First Regular Session Sixty-fourth General Assembly STATE OF COLORADO INTRODUCED LLS NO. 03-0636.01 Duane Gall HOUSE BILL 03-1200 HOUSE SPONSORSHIP Rose SENATE SPONSORSHIP (None) House Committees Senate Committees Information & Technology A BILL FOR AN ACT Concerning the addition of a no-solicitation list to the "Colorado Junk E-mail Law". Bill Summary (Note: This summary applies to this bill as introduced and does not necessarily reflect any amendments that may be subsequently adopted.) Amends the "Colorado Junk E-mail Law" to include a no-solicitation list similar to the telemarketing no-call list. Be it enacted by the General Assembly of the State of Colorado: SECTION 1. Article 2.5 of title 6, Colorado Revised Statutes, is amended to read: ARTICLE 2.5 Colorado Junk E-mail Law 6-2.5-101. Short title. This article shall be known and may be cited as the "Colorado Junk E-mail Law". 6-2.5-101.5. Legislative declaration. (1) The general assembly hereby finds, determines, and declares that: (a) The use of electronic mail (e-mail) to market goods and services is widespread; (b) Many citizens of this state view unsolicited commercial electronic mail, commonly referred to as "spam", as an invasion of privacy; (c) The instant linking of certain spam e-mail messages to web sites containing offensive or pornographic material creates additional problems for parents of young children who may become inadvertent viewers of such material; (d) Individuals' privacy rights and commercial freedom of speech should be balanced in a way that accommodates both the privacy of individuals and legitimate telemarketing practices; (e) Although charitable and political organizations may be exempt from the provisions of this article because of considerations of freedom of speech, the general assembly encourages such organizations to voluntarily comply with this article when possible; and (f) It is in the public interest to establish a mechanism under which the individual citizens of this state can decide whether or not to receive commercial solicitations by electronic mail. 6-2.5-102. Definitions. As used in this article, unless the context otherwise requires: (1) "Current or prior business relationship" means: (a) The recipient has indicated a willingness to receive commercial electronic mail messages from that sender; or (b) The recipient has purchased or leased real property, goods, or services from the sender of the unsolicited commercial electronic mail message, the message from the sender directly concerns the purchase or lease, and the message is sent within the warranty period or within thirteen months after the date of purchase or lease, whichever period is a greater length of time; or (c) The recipient has an ongoing contract with the sender of the unsolicited commercial electronic mail message, and the message from the sender directly concerns the ongoing contract "Colorado no-spam list" means the database of Colorado residential subscribers that have given notice, in accordance with rules promulgated under section 6-2.5-103.6, of such subscribers' objection to receiving unsolicited commercial e-mail messages. (2) "Conforming consolidated no-spam list" means any database that includes e-mail addresses of residential subscribers that do not wish to receive unsolicited commercial e-mail messages, if such database has been updated within the prior thirty days to include all of the e-mail addresses on the Colorado no-spam list. (3) "Conforming list broker" means any person or entity that provides lists for the purpose of sending unsolicited commercial e-mail messages, if such lists shall have removed, at a minimum of every thirty days, any e-mail addresses that are included on the Colorado no-spam list. (4) "Designated agent" means the party with which the public utilities commission contracts under section 6-2.5-103.6 (2). (2) (5) "Electronic mail", "e-mail", or "email" means an electronic message or computer file containing an image of a message that is transmitted between two or more computers or electronic terminals. "Electronic mail" includes electronic messages that are transmitted within or between computer networks. (3) (6) "Electronic mail service provider" means any person, including without limitation an internet service provider, commonly known as an "ISP", that is acts as an intermediary in sending or receiving electronic mail or provides to end users of electronic mail services the ability to send or receive electronic mail. (7) (a) "Established business relationship" means a relationship that: (I) Was formed, prior to the unsolicited commercial e-mail message, through a voluntary, two-way communication between a seller or seller's agent and a residential subscriber, with or without consideration, on the basis of an application, purchase, ongoing contractual agreement, or commercial transaction between the parties regarding products or services offered by such seller or agent; and (II) Has not been previously terminated by either party; and (III) Currently exists or has existed within the immediately preceding eighteen months. (b) "Established business relationship", with respect to a financial institution or affiliate, as those terms are defined in section 527 of the federal "Gramm-Leach-Bliley Act of 1999", includes any situation in which a financial institution or affiliate makes solicitation calls related to other financial services offered, if the financial institution or affiliate is subject to the requirements regarding privacy of title V of the federal "Gramm-Leach-Bliley Act of 1999", and the financial institution or affiliate regularly conducts business in Colorado. (8) "Internet" means the international computer network consisting of federal and nonfederal, interoperable, packet-controlled switched data networks. (4) (9) "Person" shall have the same meaning as set forth in section 2-4-401 (8), C.R.S. (10) "Residential subscriber" means a person who has contracted with an electronic mail service provider for one or more noncommercial e-mail accounts. "Person", as used in this subsection (10), also includes any other persons living or residing with such person. (5) (11) (a) "Unsolicited commercial electronic mail message" means an electronic mail message sent without the recipient's expressed permission for the purpose of promoting real property, goods, or services for sale or lease. (b) Notwithstanding paragraph (a) of this subsection (11), "unsolicited commercial e-mail message" does not include communications: (I) To any residential subscriber with that subscriber's prior express invitation or permission; (II) By or on behalf of any person or entity with whom a residential subscriber has an established business relationship; (III) For thirty days after a residential subscriber has contacted a business to inquire about the potential purchase of goods or services or until the subscriber requests that no further e-mails be sent, whichever occurs first; (IV) By or on behalf of a charitable organization that is required to and that has complied with the notice and reporting requirements of section 6-16-104 or is excluded from such notice and reporting requirements by section 6-16-103 (7); (V) Made for the sole purpose of urging support for or opposition to a political candidate or ballot issue; or (VI) Made for the sole purpose of conducting political polls or soliciting the expression of opinions, ideas, or votes. (c) "Unsolicited commercial e-mail message" includes any communication described in paragraph (a) of this subsection (11), whether such communication originates from a live operator, through the use of automatic dialing and recorded message equipment, or by other means. 6-2.5-103. Restrictions on certain commercial electronic mail - violations of article. (1) It shall be a violation of this article for any person that sends an unsolicited commercial electronic mail message to fail to disclose the actual point-of-origin electronic mail address of the unsolicited commercial electronic mail message. (2) It shall be a violation of this article for any person that sends an unsolicited commercial electronic mail message to falsify electronic mail transmission information or other routing information for the unsolicited commercial electronic mail message. (3) It shall be a violation of this article for any person that sends an unsolicited commercial electronic mail message to use a third party's internet address or domain name without the third party's consent for the purposes of transmitting electronic mail. (4) It shall be a violation of this article for any person that sends an unsolicited commercial electronic mail message to fail to use the exact characters "ADV:" (the capital letters "A", "D", and "V", in that order, followed immediately by a colon) as the first four characters in the subject line of an unsolicited commercial electronic mail message unless the sender: (a) Is an organization using electronic mail to communicate exclusively with its members; or (b) Is an organization using electronic mail to communicate exclusively with its employees or contractors, or both; or (c) Has a current or prior an established business relationship with the recipient, as defined in section 6-2.5-102 (1) (7). (5) It shall be a violation of this article for any person that sends an unsolicited commercial electronic mail message to fail to provide a mechanism allowing recipients to easily and at no cost remove themselves from the sender's electronic mail address lists so that they are not included in future mailings. It shall also be a violation of this article to send unsolicited commercial electronic mail messages to any person that has requested under this subsection (5) to be removed from the sender's electronic mail lists or to provide the electronic mail address of any such person to any third party, whether or not such third party is part of the sender's business organization. However, electronic mail addresses may be provided to any such person or to any third party for the sole purpose of inclusion in do-not-email lists. 6-2.5-103.3. Unlawful to send unsolicited commercial e-mail messages to subscribers on the Colorado no-spam list - requirements for unsolicited commercial e-mail messages generally. (1) (a) No person shall send or cause to be sent any unsolicited commercial e-mail message to the e-mail account of any residential subscriber in this state who has added his or her e-mail address and zip code to the Colorado no-spam list in accordance with rules promulgated under section 6-2.5-103.6. (b) Any person that sends an unsolicited commercial e-mail message to the e-mail account of any residential subscriber in this state shall register in accordance with the provisions of section 6-2.5-103.6 (3) (b) (II). (2) Any person that sends an unsolicited commercial e-mail message to the e-mail account of any residential subscriber in this state shall comply with section 6-2.5-103. (3) Persons desiring to send unsolicited commercial e-mail messages shall update their copies of the Colorado no-spam list, conforming consolidated no-spam list, or a list obtained from a conforming list broker within thirty days after the beginning of every calendar quarter, on or after July 1, 2004, or upon the initial availability and accessability of the Colorado no-spam list, whichever is earlier. 6-2.5-103.6. Establishment and operation of a Colorado no-spam list. (1) The Colorado no-spam list program is hereby created for the purpose of establishing a database to use when verifying residential subscribers in this state who have given notice, in accordance with rules promulgated under paragraph (b) of subsection (3) of this section, of such subscribers' objection to receiving unsolicited commercial e-mail messages. The program shall be administered by the public utilities commission. (2) Not later than January 1, 2004, the public utilities commission shall contract with a designated agent, which shall maintain the web site and database containing the Colorado no-spam list. If no more than one entity bids on the contract, the public utilities commission may award, at its discretion, such contract. (3) (a) Not later than July 1, 2004, the designated agent, using the designated state internet web site, shall develop and maintain the Colorado no-spam list database with information provided by residential subscribers. (b) The public utilities commission shall establish, by rule, guidelines for the designated agent for the development and maintenance of the Colorado no-spam list so that the no-spam list can easily be accessed by persons desiring to send unsolicited commercial e-mail messages, and by state and local law enforcement agencies. No later than April 1, 2004, the public utilities commission shall promulgate rules that: (I) Specify that there shall be no cost for a residential subscriber to provide notification to the designated agent that such subscriber objects to receiving unsolicited commercial e-mail messages; (II) Specify that there shall be an annual registration fee of not more than five hundred dollars for persons or entities that wish to send unsolicited commercial e-mail messages or otherwise access the database of e-mail addresses and zip codes contained in the Colorado no-spam list database. The public utilities commission shall determine such fee on a sliding scale so that persons or entities with fewer than five employees shall pay no fee. In addition, there shall be no fee charged to conforming list brokers or nonprofit corporations, as defined in section 7-121-401 (26), C.R.S. The maximum fee shall be charged only to persons or entities with more than one thousand employees. Moneys collected from such fees shall cover the direct and indirect costs related to the creation and operation of the Colorado no-spam list. Moneys from such fees shall be collected by and paid directly to the designated agent. The public utilities commission shall have the authority to annually adjust the fees below the stated maximum based on revenue history of the fees received by the designated agent. The designated agent shall provide means for on-line registration and credit card payment of fees charged pursuant to this subparagraph (II). Each such person or entity shall provide a current business name, business address, email address, and telephone number when initially registering for the no-spam list. This information shall be updated when changes occur. (III) Specify that the method by which each residential subscriber may give notice to the designated agent of his or her objection to receiving unsolicited commercial e-mail messages, or may revoke such notice, shall be exclusively by entering the e-mail address and zip code of the subscriber directly into the database via the designated state internet web site; (IV) Specify that the date of every notice received in accordance with subparagraph (III) of this paragraph (b) be recorded and included as part of the information in the no-spam list; (V) Require the designated agent to provide updated information about the Colorado no-spam list program on the designated state web site, subject to supervision by the public utilities commission; (VI) Prohibit the designated agent or any person or entity collecting information to be transmitted to the designated agent from making any use or distribution of subscriber information contained in the no-spam list except as expressly authorized under this article; (VII) Specify the methods by which additions, deletions, changes, and modifications shall be sent to the Colorado no-spam list database and how updates of the database shall be made available to persons or entities desiring such updates. Such methods shall include provisions to remove from the Colorado no-spam list, on at least an annual basis, any e-mail address that has been disconnected or reassigned. (VIII) Require the designated agent to maintain an automated, on-line complaint system for residential subscribers to report suspected violations over the internet web site. The automated, on-line complaint system shall have the capability to collect, sort, and report suspected violations to the appropriate state enforcement agency electronically for enforcement purposes. (IX) Specify that the no-spam list shall be available on line at the Colorado no-spam list web site to a person or entity desiring to send unsolicited commercial e-mail messages if the person or entity has registered in accordance with the provisions of subparagraph (II) of this paragraph (b). The list shall be available in a text or other compatible format, at the discretion of the public utilities commission, but shall allow for selection and sorting by specific zip codes. Bulk e-mailers and conforming list brokers shall not receive additional compensation for distributing the Colorado no-spam list, but are encouraged to freely distribute the Colorado no-spam list at no cost. (X) Specify such other matters relating to the database as the public utilities commission deems necessary or desirable. (c) If the appropriate federal agency establishes a single national database of e-mail addresses of residential subscribers who object to receiving unsolicited commercial e-mail messages, the designated agent shall include that portion of such single national database that relates to Colorado in the Colorado no-spam list established under this article. (4) The state shall not be liable to any person for gathering, managing, or using information in the Colorado no-spam list database pursuant to this article and for enforcing the provisions of this article. (5) The designated agent shall not be liable to any person for performing its duties under this article unless, and only to the extent that, the designated agent commits a willful and wanton act or omission. (6) Beginning not later than July 1, 2004, the designated agent shall update the database, on an ongoing basis, with information provided by residential subscribers and electronic mail service providers. (7) No person shall place the e-mail address of another person on the Colorado no-spam list without the authorization of the person to whom the address is assigned. (8) Beginning not later than July 1, 2004, the public utilities commission shall submit a report to the joint budget committee every six months. This report shall include fee revenues received in the previous six months, expenditures for administration of the program for the previous six months, projections of fee revenues for the next twelve months, and projections of expenditures for administration of the program for the next twelve months. Expenditures for administration of the program include the expenditures of the designated agent and expenditures of the public utilities commission. 6-2.5-104. Enforcement - civil right of action for damages - civil penalties - defenses. (1) In the case of any violation of this article, the following entities may each separately file a civil action in a court of competent jurisdiction and may each, upon proof of such violation, recover such sums as are allowed under this section: (a) The person receiving an unsolicited commercial electronic mail message; (b) Any electronic mail service provider whose network or facilities were used in the transmission or attempted transmission of an unsolicited commercial electronic mail message. (2) (a) In any such action, the prevailing party other than the originator of the unsolicited commercial electronic mail message shall be entitled to actual damages. Upon a showing that the sender of an unsolicited commercial electronic mail message violated any provision of this article, whether or not the violation resulted in a financial loss or injury, the prevailing party other than the originator of the unsolicited commercial electronic mail message may recover attorney fees and costs. (b) In any such action, the prevailing party other than the originator of the unsolicited commercial electronic mail message is also entitled to recover as part of the judgment a civil penalty in the amount of ten dollars for each unsolicited commercial electronic mail message transmitted in violation of this article. (2.5) (a) On and after July 1, 2004, violation of any provision of section 6-2.5-103.3 or 6-2.5-103.6 constitutes a deceptive trade practice under the provisions of section 6-1-105 (1) and may be enforced under sections 6-1-110, 6-1-112, and 6-1-113. No state enforcement action under this article may be brought against a person or entity for fewer than three violations per month. (b) Notwithstanding paragraph (a) of this subsection (2.5), it shall not be a violation of this section if: (I) The person or entity has otherwise fully complied with the provisions of this article and has established and implemented, prior to the violation, written practices and procedures to effectively prevent unsolicited commercial e-mail messages in violation of this article; or (II) The violation resulted from an error in transcription or other technical defect, not the fault of the person or entity, that caused the information in the no-spam list as received by the person or entity to differ from the information that was or should have been included in the no-spam list as transmitted by the designated agent. (c) No electronic mail service provider and no local exchange provider, as defined in section 40-15-102 (18), C.R.S., shall be held liable for violations of this article committed by other persons or entities. (3) The remedies, duties, prohibitions, and penalties of this section are not exclusive and are in addition to all other causes of action, remedies, and penalties provided by law. (4) At the request of any party to an action brought pursuant to this section, the court may, in its discretion, conduct all legal proceedings in such a way as to protect the secrecy and security of any computer, computer network, computer data, or computer software involved in order to prevent possible recurrence of the same or similar conduct by another person and to protect the trade secrets of any party. (5) Electronic mail service providers that adopt and implement terms, conditions, or technical measures with the intent to prevent or prohibit the origination or transmission of unsolicited commercial electronic mail messages in violation of this article shall be immune from civil liability for any such actions, and no provision of this article shall be construed to create any liability for such actions. (6) No electronic mail service provider shall be liable for the mere transmission of unsolicited commercial electronic mail messages over the provider's computer network or facilities. (7) The provisions of this article shall not be construed to require any electronic mail service provider to carry or deliver any electronic mail merely because a sender complies with the provisions of this article. 6-2.5-105. Scope of article. This article shall apply when an unsolicited commercial electronic mail message is sent to a Colorado resident via an electronic mail service provider's service or leased or owned equipment located in this state. 6-2.5-106. Severability. If any provision of this article or the application thereof to any person or circumstances is held invalid, such invalidity shall not affect other provisions or applications of this article that can be given effect without the invalid provision or application, and to this end the provisions of this article are declared to be severable. 6-2.5-107. Acceptance of gifts, grants, and donations. The public utilities commission may accept and expend moneys from gifts, grants, and donations for purposes of administering the provisions of this article. SECTION 2. Safety clause. The general assembly hereby finds, determines, and declares that this act is necessary for the immediate preservation of the public peace, health, and safety.