Law / United States / 
Michigan
Unsolicited Commercial E-mail Protection Act
MCL 445.2501, 445.2503, 445.2504, 445.2505, 445.2507, 445.2508
In force since .
A commercial messages rule binding public and private bodies.
- Obligation class
- Disclosure, Prohibition
What it requires
- Do not use a third party's internet domain name or e-mail address in identifying the point of origin or transmission path of a commercial e-mail without that third party's consent, misrepresent that information, or fail to include the information necessary to identify the point of origin.no control in the NIST Privacy Framework
- Once a recipient notifies you that they do not want to receive further unsolicited commercial e-mail, do not send that recipient further unsolicited commercial e-mail, directly or through a third party, and keep policies and records, updated at least every 14 business days, so that the recipient receives none from the date of the notice.NIST Privacy FrameworkCT.PO-P3
- Do not sell, give, distribute, or possess with intent to sell, give or distribute, software primarily designed, of only limited other commercially significant use, or marketed for falsifying commercial e-mail transmission or routing information.no control in the NIST Privacy Framework
- A commercial e-mail you intentionally send unsolicited through an e-mail service provider you knew or should have known is located in Michigan, or to an address you knew or should have known is held by a Michigan resident, must carry "ADV:" as the first four characters of the subject line, your legal name, correct street address, valid domain name and valid return e-mail address, and a toll-free number, return e-mail address or other easy electronic method the recipient can use to opt out, with a notice of it in print as large as most of the message; this labeling, identification and opt-out duty is not framed as a rule against falsity or deception.NIST Privacy FrameworkCM.AW-P1NIST Privacy FrameworkCT.PO-P3
- An e-mail sent with the recipient's express permission, to someone with whom you have a preexisting business or personal relationship, or received because the recipient opted into a system to receive promotional material is not unsolicited.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- CT.PO-P3Policies, processes, and procedures for enabling individuals’ data processing preferences and requests are established and in place.
- CM.AW-P1Mechanisms (e.g., notices, internal or public reports) for communicating data processing purposes, practices, associated privacy risks, and options for enabling individuals’ data processing preferences and requests are established and in place.
- FINOS AIGF
- AIR-PREV-005System Acceptance Testing
- AIR-DET-021Agent Decision Audit and Explainability
Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
If you get it wrong
Criminal exposureYes
Private right of actionYes
Criminal exposure note
A violation of the act is ordinarily a misdemeanor punishable by imprisonment for not more than 1 year or a fine of not more than $10,000, or both. A person who violates the anti-falsification section (concerning falsified or misrepresented transmission or routing information) or who violates the act in furtherance of another crime is guilty of a felony punishable by imprisonment for not more than 4 years or a fine of not more than $25,000, or both.
Penalty structure
A person who violates section 4 or violates the act in the furtherance of another crime is guilty of a felony punishable by imprisonment for not more than 4 years or a fine of not more than $25,000, or both. Any other violation is a misdemeanor punishable by imprisonment for not more than 1 year or a fine of not more than $10,000, or both. Each commercial e-mail sent in violation of the act is a separate violation.
- Rule
- Per violation only
- As of
- Currency
- USD
- Per violation unit
- Violation
- Per violation amount
- 25,000
Statutory damages
In lieu of actual damages, a recipient, e-mail service provider or the attorney general may recover the lesser of $500 for each unsolicited commercial e-mail received or transmitted, or $250,000 for each day the violation occurs; a prevailing recipient or e-mail service provider also recovers actual costs and reasonable attorney fees. Each commercial e-mail sent in violation of the act is a separate violation.
- As of
- Currency
- USD
Who enforces it
Enforcement body
A civil action by a recipient, an e-mail service provider, or the attorney general under MCL 445.2508; criminal prosecution under MCL 445.2507.
Settledness
- As of
- Open questions
- Does a relationship with an affiliate of the sender amount to a 'preexisting business relationship' under MCL 445.2502(g), which is one 'formed voluntarily by the recipient with another person by means of an inquiry, application, purchase, or use of a product or service of the person sending the e-mail'?
What this law does
A person who intentionally sends an unsolicited commercial e-mail through an e-mail service provider the sender knew or should have known is located in Michigan, or to an address the sender knew or should have known is held by a Michigan resident, must begin its subject line with "ADV:", conspicuously state the sender's legal name, correct street address, valid domain name and valid return e-mail address, and provide a toll-free number, return e-mail address or other easy electronic method to opt out, with a notice of it in print as large as most of the message.
Unsolicited means without the recipient's express permission, and an e-mail is not unsolicited if the sender has a preexisting business or personal relationship with the recipient or the recipient opted into a system to receive promotional material.
A sender of unsolicited commercial e-mail through a Michigan provider or to a Michigan resident's address must not use a third party's domain name or e-mail address to identify the message's point of origin or transmission path without consent, misrepresent that information, or omit the information needed to identify the point of origin.
Once a recipient tells the sender they do not want future unsolicited commercial e-mail, the sender must not send them any, directly or through a third party, and must keep policies and records, updated at least every 14 business days, so that the recipient receives none from the date of the notice.
The origin and transmission-path prohibitions are framed as rules against falsity or deception, the kind of state email rule the CAN-SPAM Act's preemption clause leaves in force; the labeling, identification and opt-out duties are not framed that way.
A person must not knowingly sell, give, distribute or possess with intent to distribute software primarily designed, of only limited other commercially significant use, or marketed to enable falsifying commercial e-mail transmission or routing information.
A violation is a misdemeanor, and a violation of section 4, which holds the origin and path prohibitions and the opt-out-honoring duty, or of the act in furtherance of another crime is a felony; each commercial e-mail sent in violation is a separate violation. It is a defense that the e-mail was transmitted accidentally or as a result of a preexisting business relationship, which the sender must prove.
A recipient, an e-mail service provider through whose facilities the e-mail passed, or the attorney general may recover actual damages or, in lieu of actual damages, the lesser of $500 for each unsolicited commercial e-mail or $250,000 for each day the violation occurs, and a prevailing recipient or e-mail service provider also recovers actual costs and reasonable attorney fees.
An e-mail service provider does not violate the act by acting as an intermediary in, or providing, the transmission of an unsolicited commercial e-mail that violates it. Person is defined to include a governmental entity as well as an individual, corporation, partnership or association.
When LexLint raises it
When your app profile says your app sends commercial email.
Back to the example · Lint your app
Page updated .