Around this time last year, the FTC argued that CAN-SPAM imposed strict liability on marketers for the emailing activities of their affiliates.  A federal judge in Arizona disagreed, and handed what at the time seemed like a loss to the FTC.  Now the FTC has settled with the advertiser.  As Reasonable Basis notes, the advertiser has to pay around 400K, but more importantly it agreed to enter into a stipulation which requires the advertiser to take certain precautions with respect to its advertising activities:
At first blush, I was not sure whether this set of conditions would be a set of best practices or conditions so onerous that it would make marketing via third party marketers impractical.  Now that I take a closer look, I'm not so sure.  I would say that steps 4 and 5 could be crunched into some useful guidance for marketers.  (Of course, marketers who market via continuously *varying* emails would have trouble logistically reviewing those emails, but the FTC probably thinks that's per se indicative of an intent to defeat spam filters . . . so people should think about whether or not they want to do that anyway.)

So there you have it.  In entering into agreements with affiliates/independent marketers, it definitely helps to (1) provide the affiliate with detailed CAN-SPAM requirements; (2) require the marketer to certify how and where the receiving email addresses were obtained and compliance with the CAN SPAM requirements; and (3) review a copy of the proposed emails (from line, subject line, etc.) and approve the actual emails.  Many marketers probably already do this anyway, so this is not earthshattering.  But I suppose it's helpful in the sense that it's an indication of what the FTC views as adequate due diligence to keep affiliates in check.