Browse: Departments   Dates   Agencies  

FEDERAL COMMUNICATIONS COMMISSION

Federal Communications Commission

CFR Citation: 47 CFR Part 64

Docket ID: [CG Docket Nos. 04-53 and 02-278; FCC 04-194]

NOTICE: RULES

ACTION: Common carrier services:

DOCUMENT ACTION: Final rule.

SUBJECT CATEGORY: Rules and Regulations Implementing the Controlling the Assault of Non-Solicited Pornography and Marketing Act of 2003; Rules and Regulations Implementing the Telephone Consumer Protection Act of 1991

DATES: Effective October 18, 2004 except Sec. 64.3100(a)(4), (d), (e) and (f) of the Commission's rules, which contain information collection requirements under the Paperwork Reduction Act (PRA) that are not effective until approved by Office of Management and Budget (OMB). Written comments by the public on the new and modified information collections are due November 15, 2004. The Commission will publish a document in the Federal Register announcing the effective date for these rules.

DOCUMENT SUMMARY: In this document, the Commission adopts rules to implement those aspects of the Controlling the Assault of the NonSolicited Pornography and Marketing Act of 2003 (CAN SPAM Act) directed to the Federal Communications Commission (FCC or Commission). Also, in this document, the Commission adopts a general prohibition on sending commercial messages to any address referencing an Internet domain name associated with wireless subscriber messaging services. Furthermore, the Commission clarifies the delineation between these new rules implementing the CAN SPAM Act and our existing rules concerning messages sent to wireless telephone numbers under the Telephone Consumer Protection Act (TCPA).

SUMMARY: Controlling the Assault of Non-Solicited Pornography and Marketing Act of 2003 and Telephone Consumer Protection Act of 1991; implementation—; Consumer protection from unwanted mobile service commercial messages,

SUPPLEMENTAL INFORMATION

This Order contains new or modified information collection requirements subject to the PRA of 1995, Public Law 10413. These will be submitted to the Office of Management and Budget (OMB) for review under section 3507(d) of the PRA. OMB, the general public, and other Federal agencies are invited to comment on the new or modified information collection requirements contained in this proceeding. The Order addresses issues arising from Rules and Regulations Implementing the Controlling the Assault of NonSolicited Pornography and Marketing Act of 2003; Rules and Regulations Implementing the Telephone Consumer Protection Act of 1991 Notice of Proposed Rulemaking (NPRM), CG Docket Nos. 02278 and 0453; FCC 0452. Copies of any subsequently filed documents in this matter will be available for public inspection and copying during regular business hours at the FCC Reference Information Center, Portals II, 445 12th Street, SW., Room CYA257, Washington, DC 20554. The complete text of this decision may be purchased from the Commission's duplicating contractor, Best Copy and Printing, Inc. (BCPI), Portals II, 445 12th Street, SW., Room CYB402, Washington, DC 20554. Customers may contact BCPI, Inc. at their web site: http://www.bcpiweb.com or call 18003783160. To request materials in accessible formats for people with disabilities (Braille, large print, electronic files, audio format), send an email to fcc504@fcc.gov or call the Consumer & Governmental Affairs Bureau at (202) 4180530 (voice) or (202) 4180432 (TTY). This Order can also be downloaded in Word and Portable Document Format (PDF) at: http://www.fcc.gov/cgb/pol .

Paperwork Reduction Act of 1995 Analysis

This Order contains new or modified information collection requirements. The Commission, as part of its continuing effort to reduce paperwork burdens, invites the general public to comment on the information collection requirements contained in the Order as required by the Paperwork Reduction Act (PRA) of 1995, Public Law 10413. Public and agency comments are due November 15, 2004. In addition, the Commission notes that pursuant to the Small Business Paperwork Relief Act of 2002, Public Law 107198, see 44 U.S.C. 3506(c)(4), we previously sought specific comment on how the commission might ``further reduce the information collection burden for small business concerns with fewer than 25 employees.'' In the present document we have assessed the effects of adopting these rules, and find that there may be an administrative burden on businesses with fewer than 25 employees. However, since this action is consistent with our mandate from Congress under the Controlling the Assault of NonSolicited Pornography and Marketing Act of 2003, we believe small businesses will also benefit from this requirement in that they too will receive less unwanted commercial messages. In addition, the rules allow entities and persons a variety of ways to obtain express prior authorization to send such messages, which should substantially alleviate any burdens imposed on all businesses, including those with fewer than 25 employees. Synopsis

In this Order, the Commission adopts rules to implement those aspects of the Controlling the Assault of NonSolicited Pornography and Marketing Act of 2003 (CAN SPAM Act) directed to the Federal Communications Commission (FCC or Commission). The CAN SPAM Act directs the Commission to issue regulations to protect consumers from ``unwanted mobile service commercial messages.'' Thus, we adopt a general prohibition on sending commercial messages to any address referencing an Internet domain name associated with wireless subscriber messaging services. To assist the senders of such messages in identifying those subscribers, we require that commercial mobile radio service (CMRS) providers submit those domain names to the Commission, for inclusion in a list that will be made publicly available. We also clarify the delineation between these new rules implementing the CAN SPAM Act, and our existing rules concerning messages sent to wireless telephone numbers under the Telephone Consumer Protection Act (TCPA). Discussion

A. Mobile Service Commercial Message (MSCM)

Section 14 (b)(1) of the CAN SPAM Act requires that the Commission adopt rules to provide subscribers with the ability to avoid receiving a ``mobile service commercial message'' unless the subscriber has expressly authorized such messages beforehand. An MSCM is defined in the CAN SPAM Act as a ``commercial electronic mail message that is transmitted directly to a wireless device that is utilized by a subscriber of commercial mobile service'' as defined in 47 U.S.C. 332(d) ``in connection with that service.'' The CAN SPAM Act defines an electronic mail message as a message having a unique electronic mail address that includes ``a reference to an Internet domain.''

In the CAN SPAM NPRM, we asked whether it was appropriate to find that only commercial electronic mail messages transmitted directly to a wireless device used by a CMRS subscriber would fall within the definition of MSCMs under the CAN SPAM Act. We sought comment on whether the statutory language would be satisfied by our proposed interpretation that an MSCM is a message transmitted to an electronic mail address provided by a CMRS provider for delivery to the addressee subscriber's wireless device. We asked for comment on whether an MSCM must be limited to a message sent to a wireless device used by a subscriber of CMRS ``in connection with that service.''

Few commenters directly addressed the scope of MSCMs, aside from references to forwarding, SMS, and similar technology discussed below. We agree with Dobson that the definition of MSCM should be limited to messages sent to addresses referencing domain names assigned by each CMRS carrier for mobile service message (MSM) service. This is consistent with the intent of the CAN SPAM Act in that section 14 of the CAN SPAM Act governs only those messages that are mobile services messages. We therefore adopt a definition of MSCM that is limited to a message transmitted to an electronic mail address provided by a CMRS provider for delivery to the subscriber's wireless device. Our definition of MSCM only applies to
[[Page 55767]]
those CMRS mail addresses designated by carriers specifically for mobile service messaging. For example, if a wireless carrier offered general electronic mail service not designed specifically for mobile devices, such service would not be covered by section 14 of the CAN SPAM Act. Forwarded messages. We sought comment on our tentative conclusion that messages ``forwarded'' by a subscriber to his or her own wireless device are not covered under section 14 of the CAN SPAM Act. Commenters agree with the Commission that section 14 of the CAN SPAM Act is not meant to cover forwarding in general. The Consumers Union warned the Commission not to allow the exclusion of ``forwarded'' messages to become a loophole for marketers who encourage others to forward messages to their friends and associates. We agree that the rules should exclude those messages forwarded by the subscriber's actions to forward messages to his or her own wireless device. However, a person who receives consideration or inducement to forward a commercial message to a wireless device other than his or her own device would be subject to the rules implementing section 14 of the CAN SPAM Act. In addition, VeriSign notes that some technologies being explored would allow for differentiation of forwarded mail from other mail. We do not rule out revisiting this issue in the future if such technology becomes widely available.

SMS Messages: In the NPRM, we asked for comment on whether the definition of an MSCM should include messages using different technologies, including Internettophone SMS. We noted that the TCPA and Commission's rules that specifically prohibit using automatic telephone dialing systems to call wireless numbers already apply to any type of call, including both voice and text calls. We also noted in the NPRM that the legislative history of The CAN SPAM Act suggests section 14, in conjunction with the TCPA, was intended to address wireless text messaging. We proposed that Internettophone SMS calls, which include addresses that reference Internet domains, should be considered MSCMs and should be addressed under section 14 of the CAN SPAM Act.

Commenters in general agree with our proposal that Internetto phone SMS calls should be covered by section 14 of the CAN SPAM Act. National Association of Attorneys General (NAAG) and other commenters argue that the FCC should also address all SMS, whether Internetto phone or phonetophone SMS service. Several commenters raise the issue of whether MSCMs should include all types of message services, including those transmitting images, audio messages and those using short codes.

We conclude that the definition of MSCM under the CAN SPAM Act includes any commercial electronic mail message as long as the address to which it is sent or transmitted includes a reference to the Internet and is for a wireless device as discussed above. This holds true regardless of the format of the message, such as audio messages. We believe this interpretation best applies the statutory language to the evolving technology for delivering such messages. Therefore, messages sent using Internettophone SMS technology are among messages covered by section 14 of the CAN SPAM Act when they include an Internet reference in the address to which the message is sent or delivered.

We find, however, that the CAN SPAM Act does not apply to those technologies that use other types of addresses or numbers to send or deliver messages to wireless devices. For example, as discussed above, we agree with those commenters who maintain that phonetophone SMS is not captured by section 14 of the CAN SPAM Act because such messages do not have references to Internet domains. However, we note that while section 14 of the CAN SPAM Act is limited in scope to messages sent or transmitted to addresses that have references to Internet domains, the TCPA provides separate protections for calls made to wireless telephone numbers (without such references). And, as we explained in the NPRM and a previous Commission Order, the TCPA prohibition on using automatic telephone dialing systems to make calls to wireless phone numbers applies to text messages (e.g., phonetophone SMS), as well as voice calls. We clarify here that this prohibition applies to all autodialed calls made to wireless numbers, including audio and visual services, regardless of the format of the message.

B. Avoiding Unwanted MSCMs

As a preliminary matter, we noted in the NPRM that one possible interpretation of section 14 of the CAN SPAM Act is that it was intended to prohibit senders of commercial electronic mail from sending any MSCMs unless they first obtain express authorization from the recipient. This reading would allow a subscriber to avoid all MSCMs unless the subscriber acts affirmatively to give express prior authorization to receive messages from individual senders. Another interpretation of this provision is that Congress intended the subscriber to take affirmative steps to avoid receiving MSCMs by indicating his or her desire not to receive such messages.

Most commenters argue that Congress intended section 14 of the CAN SPAM Act to be a flat prohibition on sending MSCMs unless authorized by a given subscriber, and that such a prohibition is, in fact, necessary to protect subscribers. NAAG indicates that wireless devices are often used not for receiving commercial messages, but rather as security and safety devicesfor emergencies and to communicate with family members. NAAG contends that Congress intended to craft a flat prohibition unless the consumer first consented to receive the messages, and that any rule treating inaction by the consumer as consent to receive any commercial messages would conflict with Congressional intent. The Direct Marketing Association (DMA) argues that the prohibition should apply only to messages for which the recipient must pay. The National Association of Realtors (NAR) contends that a general prohibition without certain exceptions would harm small businesses.

We conclude that wireless subscribers would be best protected by a flat prohibition on sending MSCMs unless express prior authorization has been obtained from the subscriber. We agree that wireless devices are not ones on which subscribers would expect to receive commercial messages. We agree that it is the intrusive nature of such messages, in addition to the costs to receive them, which necessitates our adopting a ban unless the consumer has taken some action to invite them. We believe that NAR's concerns about the burden on small businesses are addressed by the exemption for express prior authorization, discussed below.

Verizon Wireless argues that a prohibition without an exemption for wireless providers would violate the First Amendment. We disagree. A flat prohibition here satisfies the criteria set forth in Central Hudson Gas & Elec. v. Pub. Serv. Comm. of N.Y., in which the Supreme Court established the applicable analytical framework for determining the constitutionality of a regulation of commercial speech. Under the framework established in Central Hudson, a regulation of commercial speech will be found compatible with the First Amendment if (1) there is a substantial government interest; (2) the regulation directly advances the substantial government interest; and (3) the proposed regulations are not more extensive than necessary to serve that interest.

[[Page 55768]]

Under the first prong, we find that there is a substantial governmental interest in protecting privacy. Congress found that ``there is a substantial government interest in regulation of commercial electronic mail on a nationwide basis.'' Specifically, Congress found that (1) electronic mail has become an extremely important and popular means of communication, (2) that the convenience and efficiency of electronic mail are threatened by the high volume of unsolicited commercial electronic mail, (3) that the receipt of unsolicited commercial electronic mail may result in costs for storage and/or time spent accessing, reviewing, and discarding such mail, and (4) that the growth in such electronic mail imposes significant monetary costs on providers of Internet access services, businesses, and educational and nonprofit institutions. NAAG notes that in addition to being intrusive in general, unwanted calls to wireless devices use battery power and interfere with a consumer's ability to use devices during emergencies.

We find that the rules we adopt today will advance those interests, and do so with regulations that are no more extensive than necessary. Under the second prong, the method we adopt directly advances the government's interest by alerting senders to the electronic mail addresses that are associated with mobile services and prohibiting the sending of such messages to wireless devices. Under the third prong, we have reviewed other possible options and we believe the method we adopt today, tailored to affect only those addresses associated with mobile service, is no more extensive than necessary. In addition, senders of such messages may continue to contact recipients that have provided express prior authorization to do so. Our conclusion is also consistent with Court of Appeals decisions regarding First Amendment challenges to the TCPA. We conclude we have the authority and a mandate to adopt measures to protect the public from such messages. We believe that a prohibition, combined with a domain name list as discussed below, is the most effective method, but it is no more extensive than necessary, to accomplish that end.

1. List of Wireless Domain Names

In the NPRM we noted that a key problem with regulating MSCMs, as opposed to messages sent to other devices such as desktop computers, is the current difficulty senders have in recognizing electronic mail addresses associated with wireless service and devices. Our task, therefore, differs substantially from that of the FTC's efforts to implement the CAN SPAM Act. We note that should the FTC or Congress take significant action to change the landscape of commercial electronic mail messaging, such as requiring labeling of all commercial electronic mail, the Commission may revisit the options discussed below.

We sought comment on several proposals to enable senders to recognize which addresses were associated with wireless devices. These included developing a list of domain names, requiring carriers to use standard subdomain names, requiring a registry of individual electronic mail addresses, incorporating challengeresponse technology, and otherwise maximizing use of filters.

We believe that creating a list of Internet domain names associated with CMRS subscribers and prohibiting the sending of commercial messages to addresses using those domain names is the best option at this time to allow subscribers to avoid unwanted MSCMs. We believe that if senders are able to identify wireless subscribers by domain name, consumers and carriers alike will benefit. The record reveals that it is already industry practice for CMRS providers to use certain subdomains exclusively to serve their MSM subscribers and that these subdomains distinguish such customers from other customers. Therefore the burden on wireless providers, even small wireless providers, to supply such names for a directory would be minimal. In addition, we agree with those commenters who indicate that making available to senders of MSCMs a list of the domains used by wireless subscribers is the most efficient option to assist senders in complying with the rules.

Senders will need to check the list on a regular basis to avoid sending MSCMs to the domain names on the list. We believe that, due to the estimated small size of the list and the evidence that the list is anticipated to remain relatively static; the list is the option that imposes a burden that is no more extensive than necessary for senders as well. Furthermore, such a registry places no burdens on subscribers who wish to avoid unwanted MSCMs and it does not collect personal information about those subscribers. Subscribers need not change their electronic mail addresses or take any further action to avail themselves of the protections under section 14 of the CAN SPAM Act. Thus, despite the concerns of some commenters regarding other proposals in the NPRM, under this system wireless subscribers will not have to change addresses, and incur associated advertising and administrative costs, if they wish to avoid commercial electronic mail.

TMobile urges the Commission not to require wireless service providers to provide domain names for a domain name list. TMobile argues instead that a voluntary list would afford each provider the ability to choose whether to publicize its domain name. However, we note that many of these domain names are already widely known or publicly available. Congress has directed us to give all wireless consumers the ability to avoid unwanted MSCMs, and we have no authority to limit such protections to subscribers of those carriers that elect to submit a domain name to the list. Therefore, we decline to make the submission of domain names to the list voluntary for wireless providers.

Therefore, we require all CMRS carriers, including small carriers, to file with the Commission the names of all electronic mail domain names used to offer subscribers messaging specifically for mobile devices. Once we have obtained approval from the Office of Management and Budget (OMB) for information collections associated with these rules, the Commission will issue a separate public notice in this docket outlining the process for submitting this information and the timeframe for doing so. Carriers will also be required to file any updates to their listings with the Commission not less than 30 days before issuing subscribers a new or modified domain name. Carriers are encouraged to file updated information further in advance. In addition, to ensure the continued accuracy of the list, carriers must remove any domain name that has not been issued to subscribers or is no longer in use within 6 months of placing it on the list or last date of use.

We will make the official list of domain names available to the public from the FCC's website, in a similar fashion to the list of Section 255 Service Provider contacts. The list will be updated regularly. The Commission will issue a second public notice announcing the date on which senders of commercial electronic mail will have access to the domain name list from the Commission's website. Senders will then have an additional 30 days from the date the list becomes publicly available to comply with the rules to avoid sending MSCMs to wireless subscribers absent their express prior authorization.

As discussed above, to make such a list effective, we also adopt rules to prohibit the sending of any commercial
[[Page 55769]]
message to an address that references a domain name on the Commission's domain name list, unless the sender has received the express prior authorization of the person or entity to which the message is sent or delivered. This prohibition only applies to ``commercial'' messages, as defined in the CAN SPAM Act, and as interpreted by the FTC. We note that in promulgating the rules we adopt today, we have incorporated portions of the CAN SPAM Act directly.

Persons initiating commercial messages would be expected to check the domain name list to ensure that they are not sending MSCMs without express prior authorization. While we will not require any person or entity to provide proof of when they consulted the domain name list, any person or entity may use as a ``safe harbor'' defense proof that a specific domain name was not on the list more than 30 days before the offending message was initiated. This ``safe harbor'' defense shall not excuse any willful violation of the ban on sending unwanted messages to wireless subscribers. Any person or entity will be considered in violation of the prohibition if the message is initiated knowingly to a subscriber of MSM service, even if it is sent within 30 days of the domain name appearing on the list. This prohibition applies to the entity on whose behalf the message is sent and to any other entity that knowingly transmits an MSCM without consulting the domain name list. 2. Other Proposals

Standard subdomain names. We decline at this time to require CMRS providers to adopt a standard subdomain name for wireless devices. In the NPRM we sought comment on two related proposals. First, we sought comment on whether it would be possible and useful to require the use of specific toplevel and secondlevel domains, which form the last two portions of the Internet domain address. No commenter specifically addressed our proposal. Second, we sought comment on whether we should require one portion of the domain to follow a standard naming convention to be used for all MSM service. As we noted in the NPRM, unless we required use of a limited toplevel domain, we have no way to prevent entities that do not provide MSM service from adopting such names. In addition, any ban associated with such a subdomain outside a limited toplevel domain, could inadvertently ban commercial messages for any entities that happened to already have such subdomains. Thus, the sender would not be able to distinguish between those addresses which were truly used for wireless messaging, and other addresses.

Cingular, Nextel, VeriSign and Verizon Wireless caution the Commission against requiring subdomain naming standards. They note this would be costly for subscribers, especially small businesses, who could have large administrative costs to change their advertising and business materials to reflect a new address. Cingular states that a subdomain naming standard would also force carriers to absorb considerable costs. Carriers argue also that any cost to protect wireless subscribers from unwanted commercial mail should fall instead to the senders of such mail. While we agree with NAAG and National Automobile Dealers Association (NADA) that a standard subdomain name would be simpler for senders, we believe it would be more burdensome for carriers, especially small businesses, to implement than a domain name list. In addition, we agree that, consistent with the intent of the CAN SPAM Act, subscribers should not have to bear additional costs, such as the administrative costs mentioned, in Order to avoid unwanted MSCMs. Thus, we decline to adopt this option at this time.

Registry of Individual Email Addresses. We also decline to establish a limited national registry containing individual electronic mail addresses, similar to the national ``donotcall'' registry. In the NPRM, we noted that the FTC is tasked with reviewing whether a nationwide marketing ``DoNotEMail'' registry might offer protection for those consumers who opt to place their electronic mail addresses on such a registry. In June, the FTC released its report to Congress recommending against adopting a national donotemail registry at this time. The FTC noted that there is no directory of valid individual addresses and, therefore, creating a registry of individual addresses would create ``a gold mine'' for marketers, both legitimate and illegal. The report stated that existing security measures are currently inadequate to protect such a registry. In addition, the report noted that there were practical concerns with the large number of anticipated addresses.

Commenters generally oppose the establishment of a registry of individual subscriber addresses, even if it is limited to MSM subscribers. They contend that such a registry would not be secure, could enable spammers to send more unwanted electronic mail messages, and that the security risk would threaten consumer privacy interests. Commenters also maintain that such a registry would be burdensome for consumers and for senders, that there would be huge operational problems with setting up such a registry, that it would be ineffective, and that it would be costly to train senders to use it properly. The DMA submitted a detailed study demonstrating what it believes are significant problems with the security, practicality, and technical feasibility of such a registry. Only a few commenters argue that a registry of electronic mail addresses would be useful, with little or no support for their conclusions, and one commenter saying it would be beneficial if combined with other antispam measures.

Upon careful consideration of the costs and benefits of creating a national wireless donotemail registry of individual electronic mail addresses, we believe that the disadvantages of such a system described in the record outweigh any possible advantages at this time. A national registry containing individual electronic mail addresses would involve significant resources and cost to set up and administer. Because a registry of individual addresses may potentially contain millions of records, it could also be burdensome for senders of MSCMs, including small businesses, to regularly access, download, and use the registry to check against targeted addresses. It would be less burdensome to do the same with a much smaller list of mobile service domain names. Even if the resources were devoted to establishing such a registry, commenters describe serious concerns about a registry becoming a target for unscrupulous marketers who would target electronic mail addresses on the list. As noted by the DMA, other commenters, and by the FTC in a Report to Congress, because such a list would be considered valuable to such marketers, there is a significant risk that such individuals might be motivated to try to obtain the list specifically for the purpose of sending unsolicited messages to those addresses. The record also reveals that at this time such a registry would not be as effective as one containing only domain names. Commenters note that the annual rate for electronic mail address turnover is high'as much as 32 percent per annum. As the FTC noted, unlike the donotcall registry, which uses phone databases to purge the list of disconnected phone numbers, there is no database for abandoned electronic mail addresses. Thus, any database containing such addresses would continually expand, and include valid and unused addresses. For all of these
[[Page 55770]]
reasons, we decline to adopt a registry of individual electronic mail addresses of wireless subscribers at this time.

Additional Mechanisms and CMRS Providers' Roles. There was little consensus on what other technical solutions should be required. Because the rules we adopt today address the statutory requirements for protecting consumers from unwanted messages to mobile devices, we decline to require other specific technical solutions such as the challengeresponse mechanisms or technological solutions related to filtering as discussed in the NPRM. The Members of the U.S. House Representatives who commented in the proceeding urge the Commission to make things simple for users. We believe the domain name list does so.

We believe that it is the industry itself that can help give consumers additional protections and abilities to avoid unwanted electronic mail from sources other than legitimate businesses. Wireless and technology providers contend the Commission should not regulate in detail the wireless providers' efforts to combat unwanted messages. Those providers who commented in this proceeding note that they are aggressively working to stop unwanted messages. We applaud them for those efforts and do not want to interfere with this area of evolving technologies and market forces. We agree that at this time it is not necessary for the Commission to become involved in mandating detailed technical solutions. However, we strongly encourage providers to provide subscribers with additional reasonably effective methods to avoid receiving unauthorized MSCMs. We believe service providers should determine for themselves appropriate solutions to employ and offer, and we expect all providers to offer subscribers protections against unwanted messages. We will continue to monitor the effectiveness of our rules and the efforts of wireless providers to protect wireless subscribers from MSCMs and may revisit this issue at a later date to ensure that subscribers are afforded sufficient safeguards from all unwanted commercial messages.

C. Express Prior Authorization

Congress directed the FCC to adopt rules to provide consumers with the ability to avoid receiving MSCMs, unless the subscriber has provided express prior authorization to the sender. We sought comment on the form and content that such ``express prior authorization'' should take. Specifically, we sought comment on whether senders should be required to obtain a subscriber's express authorization in writing, and how any such requirement could be met electronically. We also asked if senders should be required to provide a notice to recipients about the possibility that costs could be incurred in receiving any such messages. We asked whether the term ``affirmative consent'' in The CAN SPAM Act would be suited to use in defining ``express prior authorization.''

Commenters were generally split on whether the Commission should require senders to obtain express authorization from subscribers in writing. Wireless providers generally oppose any written authorization requirement, while consumers' groups contend that authorization should be obtained in writing, along with a signature. Wireless providers instead argue that senders should be allowed flexibility to obtain authorization via the Internet, orally over the telephone, or through messages sent to the subscriber's wireless device. Some suggest that consent forms requiring a signature would be impractical and hinder communications between sellers and consumers. NAAG, on the other hand, contends that the rules should be modeled after the Commission's ``do notcall'' provisions, where express authorization must be evidenced only with a signed, written agreement between the consumer and seller which states that the consumer agrees to be contacted by the seller and includes the telephone number to which calls may be placed. Electronic Privacy Information Center (EPIC) warns that authorization not provided in writing may result in some senders falsely claiming they had the recipient's authorization to send MSCMs. EPIC adds that any authorization notice to the subscriber should be clear and conspicuous and written in plain language for the subscriber.

As mandated by the CAN SPAM Act, we require any sender of MSCMs to obtain the express authorization of the recipient prior to sending any MSCMs to that subscriber. We agree with those commenters that contend that ``affirmative consent'' as defined in the CAN SPAM Act is not suited to defining ``express prior authorization'' because protections for wireless subscribers are meant to be more stringent. Given the intent of Congress to afford greater protections from spam to wireless subscribers than to consumers generally, we believe that the burden must rest with the sender of MSCMs to obtain authorization from any subscriber prior to sending any MSCMs. Senders must also do so in a manner that best protects subscribers' privacy interests. However, we decline to require senders to obtain a subscriber's authorization in writing.

We will permit senders to obtain authorization by oral or written means, including electronic methods. A sender may obtain the subscriber's express prior authorization to transmit MSCMs to that subscriber in writing. Written authorization may be obtained in paper form or via an electronic means such as an electronic mail message from the subscriber. It must include the subscriber's signature and the electronic mail address to which MSCMs may be sent. Senders who choose to obtain authorization in oral format are also expected to take reasonable steps to ensure that such authorization can be verified.

We note here that in the event any complaint is filed, the burden of proof rests squarely on the sender, whether authorization has been obtained in written or in oral form. We do so to avoid the likelihood that any businesses will try to fabricate authorization. Given the potential costs and inconvenience to subscribers to receive such MSCMs, it is important that such messages be sent only to those wireless devices belonging to receptive subscribers. We strongly suggest that senders take steps promptly to document that they received such authorization. Recognizing the potential for fraud by both a person signing up someone else to receive MSCMs and by businesses fabricating authorization, we recommend that the business confirm the electronic mail address with a confirmatory notice sent to the recipient requesting a reply. We emphasize that sending any commercial message to a wireless device, including any falsely purporting to be confirmatory messages, is a violation of our rules unless the subscriber has already provided express prior authorization and the sender bears the burden of showing that has occurred.

Whether given orally or in writing, express prior authorization must be express, must be given prior to the sending of any MSCMs, and must include the electronic mail address to which such MSCMs may be sent. In addition, we believe that consistent with the intent of the CAN SPAM Act, consumers must not bear any additional costs to receive a request for authorization, and must be able to reply to such a request without incurring any additional costs. In addition to actual costs for such messages, as noted above, recipients may incur costs for time spent accessing, reviewing, and discarding such mail. Thus, senders are prohibited from sending any request for authorization to any wireless subscriber's wireless devices. Express prior authorization may not be obtained in the form of a ``negative option.'' If a
[[Page 55771]]
sender chooses to use a website, we note that such authorization must include an affirmative action on the part of the subscriber, such as checking a box or hitting an ``I Accept'' button, accompanied by the clear disclosures outlined below. In addition, the subscriber must have an opportunity in the process to input the specific electronic mail address for which they are authorizing MSCMs. Express prior authorization need only be secured once from the recipient in Order to send MSCMs to that subscriber until the subscriber revokes such authorization. Senders who claim they obtained authorization from wireless subscribers to send them MSCMs prior to the effective date of these rules will not be in compliance with the rules unless they can demonstrate that such authorization met all the requirements as adopted herein, including the disclosure requirements below.

We emphasize that if the sender subsequently is notified by the subscriber that the subscriber does not wish to receive MSCMs, the sender must cease sending such messages within 10 business days of the receipt of such request in compliance with section 5(a)(4)(A) of the CAN SPAM Act. We note, however, that this 10day time period may change should the FTC amend its rules. We delegate to the Consumer & Governmental Affairs Bureau the authority to amend the rules to reflect any updates in the timeframes adopted by the FTC.

A subscriber who provides an electronic mail address for a specific purpose, e.g., notifying the subscriber when a car repair is completed, will not be considered to have given express prior authorization for purposes of sending MSCMs in general. In addition, should a sender allow subscribers to choose the types of MSCMs they receive from that sender, and authorization is provided for those specific types of messages, the sender should transmit only those types of MSCMs to the subscriber. Finally, authorization provided to a particular sender will not entitle that sender to send MSCMs on behalf of third parties, including on behalf of affiliated entities and marketing partners. If a sender obtains express prior authorization, that sender must be identified in the message in a form that will allow a subscriber to reasonably determine that the sender is the authorized entity.

Required Disclosures. As noted above, Congress found that the receipt of unsolicited commercial electronic mail often results in monetary costs and inconvenience for wireless subscribers. Thus, the rules we adopt today require senders to disclose to the subscriber at the time they obtain any subscriber's express prior authorization that: (1) The subscriber is agreeing to receive mobile service commercial messages sent to their wireless device from a particular sender; (2) the subscriber may be charged by their wireless service provider in connection with receipt of such messages; and (3) the subscriber may revoke her authorization to receive MSCMs at any time. Any such disclosure notice containing the required disclosures must be clearly legible, use sufficiently large type (or, if audio, be of sufficiently loud volume), and be placed so as to be readily apparent to a customer. The disclosure notice must also be separate from any other authorizations in the document. And, it must clearly provide the name of the person or entity sending the MSCM and the person or entity whose product or service is advertised or promoted in the MSCMs if different from the sender. Finally, if any portion of the disclosure notice is translated into another language, then all portions of the notice must be translated into that language. Senders are cautioned that if they use a website for obtaining authorization, such authorization notice must comply with these disclosure requirements as well. We note that if authorization is obtained orally, all required disclosures must still be made by the sender.

We decline to carve out any exemptions from the ``express prior authorization'' requirements. We find that any exemption for a particular industry would be in direct conflict with the intent of the CAN SPAM Act to protect wireless subscribers from commercial electronic mail messages that they do not wish to receive. We also find that permitting senders to obtain authorization orally or in writing, addresses the concerns described by certain commenters in obtaining such authorization.

The legislative history demonstrates that section 14 of the CAN SPAM Act was included so that wireless subscribers would have greater protections from commercial electronic mail messages than those protections provided elsewhere in the CAN SPAM Act. Congress was concerned about the intrusive nature of wireless spam and the costs to subscribers associated with receiving such spam. Thus, we emphasize that any MSCM sender that claims its messages are transmitted based on oral, written, or electronic authorization must be prepared to provide clear and convincing evidence of such express prior authorization by the subscriber. The failure to obtain such authorization before sending MSCMs will be a clear violation of the CAN SPAM Act and Commission's rules.

D. Electronic Rejection of MSCMs

Required technical mechanisms. In the NPRM we sought comment on how we could best fulfill the mandate of section 14 (b)(2) of the CAN SPAM Act to develop rules that ``allow recipients of MSCMs to indicate electronically a desire not to receive future MSCMs from the sender.'' We also sought comment on technical options that might be used to do this simply.

Commenters suggested technical options for withdrawing authorization including a return electronic mail address, a hyperlink to a website, the use of short code mechanisms, telephonebased techniques such as those that allow the caller to use key pads, or some combination of the foregoing. Members of the U.S. House of Representatives and the Motion Picture Association of America, encourage the Commission to adopt a simple, streamlined electronic response technique to quickly withdraw prior authorization using a recipient's handset. Two commenters contend that requiring small businesses to setup and maintain a website for the purpose of rejecting future messages would impose an unreasonable burden. NAAG contends the first screen of any MSCM should display the existence of an option to decline to receive messages and the means by which it can be exercised.

As a preliminary matter we note that section 5(a)(3) of the CAN SPAM Act requires that all commercial electronic mail include ``a return electronic mail address or other Internetbased mechanism, clearly and conspicuously displayed.'' Several commenters endorsed the applicability of the general provision of section 5(a)(3) of the CAN SPAM Act for MSCMs, indicating that a return electronic mail address or other Internetbased mechanism, such as a link to a website, would serve as a mechanism for electronically rejecting further items and should be included in any MSCM sent. We agree that this provision would need to be included in all MSCMs in Order for our rules to be consistent with the CAN SPAM Act.

We believe, however, that more is required. Our decision is informed by the significant differences between the resources that may be available to recipients of MSCM and the resources available to recipients of electronic mail messages in general. In particular our definition of MSCM includes messages that originate on the Internet and that
[[Page 55772]]
are converted for delivery to wireless devices which may not have Internet access. Some of these wireless services and devices are by nature oneway services. Moreover, we cannot assume that all MSCM recipients have an alternative means of access to Internetbased electronic messaging or to other Internetbased mechanisms, such as a web browser. Consequently, we strongly agree with the Mobile Marketing Code of Conduct principle that ``consumers must be allowed to terminate their participation in an ongoing mobile messaging program through channels identical to those through which they can opt to receive messages about a given program.''

Therefore, we conclude that in addition to the general requirement of the CAN SPAM Act that each MSCM have a functioning return electronic mail address or other form of Internetbased communication, a sender of an MSCM must provide the recipient with access to whatever mechanism they were given access to in Order to grant express prior
authorization. For example, if a subscriber was given a shortcode mechanism for granting authorization for MSCMs to the sender, the sender must provide that subscriber with a way to send a short code as a means to electronically reject future MSCMs from that sender. A sender must also include basic instructions by which this option or these options can be exercised to reject further items.

A sender may include other mechanisms at his discretion, so long as these basic requirements are met. The means by which a recipient notifies the sender that the recipient does not wish to receive additional MSCMs can impose no new requirements on the recipient beyond the means by which he provided prior express authorization. In addition, the sender may not subject the subscriber to further commercial advertising or solicitation as part of the procedure the recipient must use to reject future messages.

Consistent with CAN SPAM Act section 5(a)(3), for no less than 30 days following the transmission of an MSCM, all included mechanisms for acquiring express prior authorization must remain capable of receiving and honoring the recipient's rejection of further messages. As we indicate above, the sender must cease sending further messages within the amount of time that the FTC has allotted for senders to act upon requests for rejecting subsequent messages, currently set at 10 business days after receipt of any request from the subscriber.

In regards to small businesses, we note that the flexibility provided for obtaining express prior authorization and for notifying the sender of the subsequent rejection of further items addresses the concerns of small business interests that, for example, a small business not be required to setup and maintain a new website. We further note that because the recipient must be given express prior authorization for any MSCM that arrives, we see no need to adopt NAAG's suggestion to require material regarding how to decline to receive more messages to be displayed on the first screen of any MSCM. Finally, the record does not indicate that provider services and subscriber devices currently support a common responsebased technique that is simple for subscribers to use and that the Commission could adopt. We therefore encourage industry to develop an industrystandard means by which a subscriber can use his handset to easily respond to a sender that he no longer wishes to receive MSCMs. We will monitor whether industry has developed a standard means by which subscribers can use handsets to respond and may revisit this issue at a later date.

Other technical mechanisms. In the NPRM we sought comment on the applicability of a variety of other technical options that could be used by subscribers for electronically rejecting messages. For example, we asked about the possible applicability of mechanisms for blocking messages from particular senders at the subscriber's request, of an ability to add a changeable personal identifier to a wireless device mail address by means of which the subscriber could easily alter his address, and of challengeresponse mechanisms that a subscriber might invoke. One commenter supported establishing a policy framework to deploy subscribercontrolled blocking solutions. Many providers acknowledged that they voluntarily provide their subscribers such means for mitigating unsolicited MSCM, but cautioned the Commission against mandating their availability. Given the record and the apparent success to date of the voluntary approach in generally blocking unwanted MSCMs, we decline to require that all providers make such mechanisms available for use at the option of their subscribers.

E. Consideration of CMRS Provider Exemption

Section 14 (b)(3) of the CAN SPAM Act allows the Commission to exempt providers of commercial mobile services to the general prohibition on the sending of MSCMs. In doing so, the Commission must take into consideration the ``relationship that exists between providers of such services and their subscribers.'' However, as the CAN SPAM Act clearly states, our overall mandate is to protect consumers from unwanted MSCMs. The CAN SPAM Act does not require the Commission to provide an exemption, only to consider whether such an exemption would be appropriate. As a result, the Commission sought comment in the NPRM on whether there is a need for such an exemption and how it would impact consumers.

In the NPRM, we noted that the CAN SPAM Act already excludes certain ``transactional and relationship'' messages from the definition of unsolicited commercial electronic mail. Specifically the CAN SPAM Act states that transaction and relationship messages are those messages in which the primary purpose is:
(i) To facilitate, complete, or confirm a commercial transaction that the recipient has previously agreed to enter into with the sender; (ii) to provide warranty information, product recall information, or safety or security information with respect to a commercial product or service used or purchased by the recipient; (iii) to provide (I) notification concerning a change in the terms or features of; (II) notification of a change in the recipient's standing or status with respect to; or (III) at regular periodic intervals, account balance information or other type of account statement with respect to a subscription, membership, account, loan, or comparable ongoing commercial relationship involving the ongoing purchase or use by the recipient of products or services offered by the sender; (iv) to provide information directly related to an employment relationship or related benefit plan in which the recipient is currently involved, participating, or enrolled; or (v) to deliver goods or services, including product updates or upgrades, that the recipient is entitled to receive under the terms of a transaction that the recipient has previously agreed to enter into with the sender.

In light of the exclusions of those types of messages, we asked in the NPRM whether there was a need for a separate exemption for CMRS providers from the section 14 of the CAN SPAM Act ``express prior authorization'' requirement and, if so, how the Commission would implement the requirements allowing subscribers who indicated a desire not to receive future MSCMs from the provider (1) at the time of subscribing to such service and (2) in any billing mechanism. Additionally, we requested in the NPRM that CMRS providers supply us with specific examples of messages that they send to their customers that are not already excluded from the CAN SPAM Act. Finally, if such an exemption were created, we asked whether there would
[[Page 55773]]
be any impact on small businesses and whether small wireless service providers should be treated differently.

NAAG, consumer groups, and a privacy organization argue that there is no basis for granting an exemption for CMRS providers. CMRS providers argue they should have an exemptionwith two providers noting this should be only if the carriers do not charge subscribers for the messages they send. However, despite the NPRM's request that carriers provide specific examples of messages that would not already be covered by the CAN SPAM Act's exemption for ``transactional'' or ``relationship'' messages, CMRS providers offer few such examples and, as discussed below, they might already be allowed under The CAN SPAM Act. NAR says it would be unfair to give an exemption to one business model and not others. Many CMRS providers counter that we should not make a special exemption for small businesses. As to the scope of the exemption, CTIA urges that any exemption for CMRS providers also should extend to its business partners, while the DMA warns that any such exemption must be narrowed to include only messages from a carrier about its own services. Verizon argues that declining to exempt carriers would be an unlawful restriction on commercial speech; however, we have already addressed that issue above.

Based upon the record before us, we decline to grant CMRS providers a special exemption from the requirement to obtain express prior authorization from their current subscribers before sending them any MSCM. In reaching this decision, we are persuaded by commenters, including many consumer groups and individuals, who urge us to provide greater consumer protection for wireless consumersprotection that is not diluted by such an exemption. The CAN SPAM Act itself requires us to protect consumers from ``unwanted'' commercial messages, not only those that have additional costs. As commenters note, consumers are concerned with the nuisance of receiving such messages.

Several of these commenters emphasize that CMRS providers should not be exempt from the rules requiring express prior authorization because the bulk of CMRS providers' communications with their customers are already expressly exempted under the CAN SPAM Act as
``transactional and relationship'' messages. We agree that the few examples that CMRS providers supplied in the record appear to already fall within ``transactional and relationship'' messages or otherwise outside of the definition of ``commercial'' messages. For example, T Mobile contends that it needs to be able to send notices to customers about fraud. As noted above, the CAN SPAM Act defines a ``commercial electronic mail message'' as an electronic message for which the ``primary purpose'' is the ``commercial advertisement or promotion of a commercial product or service (including content on an Internet website operated for a commercial purpose).'' If the primary purpose of the message was to alert customers about fraud, we do not believe T Mobile's example would fall within the definition of ``commercial'' and therefore would not fall under the CAN SPAM Act at all. In addition, Nextel provides the example of a carrier needing to send out an alert to a prepaid customer that his account balance is running low. If that was the primary purpose of the message, such a message would fall under the exemption for transaction and relationship message.

As noted previously, the FTC has authority to develop the criteria used to define whether a message is ``commercial,'' as well as any modifications for what is considered in the exemption of transactional and relationship messages. Therefore, we delegate to the Consumer & Governmental Affairs Bureau the authority to amend the rules we adopt today to ensure consistency with any rule the FTC adopts under the CAN SPAM Act to further define ``commercial'' and ``transactional relationship'' messages.

Although CMRS providers contend that an exemption should be provided, very little support for such an exemption was provided in the record in this proceeding. Much of the comment in support of the exemption is conclusory in nature. TMobile states that, by empowering the Commission to exempt wireless carriers from section 14 (b)(1) of the CAN SPAM Act, Congress has recognized that the MSCMs sent by wireless carriers are fundamentally different than MSCMs sent by all other senders. Cingular, Nextel and Sprint urge the Commission to presume that the customer is willing to receive information about their providers' new products and services. Nextel notes that, unlike third parties, wireless carriers can ensure that customers are not charged for such messages. Dobson states that, in many cases, a subscriber would prefer an SMS message from its carrier rather than a phone call or bill insert.

We note again that Congress' intent in including section 14 in the CAN SPAM Act was to afford wireless consumers greater protection from unwanted commercial electronic mail messages. Ultimately, we are persuaded that safeguarding wireless consumers from MSCMs, undiluted with an exemption for CMRS providers, will ensure that consumers receive ``less, not more, spam.'' The record shows that MSCMs sent by CMRS providers are not fundamentally different from those sent by other senders, other than that they may be provided without additional cost to subscribers. An MSCM from a CMRS provider may be just as intrusive, and costly in other respects, as an MSCM from a third party. As Congress noted, the receipt of unwanted mail can result in costs ``for the storage of such mail, or for the time spent accessing, reviewing, and discarding such mail.'' In addition, providers have unique channels such as monthly statements and web sites, through which they can request a subscriber's prior express authorization. We note that the rules we establish in this proceeding are sufficiently flexible to enable the CMRS provider to readily obtain the subscriber's express prior authorization in a number of ways, if a CMRS provider desires to send an MSCM to any wireless subscriber. For all of those reasons, a promise to make them costfree alone does not suffice as justification for an exemption.

Accordingly, we decline to exempt CMRS providers from the requirement to obtain express prior authorization from their current subscribers before sending them any MSCM. For similar reasons, we also decline to create an exemption for other entities, such as realtors or small businesses. NAR argues that the MSCM rules should not apply to a real estate professional's communications to their clients about the services they are providing to that client, or to communications between associations and their members. As noted above, the CAN SPAM Act's existing exemption already broadly covers many transaction and relationship messages. Furthermore, the allowance for orally obtaining express prior authorization, which NAR advocates, should allow realtors to obtain such authorizations as needed. NAR has not established that messages sent by its members are fundamentally different from those sent by other senders. An MSCM from a real estate professional may be just as intrusive, and costly as an MSCM from any other entity. ACA International contends that messages sent to wireless devices for the primary purpose of collecting debts are not MSCMs as they are not ``commercial'' and therefore are exempt from the CAN SPAM Act. As we noted
[[Page 55774]]
previously, while the statute leaves the interpretation of ``transactional and relationship'' messages to the FTC, in the absence of any ruling to the contrary, we believe that messages from a person or entity with whom the recipient has previously agreed to enter into a transaction and that concern a debt owed for that transaction would fall under the exemption. However, consistent with our 2003 TCPA Order, a call to sell debt consolidation services, for example, is a commercial call regardless of whether the consumer is also referred to a taxexempt nonprofit organization for counseling services. We believe that to do so would be inconsistent with our mandate from Congress to protect subscribers from unwanted commercial messages.

F. General Compliance With the CAN SPAM Act

We asked for comment on specific compliance issues that senders of MSCM might have with other sections of the CAN SPAM Act. We noted in the NPRM that although we believed that currently, some carriers choose to limit the length of certain text messages that some commercial mobile service subscribers already appeared to be supplementing the limited text handling functionality with ancillary personal computer technology. We received little response about this issue. CTIA states that some handsets are limited in message storage beyond a certain length and screens are small; thus, CTIA argues that senders should not be required to meet all of the disclosures. Consumer Action, the Consumer Federation of America and the National Consumers League contend that the disclosure requirements of the main provisions of the CAN SPAM Act are so important that they should trump any awkwardness with messages being filled with disclosures. We agree. There is insufficient evidence on the record to warrant a waiver of the basic disclosure requirements mandated by the CAN SPAM Act.

Finally, CTIA contends that wireless carriers should be given special treatment with regard to general compliance with the information requirements of section 5 of the CAN SPAM Act, given that they can provide this data at the time of subscription and in each monthly bill. CTIA contends in a footnote that interpreting the statute to mean that CMRS providers would need to comply with all the information requirements of section 5 would render section 14 (b)(4) of the CAN SPAM Act meaningless. We disagree. Based on the information discussed above regarding messages sent by CMRS providers, we find there is no reason for treating them differently from other businesses. Final Regulatory Flexibility Analysis

As required by the Regulatory Flexibility Act of 1980, as amended (RFA), an Initial Regulatory Flexibility Analysis (IRFA) was incorporated in the Notice of Proposed Rulemaking and Further Notice of Proposed Rulemaking (NPRM & FNPRM) released by the Federal Communications Commission (Commission) on March 19, 2004. The Commission sought written public comments on the proposals contained in both the NPRM & FNPRM, including comments on the IRFA. None of the comments filed in this proceeding was specifically identified as comments addressing the IRFA. This present Final Regulatory Flexibility Analysis (FRFA) conforms to the RFA.

Need for, and Objectives of, This Order

On December 8, 2003, Congress passed the Controlling the Assault of NonSolicited Pornography and Marketing Act of 2003 (CAN SPAM Act) to address the growing number of unwanted commercial electronic mail messages, which Congress determined to be costly, inconvenient, and often fraudulent or deceptive. Congress found that recipients ``who cannot refuse to accept such mail'' may incur costs for storage and for ``time spent accessing, reviewing, and discarding such mail.'' The CAN SPAM Act prohibits any person from transmitting such messages with false or misleading information about the source or content, and gives recipients the right to decline to receive additional messages from the same source. Certain agencies, including the Commission, are charged with enforcement of the CAN SPAM Act.

Section 14 of the CAN SPAM Act requires the Commission to (1) promulgate rules to protect consumers from unwanted mobile service commercial messages, and (2) consider, in doing so, the ability of senders to determine whether a message is a mobile commercial electronic mail message. In addition, the Commission shall consider the ability of senders of mobile service commercial messages to comply with the CAN SPAM Act in general. Furthermore, the CAN SPAM Act requires the Commission to consider the relationship that exists between providers of such services and their subscribers.

On March 19, 2004, the Commission issued the NPRM & FNPRM regarding implementation of section 14 of the CAN SPAM Act. The Commission sought comment on how to protect wireless subscribers from those electronic mail messages, such as traditional email and forms of text messaging, that fall under section 14 of the CAN SPAM Act, while not interfering with regular electronic messages that are covered under the CAN SPAM Act in general. In the NPRM & FNPRM, the Commission sought comment on the ability of senders to determine whether a message is a mobile service commercial electronic mail message, as well as different options and technologies that might enable the sen

FOR FURTHER INFORMATION CONTACT Ruth Yodaiken, of the Consumer & Governmental Affairs Bureau at (202) 4187928 (voice), or email
Ruth.Yodaiken@fcc.gov. For additional information concerning the PRA information collection requirements contained in this document, contact Judith B. Herman at (202) 4180214, or via the Internet at
JudithB.Herman@fcc.gov.