As you've probably heard, last week the CAN-SPAM law suits started. And the first marketer in trouble wasn't a prototypical "bad guy", it was home improvement expert BobVila.com.

If it can happen to Bob, it can happen to anyone.

How are marketers preparing? We contacted six well-known companies to ask how they'd adjusted their tactics; including an eretailer with thousands of affiliates, a national amusement park, a top online consumer research firm, and a large high tech company.

Each said proudly, "Yes, we're putting street addresses and a working opt-out link on everything we send now." But, when we asked about the tougher stuff, such as setting up brand-wide suppression files and requiring affiliates and sales reps to use them for every single mailing... everyone said, "Oh. No. We're not there yet."

So, next we turned to the vendors in the email space -- folks who could lose their whole business if they don't meet legal requirements.

All agreed that while adding a postal address and working opt-out link is a good start, it's only a start. You also need to take three immediate actions:

#1. If you aren't already using a suppression file to keep track of email addresses that have opted off your list, you'd better start one, especially if you still rent other people's lists to send messages or you rent your list to others.

#2. Remodel your privacy policy to cover sharing opt-out names with potential advertisers or list brokers who want to keep those names out of any shared promotions.

#3. If you send promotional blasts to your list on behalf of a third party, make sure their ad creatives meet the law, the opt-out link works, and require that your service bureau get a copy of that advertiser's own house opt-out file to use as a suppression list prior to the mailing.

Here are some more specific notes about how three email-related vendors are handling CAN-SPAM to inspire your own in-house efforts:

NetCreations

Opt-in email list broker NetCreations overhauled several programs, did company-wide education and created a new do-not-email service for clients, CEO Michael Mayor told us.

"We had to change our privacy policy, because we had said we would never give out email addresses to a third party," Mayor says. "CAN-SPAM changes all that, because we have to share our unsubs with the advertisers. It's a logistical issue of how do you do that? How do you receive their do-not-email file for suppression before a campaign goes out?"

Mayor says the company "went into overdrive" to build what he called the DNE Manager, which lets marketers who rent NetCreations-administered lists to submit a do-not-email list in a secure electronic transfer. NetCreations then takes out the matches.

Here's how NetCreations' privacy policy deals with sharing suppression-file addresses with other companies:

"If you choose to remove yourself from our lists, we will also forward your email address to the specific marketer whose offer you received from us prompting your unsubscribe request so that it can include your email address on its do-not-email list too." (See URL to full policy in the Resource List.)

NetCreations also saw unsubscribes go up in February, which here is a good thing. "Unsubscribe activity has increased because people feel that it's a credible unsubscribe," Mayor says.

NetCreations also combined opt-out links -- one for the advertiser, one for the list owner -- in the email message. "We combined the links and have a process where you can get off both with one click. It's part of the DNE platform. List owners have to spell out exactly what clicking the link is going to do. It's another hurdle to overcome. It all comes down to being incredibly clear."

Response Media

This list brokerage and database-management company tightened up suppression-file requirements and opt-out management, among other changes, says Executive Vice President Josh Perlstein.

"We make sure that on every list we are requiring clients to send us their suppression lists," he says. "Most of them are starting to have them, and if they tell us, 'Well, we don't have one,' we tell them, 'Then you need to have one.' If they don't have one, we help them build it, and we forward it to each list manager on the campaigns.

"We also created a release form for people with no opt-out list. We say, if there isn't one, 'We assume you're signing off that there are no opt-outs.' In over 90 percent of cases, they do have their own suppression lists."

The law outlaws deceptive "from" lines, but "(it) has been so loosely written that nobody really know if it should be the list owner or the advertiser's name in the 'from' line," Perlstein says.

"We play some things by ear. .. We go by whatever will best bring in the highest response. With a list owner who carries a lot of value -- who doesn't send out emails too frequently -- we'll use the list owner, but if the list doesn't carry a lot of recognition, we'll go with the brand name. Either is right in terms of CAN-SPAM, but it's whatever brings out the best response" unless the list owner specifies which name to use.

washingtonpost.com

washingtonpost.com contracts with advertisers to send messages to its opt-in third-party-ads house list, which is separate from lists for company announcements and for Washington Post editorial newsletters, which don't accept outside ads.

Tim Ruder, VP/marketing for Washington Post-Newsweek Interactive, says the company first got its sales people and clients on board to understand what the law required. Then, it began policing ad content.

"Our focus is ensuring (the ads) are in compliance," Ruder says. "Our email practices have always been opt-in and the highest best practice. The only substantial change is ensuring the physical addresses of our clients focus are in the emails."

Each commercial washingtonpost.com message includes an email opt-out and a link to the company's privacy policy, which Ruder says were standard issue before CAN-SPAM.

Useful links related to this story:

BobVila.com CAN-SPAM Lawsuit:
http://www.technewsworld.com/perl/story/33074.html

NetCreations Privacy Policy:
This is a good example of a privacy policy written in plain language, not legal jargon:
http://netcreations.com/ntcr_priv.htm

Response Media:
http://www.responsemedia.com

washingtonpost.com:
http://www.washingtonpost.com

Federal Government Info on potential CAN-SPAM regulations:
http://www.regulations.gov/freddocs/04-05500.htm

Past MarketingSherpa article outlining CAN-SPAM problem areas:
http://www.marketingsherpa.com/sample.cfm?contentID=257