Actually, you ARE allowed to send unsolicited email, even commercial (UCE). It has to be clearly labeled, contain the postal address of the sender, and contain unsubscribe links. Also, CAN-SPAM only applies to senders in the U.S. (unfortunately).
https://en.wikipedia.org/wiki/CAN-SPAM_Act_of_2003#Applicabi...
> Any opt-out mechanism you offer must be able to process opt-out requests for at least 30 days after you send your message. You must honor a recipient’s opt-out request within 10 business days. You can’t charge a fee, require the recipient to give you any personally identifying information beyond an email address, or make the recipient take any step other than sending a reply email or visiting a single page on an Internet website as a condition for honoring an opt-out request. Once people have told you they don’t want to receive more messages from you, you can’t sell or transfer their email addresses, even in the form of a mailing list.
To me it seems more of an honor-based system rather than one there's any enforcement for. Much like the Do Not Call list.
I don't care if a spam email has an unsubscribe link or the sender is clearly labelled. Once it's received and seen, the damage is done.
Given that SMTP is a relay system, would the first US-soil SMTP gateway machine a message travels through be its legal "sender" (in the way that e.g. the importer of a foreign medical device is liable if it's not FDA-approved)? One would think this would legally force those gateways, when handling foreign-originated spam, to slap their own address on them with their own unsubscribe link, that would—if clicked—then block those messages from coming through that gateway.
We could always send gunboats to reduce cities whose citizens send unsolicited emails to the U.S. … /s
More seriously, this does seem like the sort of thing which could be addressed through bilateral or multilateral negotiations, including between the private firms who own the international Internet connexions.
Sorry, this is completely false information that is easily verifiable by looking at the wikipedia page for the can spam act: https://en.wikipedia.org/wiki/CAN-SPAM_Act_of_2003#Sending_b...
>But when sending unsolicited commercial emails, it must be stated that the email is an advertisement or a marketing solicitation.
For example, Canada’s Bill C-28¹ explicitly prohibits it.
――――――
¹ — http://www.ctvnews.ca/sci-tech/canada-s-new-anti-spam-law-ap...
> This is really pushing the boundaries of the CAN-SPAM act. You're not allowed to send unsolicited emails.
The USA is not the only country in the world, but the CAN-SPAM act totally permits unsolicited emails, which is the context of this thread.
The US is the only country with a CAN-SPAM Act. Unless Canada has one of those too?
As for what constitutes solicitation, I wish it was that simple. In some instances, companies will buy your email address from another company, and they believe that constitutes consent. In other words, you did business with Company Foo, and I did business with Company Foo, so you consented to do business with me. It's insane.
Having been inside one of these businesses, I have three pieces of advice.
First: Mark spam emails as spam when you see them. You only have to get a few of your messages marked as spam to get your IP address blacklisted. You have far more power over spammers than you think. Not only that, but spammers fear this so much that they keep databases of complainers, and they'll leave you alone in the future. Sometimes they'll even share lists of complainers with other companies so they won't risk your wrath.
Spam companies love non-complainers. Even if you don't open the spam, not complaining helps their numbers with the email provider. By not complaining, you're sending a signal to your email provider that this is a good email, and other users would like to receive it. Not only that, they'll remember you as a person who can be relied upon to not complain, so you'll get more spam than other people.
Second: Read EULAs. We did business with some super-shady companies who sold us tons of really invasive user info. One company even sold us the contents of people's email. Not just meta data, we could actually read the content. They don't mention any of this on their site, but it's subtly stated in the EULA. Read them and check for references to sharing your data with business partners.
I've steered clear of some browsers and email clients as a result of vague EULAs that leave the potential for harvesting my data and selling it.
Third: This one is going to be unpopular on Hackernews, but the best way to avoid being fingerprinted by advertisers is to block JavaScript by default. There are bajillions of ways to uniquely identify your computer, right down to having your browser report which fonts you have installed. Almost every single technique relies on Flash, Java, or JavaScript. Ad-blockers help, but they don't catch everything.
I use NoScript to turn off JavaScript by default, and I only enable a site if it seems legitimate and the site is broken without it.
Here's a terrifying list of the things advertisers can do to uniquely identify you without consent and without a cookie. As the article says, disabling JavaScript by default is by far the most effective method for protecting yourself from fingerprinting: https://wiki.mozilla.org/Fingerprinting
It's a little inconvenient, but good security always is. The locks on your front door are inconvenient (what if you lose your key?), but hopefully they're even more inconvenient for would-be intruders.
Ironically on our rather elderly laptops NoScript actually increases page loading times by a factor of two and that's with the out-of-the-box configuration. I haven't looked to see what pattern-matching algorithms it uses but they're very slow.
Core2 Duo Dell Latitudes.
Leaving aside the sheer amount of stuff this will break, you're serving to identify yourself in another way, but perhaps not to an advertiser.
Given the average website, the number of people using a real web browser (i.e. not bots, curl, wget, etc) who don't run JS is going to be absolutely miniscule.
It's kind of like turning on Do Not Track - most people have it off, so you're highlighting yourself by turning it on.
We have passed a tipping point where all the annoying bullshit that depends on JavaScript to function far outnumbers the random websites that NoScript breaks. LONG time user of it and I just don't have much trouble browsing. It makes the web insanely fast and eliminates most annoyances.
I've been using uMatrix for some time (I'm a control freak, I guess) and I support this - you end up whitelisting a few sites here and there (or even just some aspects of those sites, in case of uMatrix), and the Internet becomes overall a much better (and faster) place. The amount of useless JS bloat on-line is staggering, and it hurts me that developers are actually defending this practice. Engineers should know better.
If you turn it off, they can put you into the "disabled javascript" pool of users. So what?
But if you keep it on, they can query half a dozen APIs and get a much more detailed configuration of your browser. Which lets them put you into a much smaller pool and identify you more confidently.
I've been surfing forever with noscript, only white listing those domains I need.
Exploding cookies (the add on, not the terrorist device), and an ad blocker, and the internet is quite usable.
It can make the web more usable than globally disabling javascript.
> § 17529.2. Notwithstanding any other provision of law, a person or entity may not do any of the following:
> (a) Initiate or advertise in an unsolicited commercial e-mail advertisement from California or advertise in an unsolicited commercial e-mail advertisement sent from California.
> (b) Initiate or advertise in an unsolicited commercial e-mail advertisement to a California electronic mail address, or advertise in an unsolicited commercial e-mail advertisement sent to a California electronic mail address.
> (c) The provisions of this section are severable. If any provision of this section or its application is held invalid, that invalidity shall not affect any other provision or application that can be given effect without the invalid provision or application.
tl;dr You may not send unsolicited commercial email to California residents. You are also barred from sending unsolicited commercial email from within the state of California, but this is independent of the first part.
Did you look for a new job as soon as you knew?
Edit: I misunderstood the mechanism of collecting the addresses. This isn't skirting "unsolicited mail", but it is circumventing the ban on harvested email addresses.