Gordon v. Virtumundo, Inc.

To set up his spam-suit business, Gordon, through Omni, leased server space from GoDaddy, a domain registrar and web hosting company. He then used the server space to host his own domain name, gordonworks.com, and to create email addresses for himself and several friends and family members using his domain name.[1]

Gordon registered the gordonworks.com email addresses for online promotions, eventually joining between 100 and 150 email mailing lists. As a result, the accounts received thousands of spam emails. Gordon took control of the accounts, instructing his friends and family to create their own domain names and new email addresses on Omni's server space. He then configured the old gordonworks.com addresses to respond to commercial emails with an automated message - a "contract" by which senders agreed to stop sending spam or pay $500 for each new piece of unsolicited commercial email.[1]

In 2004, after the spam did not stop, Gordon and Omni began to sue the companies that had sent spam to the email addresses on Omni's server space.[1] Omni generated no revenue except for settlement agreements in these spam-related lawsuits.[1]

The CAN-SPAM Act primarily provides for government actors (the Federal Trade Commission and state attorneys general) to enforce its provisions, however Section 7706(g) of the Act creates a limited private cause of action for "provider[s] of Internet access service adversely affected by a violation of" the act.[2] To address the standing issue, the Court of Appeals therefore needed to assess whether Omni was an Internet Access Service ("IAS") provider, and (2) whether it had been "adversely affected" within the meaning of the statute.

The court first addressed the issue of whether or not Omni was an IAS provider. Section 7702 of the CAN-SPAM Act defines "Internet access service" by reference to 47 U.S.C. § 231,[9] which states:

To interpret this definition, the court first attempted to determine Congress's intent, and it concluded that Congress had intended the private cause of action to be very narrowly construed. The court noted that Congress could not have contemplated the complete eradication of spam through broad private action because the text of the CAN-SPAM Act explicitly recognizes that "[e]lectronic mail has become an extremely important and popular means of communication". Although the court held that the definition of IAS provider was not limited to traditional internet service providers (ISP), providing email accounts alone, as Gordon and Omni had done, was not sufficient to satisfy the statutory definition. The court declined to state exactly what more would be needed, but it noted that GoDaddy.com - which retained physical control over the server hardware - and Verizon - the internet service provider that enabled Gordon's access to the internet - would "have a compelling argument that they are IAS providers."[1]

In addition, the legislative history indicated that Congress only intended the private cause of action to extend to "bona fide IAS providers" suffering spam-related network slowdowns or other technical difficulties as opposed to opportunistic plaintiffs suing to profit from awards of statutory damages.[1]

The court went on to address whether or not Omni had been "adversely affected" by Virtumundo's spam. Although the CAN-SPAM Act does not specify the meaning of "adversely affected", the court held that the statute required "network crashes, higher bandwidth utilization, and increased costs for hardware and software upgrades, network expansion and additional personnel";[1] in other words, harms that might be experienced by typical internet service providers, not the mere inconvenience of ordinary email consumers. Since Omni had not experienced any of these problems, and had actually profited from the spam through lawsuit settlements, it had not been "adversely affected".[1]

Next, the court addressed whether Gordon and Omni's remaining state law claims were preempted by the CAN-SPAM Act's express preemption clause, contained within 15 U.S.C. § 7707(b):

Pursuant to this clause, the CAN-SPAM Act preempts any state regulation of commercial electronic messages, "except to the extent that any statute ... prohibits falsity or deception." The question before the Court of Appeals was the scope of this exception. The court looked first to the dictionary definitions of "deception" and "falsity", and found that deception could easily be defined as referring to "something more than immaterial inaccuracies or inadvertent mistakes"; in other words material misrepresentation or fraud. However, the definition of falsity was ambiguous.[1]

To interpret the term "falsity", the court again looked to the CAN-SPAM Act's text and legislative history to determine Congressional intent. The legislative history indicated that Congress had intended the CAN-SPAM Act to be the national standard for the regulation of commercial email in order to spare businesses from having to deal with different standards in the fifty states. In addition, the language immediately following the preemption clause provides that the CAN-SPAM Act does not preempt "(A) State laws that are not specific to electronic mail, including State trespass, contract, or tort law; or (B) other State laws to the extent that those laws relate to acts of fraud or computer crime."[1]

From these facts, the court concluded that Congress intended for the "falsity" and "deception" exception to be read narrowly. States should be allowed to "extend traditional tort theories such as claims arising from fraud or deception to commercial e-mail communication", but no more. Thus state law claims based on immaterial misrepresentations would be preempted by the CAN-SPAM Act, though a state law claim of fraud would survive. Applying this to Gordon and Omni's case, the court concluded that Gordon and Omni's Washington CEMA and Washington CPA claims were preempted because Gordon and Omni had not alleged facts that rose to the level of "falsity or deception" within the meaning of the CAN-SPAM Act.[1]