CAN-SPAM allows for enforcement by federal agencies (primarily the FTC), states, and providers of “Internet access service[s]” (15 U.S.C. § 7706(g)).  What exactly is a provider of an Internet access service? 

CAN-SPAM does not create a cause of action in favor any recipient of an offending email.  One would think Congress would have carved out categories of persons and entities who are entitled to enforce CAN-SPAM – i.e., since Congress did not allow individuals to sue it would have defined exactly what constitutes the provider of an Internet access service so as to limit membership in this category?  One would think Congress would have limited enforcement of CAN-SPAM to large or regional ISPs?  No such luck.  As the statute is written and as it is being interpreted by the courts, virtually anyone who provides any service that enables users to access content, information, email, or other services offered over the Internet, qualifies as the provider of an Internet access service.

Hypertouch, Inc. v. Kennedy-Western Univ., Case No. C 04-05203 (2006 US Dist. Lexis 14673) (N.D. Ca. 2006) considered and rejected a defendant’s argument that the plaintiff could not bring a CAN-SPAM claim because plaintiff was not a typical ISP.  Defendant quoted the Senate Committee Report on CAN-SPAM (S. Rep. No. 102, 108th Cong., 1st Sess. 2-3 (2003)) which listed as examples companies such as Microsoft and Earthlink.  Defendant also argued that the plaintiff was not “adversely affected” as required under CAN-SPAM.  The court rejected these arguments:

An examination of the statutory language and congressional intent indicates that Hypertouch should be considered to be a provider of "Internet access service" for purposes of the Act. The plain language of the statute indicates that a provider of e-mail service alone, without any other services, qualifies as an ISP. See 47 U.S.C. 231(e)(4) ("The term Internet access service' means a service that enables users to access content, information, electronic mail, or other services offered over the Internet"). While the ISP may also provide access to other services as part of a package, this is not a requirement. Id.

The Court also rejected defendant's argument that plaintiff was not "adversely affected" based on the incremental costs imposed on everyone by spam.  In the court's eyes, the costs may not be tangible, but they undeniably exist.  (I think there may be room for argument here.  Since everyone is affected by spam, Congress must have intended some specific type of demonstrable adverse effect (e.g., cost or slowdown) as a prerequisite to bringing an action.  If at the end of the case the plaintiff has not shown any actual damage I would think the defendant could argue that plaintiff is not "adversely affected" as required by the statute.)  The Fifth Circuit reached the same result in White Buffalo Ventures, LLC v. Univ. of Texas, 420 F.3d 366, 373 (5th Cir. 2005) (“Nonetheless, status as an "Internet Access Provider" does not appear to turn on the fraction of access conducted remotely, and we are hard-pressed to find that providing email accounts and email access does not bring UT within the statutory definition borrowed from the Internet Tax Freedom Act.”).

The cases do not turn on whether the plaintiff even has servers of her own (Hypertouch acknowledged that even connectivity through a third party ISP via a DSL line does not preclude status as a provider of Internet access services) or whether the complaint is brought on behalf of a sole proprietor or an actual viable business entity.  All that is necessary is that the plaintiff provide a service that enables users to access “content, information electronic mail, or other services offered over the Internet.”  Providing someone an email address (which is a pretty standard option with even the cheapest hosting programs these days) for free would certainly qualify.  For example, if you register a domain name and set up a hosting program, the hosting company will usually allow you a certain number of email addresses.  When you provide one of these email address to your friends for their use, you have just become the provider of an Internet access service!  It would seem from the statutory definition that even this is not required. 

I’m not sure how I would approach it, but there’s certainly room for a Congressional fix here.