
primarily
by
failing
to
include
unsubscribe
links
(51%)
and
failing
to
clearly
identify
the
source
of
the
email
(45%)
.Note
that
there
is
overlap
in
these
two
figures
as
many
organizations
fail
on
both
counts. This
level
of
noncompliance
seems
surprising,
given
the
widespread
publicity
of
CAN- SPAM
and
the
ease
of
becoming
compliant
.Some
possible
reasons
for
this
widespread
noncompliance
are
discussed
in
this
report. On
the
positive
side
,even
though
these
businesses
are
not
in
compliance
with
CAN-SPAM
, they
almost
never
engage
in
spamming.
Only
three
organizations
out
of
1,057
engaged
in
email
behavior
that
most
people
would
consider
spamming
(high
volume
commercial
emails
and
an
unsubscribe
function
that
didn’t
work)
,meaning
that
99.6%
of
online
organizations
don’t
spam
,even
when
they
aren’t
CAN-SPAM
compliant. Or
,put
another
way,
compliance
with
CAN-SPAM
has
very
little
correlation
with
whether
or
not
an
organization
actually
sends
spam
emails,
a
conclusion
that
will
no
doubt
support
the
critics
of
CAN-SPAM.

Figure 1. CAN-SPAM Compliant Email Only one-third of online businesses send emails that are CAN- SPAM compliant. The other two-thirds remain in violation of CAN- SPAM, primarily by failing to include unsubscribe links and failing to clearly identify the source of the email.

a r i a l S O F T W A R E ©2004
Arial
Software
.All
Rights
Reserved
.For
more
information
please
contact
us
at
[e-mail]
or
via
phone
at
307.587.1338.

2

Figure 2. Working Unsubscribe Links A surprising find: only 49% of the surveyed emails contained a working unsubscribed link.

2004 B2C CAN-SPAM Compliance Audit

1.8% Ignore Unsubscribe Requests In
the
first
edition
of
this
white
paper
,we
listed
twelve
firms
whose
email
unsubscribe
processes
did
not
work
properly
.Many
of
these
firms
received
an
early
version
of
this
report
and
,after
finding
themselves
listed
here
,sent
Arial
Software
strongly-worded
letters
insisting
that
their
unsubscribe
process
worked
perfectly
,and
they
should
not
be
listed
here.
While
our
research
was
meticulously
documented
,and
we
are
confident
that
our
original
list
of
twelve
firms
was
accurate
,due
to
the
surprising
popularity
of
this
report
and
as
a
professional
courtesy
to
those
twelve
firms,
we’ve
decided
to
remove
their
names
from
this
report. Each
of
these
firms
apparently
stands
in
violation
of
the
federal
CAN-SPAM
Act
for
failing
to
unsubscribe
users
in
a
timely
manner
.It
is
possible
their
unsubscribe
processing
scripts
may
have
been
malfunctioning
during
our
request,
but
even
a
temporary
failure
of
processing
unsubscribe
requests
is
considered
a
CAN-SPAM
violation. 51% Don t Offer An Unsubscribe Link ’ The
organizations
just
mentioned
certainly
have
some
improvements
to
make
with
their
unsubscribe
handling
,but
they
are
well
ahead
of
the
51%
we
found
to
have
no
working
unsubscribe
link
at
all,
which
is
also
a
blatant
CAN-SPAM
violation. You
read
it
right:
over
half
of
all
email
newsletters,
even
from
reputable
companies,
have
no
obvious
unsubscribe
mechanism
in
place!
This
is
a
serious
violation
of
CAN-SPAM,
and
it
indicates
that
compliance
with
CAN-SPAM,
even
among
ethical
emailers,
is
shockingly
low
.In
other
words,
these
51%
didn’t
spam
us,
but
they
also
didn’t
allow
us
to
unsubscribe.
As
a
result,
we’re
still
receiving
email
from
hundreds
of
organizations
with
no
way
to
unsubscribe. To
most
people,
that
would
eventually
be
considered
spam.
Although
the
email
volume
from
these
organizations
was
extremely
low
(less
than
0.1
emails
per
month
on
average)
, and
initial
permission
was
given
to
the
organization
via
the
sign-up
process
,the
fact
that
these
organizations
would
apparently
continue
sending
emails
ad
nauseum
to
end
users
likely
indicates
that,
sooner
or
later,
somebody
is
going
to
scream
,“Spam!” Only 7% Use Double-Confirmed Subscription Processing Another
shocking
finding
from
the
study
is
that
only
seven
percent
of
organizations
use
double-confirm
subscription
processes
.A
double-confirm
means
that
when
you
post
your
email
address
to
the
subscription
form
,they
send
you
an
email
asking
you
to
confirm
your
subscription
by
clicking
a
specially
coded
link
in
the
email
message.
Once
you
click
the
link
, you’re
subscribed
.This
prevents
people
from
signing
up
email
addresses
they
don’t
control. A
jaw-dropping
93%
of
the
organizations
audited
here
don’t
use
double-confirm
subscription
processes!
That’s
not
necessarily
a
CAN-SPAM
violation
,but
it’s
an
invitation
to
being
hacked
by
a
malicious
script
and,
ultimately
,committing
mass
violations
of
CAN-SPAM
.In
other
words
,anyone
with
some
free
time
on
their
hands
could
write
an
email
posting
robot
that
could
post
the
entire
dictionary
of
names
and
domain
combinations
to
the
email
lists
of
these
companies.
The
next
time
these
companies
send
out
an
email
newsletter
, they
will
be
spamming.

a r i a l S O F T W A R E ©2004
Arial
Software.
All
Rights
Reserved
.For
more
information
please
contact
us
at
[e-mail]
or
via
phone
at
307.587.1338.

3