The CAN-SPAM Act of 2003:
A Six-Month Progress Report

Technical Details

On the same day in February, we placed a list of 11 e-mail addresses on several government Web sites, hiding them in plain sight either by making the text color the same as the background color or by making the addresses “comments.” (Comments are pieces of HTML code that do not execute, generally used by programmers to clarify the function of a particular block of executable code.) The addresses included nine in plain text and two in ASCII code, all clustered in a single group.

Table A.1:  Characteristics of E-mail Addresses

Each day, all incoming spam was documented, noting sender names, return addresses, subject lines, content, and opt-out options (if any). Addresses 2, 4, 6, and 8 opted-out of everything they received. In the event that a spam message presented no opportunity to opt-out, or if an Internet-based opt-out mechanism was not functional, an opt-out request was e-mailed to the return address.

The “Opt-Out” vs. “No Response” comparisons in Figures 2 and 3 only included the e-mail totals for Addresses 1 through 8. Figure 4 contrasts the total e-mails received by Addresses 1 and 9 with those of Addresses 10 and 11.

Table A.2:  Addresses Represented in Figure 4

Registration for Newsletters

When we posted the 11 addresses on various Web pages, we also created two fictitious employees who each registered on five Web sites to receive an assortment of newsletters concerning weather, sports, travel, finance, and sweepstakes. At the time of their registration, the two provided phony demographic information and agreed to receive e-mailed ads (“solicited ads”) from the Web sites’ affiliates and advertisers. Employee 1 (E1) diligently logged onto the websites, clicking banner ads as a typical user might. E1 also opted-out of all the solicited ads received. Employee 2 (E2) never logged onto the five Web sites and never responded to a single e-mail.

Figure A.1: Fictitious Employees

In spite of opting-out of solicited ads, E1 received the same amount as E2, and continued to receive advertisements from the same businesses, sometimes months after opting-out. During the course of the experiment, E2 received not a single unsolicited advertisement, while E1 received more spam than legitimate e-mails and solicited ads combined. These dramatically underscore the importance of not using work e-mail addresses when registering on non-work-related Web sites.