As part of a continuing series on compliance issues in the affiliate marketing industry, this week we are addressing the issue of suppression lists. Suppression lists are the lists which every company must keep of individuals who have unsubscribed from receiving offers. So much has been written about the CAN SPAM Act, that I’ll leave the “how to comply with CAN SPAM” to others. Instead, we’ll be discussing how individual companies handle and distribute their suppression lists.
For starters, it's important to note that suppression lists are highly valuable to the bad guy mailers in our industry. In terms of deliverability and legitimacy of e-mail addresses, what could be better than a list of the addresses which people have submitted requesting to be removed from someone's mailings? The short answer is, almost nothing. These lists are coveted by those who would mail to them (usually from a server in someplace like Mongolia). While such a practice might seem horrifying to those of us who play according to the rules, there are many unscrupulous mailers who would love to get their hands on your suppression list. So what do companies do to protect this asset?
You may have noted that I called a suppression list an "asset." While it may not have intrinsic or revenue producing value to your company, certainly others who would misuse your list consider it a valuable "asset" and you need to protect it with that in mind. While it may not produce revenue for you, should it fall into the wrong hands and be misused, it can cost you dearly. Do you really want to deal with the complaints and fallout and potential Spamhaus listings that can come from the misuse of your list? I didn't think so.
So, how can you be sure that you're handling your suppression list in a safe manner? Let's start with some of the major mistakes that I see companies making with their suppression lists.
E-mailing Suppression List Files. It's unfortunate in this day and age, but I still see companies passing their suppression lists to affiliates via unencrypted attachments to e-mails. This is exceptionally risky behavior. You simply shouldn't do this.
Sending Suppression Lists via Unsecured FTP. Again, this is very risky behavior and shouldn't be done.
Updating Suppression Lists via "Delta” or "Change" Files. Some mailers will request to receive only the suppression list records added to a list since the last time they received it. While I realize that it might be easier for them to process the small change files, this approach is fraught with inherent risk. In the event that there is a technology failure or human error, and they miss even a single update, they will never be able to recapture the portion of the suppression list which they have missed. This means that they will absolutely be mailing to people who have requested to be removed. That is a clear violation of the CAN SPAM Act, and just poor business practice. On the flipside, if a company demands a complete suppression list on a regular basis (I suggest no less than every three days) in the event of a human or technology failure, they will not be caught in the same position. As each list is a complete list, they will have all the unsubscribe data they need to be in compliance.
There are many ways to safely handle opt outs and suppression lists. But as always, I'm going to make a suggestion for those who are interested in what I consider the best solution. UnsubCentral, Inc. (www.unsubcentral.com) offers advertisers and affiliates global CAN-SPAM suppression list management solutions including Truste-Certified third party unsubscribe list cleansing, seamless integration with email service providers, 100% CAN-SPAM compliance monitoring with Lashback integration, and multiple suppression list distribution and cleansing options. Through the use of UnsubCentral I can always be sure that my opt-outs are handled properly, and that the transfer of suppression lists is handled according to industry best practices. When deciding whether to do business with another company, one of the factors we always consider is whether that company as a customer of UnsubCentral. I find that companies who actively work with UnsubCentral are generally trustworthy in regard to compliance issues.
Just be clear, there are plenty of companies who have home-grown technology for dealing with suppression lists and opt-outs. And many of them handle these important assets safely and effectively. But beware, and be informed. Make sure you and the companies you do business with are handling suppression lists as the valuable assets they are.
---------------------------------------------------------------
Come back to the iLegal column every week as we get specific about the rules, regulations, laws and trends that affect the online advertising industry. Each week we discuss important legal issues, talk about how to avoid the pitfalls, and cover the breaking legal and regulatory advertising industry news.
Legal Disclaimer: Information conveyed in this column is provided for informational purposes only and does not constitute legal advice. These materials do not necessarily reflect the opinions of Digital Moses, and is not guaranteed to be complete, correct, or up-to-date. The column is provided for "information purposes" only and should not be relied upon as "legal advice." This information is not intended to substitute for obtaining legal advice from an attorney. No person should act or rely on any information in this column without seeking the advice of an attorney.
Mark Meckler is the General Counsel for UniqueLeads.com, Inc., and Unique Lists, Inc. Mark is the Vice Chair of the eCommerce and Technology Committee of the Association of Corporate Counsel, and is a member of the International Association of Privacy Professionals. www.UniqueLeads.com
Copyright 2008 Mark J. Meckler
Digg 
