CAN-SPAM Act of 2003

This incredible gift to the sales profession, we ruined it.

And we needed blacklists and spam filters and legislation here in the US, the Can Spam Act.

We did it with video.

We're doing it with everything.

So technically, by the simple blanket, it is spam, right? But it's not spam in the nature is it illegal? No.

It's not against the CAN-SPAM Act, but it is spam in that you are sending people emails that are unwanted ultimately.

Spam by intent, not by legal definition.

Yeah.

And we mentioned the CAN-SPAM compliance.

The CAN-SPAM Act, it does not have an apostrophe T in it.

A lot of people forget that.

And so you have the ability to send emails, especially in the USA, for USA-owned businesses.

Do not scrape a list of 10,000 emails and blast them with AI garbage.

Good outreach, even if AI structured the first draft, still requires intense human targeting, genuine personalization based on the recipient's actual business, and strict legal compliance with global anti-spam laws like CAN-SPAM or GDPR.

Which are no joke.

You must have a legitimate business reason for contacting the person, and you must provide a clear, functional opt out mechanism.

If a business lists their email on their website or Google My Business page, yes, that information is publicly visible, but that doesn't automatically give you permission to add them to your marketing list and start sending promotional emails.

Under laws like GDPR in Europe or CAN-SPAM in the United States, you generally need explicit permission before sending marketing emails.

This is true even if you found the email address in a public directory.

The business put their email there for customers to contact them about their services, not to receive your marketing emails.

Just because you can collect someone's contact information doesn't give you permission to add them to marketing email lists without their consent.

The data collection is one thing, but how you use that data is governed by completely different laws, like GDPR and CAN-SPAM.

And here's probably the biggest source of confusion.

People assume that because a tool is available and because the information is technically public, there are no legal considerations at all.

They were coming off their AOL and their dial-up modems.

And so we were working with industry, and the Direct Marketing Association was like, "Hey, these spammers are just filling up our inboxes, and we can't do legitimate marketing anymore." So we started working, and we're like, this was before the Can Spam Act, which made spamming illegal, but we started looking and we're like, "Okay, while spamming itself isn't illegal, but a lot of the things that spam is doing is illegal," 'cause there'd be wire fraud or counterfeit goods that would be selling.

So we started working with them and putting together dossiers on some of these criminals.

Being a headquarters unit, you would see what was being investigated in the field, and we would be working with the field offices and working with industry subject matter experts out there to really understand what the threat is and get intelligence, because the industry people were really on the front end or the tip of the spear of the cyber threat.

What's fascinating is how quickly that slang transitioned into technical jargon.

By the late nineties, email service providers were calling it junk mail, and the legal world started to catch up with anti-spam legislation like the CAN-SPAM Act in two thousand and three.

The word had moved from comedy to policy.

The early spammers used simple tactics, mass mailing lists, open relays, and even stolen email addresses to flood inboxes.

This raises an important question about data ethics.

It's not just about adhering to the FTC's Can Spam Act guidelines, which legally mandate clear consent in marketing communications.

It's about fundamentally re-architecting how trust is built.

The industry is moving toward decentralized zero-party data models.