The first thing to worry about is standing. If your client is hoping to bring claims under the CAN-SPAM Act, it will be necessary to demonstrate (1) status as an "internet access service" provider and (2) an adverse effect from specific spamming activities that are of a specific type that would be suffered by an internet service provider. In practical terms, these standards are very high: the client should be hosting its own ISP-like services, should offer more services than just email, and should be able to trace very specific ISP-like harms to specific spamming activity. See Gordon v. Virtumundo, 575 F.3d 1040 (9th Cir. 2009). See also:
- Who Can Sue Under the CAN-SPAM Act?
- CAN-SPAM Act of 2003: Private Right of Action for "Internet Access Service" Providers
- Susuk Lim, Death of the SPAM Wrangler: CAN-SPAM Private Plaintiffs Required to Show Actual Harm, 6 Wash. J.L. Tech. & Arts 155 (2010)
*Practical considerations in showing an "adverse effect": Courts will want to see evidence of time and money spent dealing with spam, beyond the routine costs of running a mail server.Anti-spam measures are typically bundled into email packages, so it will be important to show time, resources, and expense involved in going beyond these measures, e.g., time spent handling user complaints.
*Practical considerations in causally connecting the spam to your defendant: Defendants will challenge the details of your case, arguing that the email wasn't properly preserved, that someone else sent it trying to frame them, that an affiliate wasn't mailing on the defendant's behalf, etc. Be prepared to counter these challenges with detailed evidence. With a large number of different entities that could possibly be in different locations, it can be difficult to determine who sent the email and who is responsible for the sender (e.g. was the sender an employee or independent contractor?). Obtaining the agreements governing these arrangements will be a priority for discovery.
If you're comfortable you can cross the standing hurdle, you might worry about personal jurisdiction. Whether your claims are being made under the CAN-SPAM Act, state anti-spam laws, or both, you will need to demonstrate that the defendant(s) had significant contacts with the forum. The defendant(s) may argue that minimal contacts with the forum, e.g. maintaining a website address in the forum, are inadequate. See, e.g., Beyond Systems v. Realtime Gaming, 878 A.2d 567 (Md. 2005). You may be able to argue, on the other hand, that the act of sending emails within the forum jurisdiction was sufficient. See, however, Fenn v. MLeads Enterprises (Utah 2005).
*Practical considerations in establishing personal jurisdiction: Plaintiffs usually file in the jurisdiction where the email system is located, making the contacts obvious.The defendants may try to have the case removed to another court, but that's a separate issue.
Other potential issues include:
- Establishing that your client didn't consent to receiving emails from the defendant(s)
- The types of remedies to be pursued (damages, injunction, etc.)