Get ready. The spam floodgates are about to open. Wide.

by Bob West
January 19, 2002

The research that went into building this site has uncovered some very nasty information. The number of Clueless Mailers is increasing rapidly... and more seriously, the sharing of unethically-acquired email addresses among Clueless Mailers and their customers is rising fast. In addition, more and more large "legitimate" businesses are being snowed into believing that "single opt-in" is a legitimate way to acquire addresses... and "opt-out spam" is becoming an everyday nuisance.

The most dangerous trend is the sudden popularity of bounties paid for unconfirmed "co-registrations".

"Network marketers" like Freeze and ItsImazing are paying website owners for each email address they submit to a central marketing database. The problem is that these submissions are unconfirmed... or, at best, opt-out. This system actually encourages abuse. It has become apparent that unethical members of these and other pay-for-submission networks are simply buying spamming lists — like the latest "Millions" CD — and gradually submitting address after address via their own websites... then getting paid for doing so. These networks do not require an opt-in confirmation reply from the subscriber's email account (not to mention the use of unique tokens).

Direct e-marketers call this "Permission-based Marketing." But we've coined a term for it that's more accurate:

"Submission-Based Marketing."

(And yes, you can quote us on that. <g> ) The presence of an email address in a database provides absolutely zero indication of the address-owner's wishes. The abuses being committed by the network-marketing "partners" are proof of that. Just because an address is submitted, that doesn't mean the address owner submitted it. Unfortunately, advertisers and e-marketers don't understand this simple fact, or they choose to ignore the truth.

The only way for a mailer to know that the recipient actually wants their mail is to use closed-loop confirmed opt-in. When an email address is submitted for subscription, a confirmation request must be sent to that address. The recipient must then reply to the request to confirm that they want to subscribe. To prevent forgeries, the initial request must cause the system to generate a unique non-guessable token that is sent only to the subscribed address, and that token must be returned with the confirmation reply. If the address and token match the original request, the subscription is completed, and the mailings may begin.

If the recipient sends no confirmation reply, the subscription must be cancelled.

But because the completion rate for this two-step process is lower than that for single opt-in, Clueless Mailers' greed overcomes their sense of responsibility, and they employ Submission-Based Marketing instead.

Many marketers use the term "Confirmed Opt-In". But they are actually employing an opt-out system. These marketers accept an address submission, then send a "confirmation" email to that address. But instead of requiring a confirmation reply from the recipient to complete the subscription process, the email only confirms that they've been subscribed to a list, and demands that the recipient opt-out if they don't want to be spammed. The first spam that arrives would be enough to let a recipient know they'd been subscribed against their will, but the marketers send that first mail just to be able to use the word "confirmed" when selling their mailing lists.

What these mailers/marketers fail to recognize — or choose to ignore — is that a recipient has absolutely no obligation to communicate with them. The burden of proof for the validity of a subscription falls on the mailer, not on the owner of the address.

Some mailer/marketers also talk about "double opt-in". But there are two kinds: systems that use unique tokens, and those that don't. Subscriptions to systems without unique tokens are easy to forge, so the fact that an email address has been submitted to a mailing list "twice" means absolutely nothing.

More and more mailers/marketers are adopting these "worst practices"...accepting unconfirmed address submissions, sending opt-out spam, and sharing addresses with other companies ...thus becoming Clueless Mailers.

Because of these factors, the amount of spam in your inbox is about to increase dramatically.

Network marketers, list managers and data integrators have formed complex partnerships, sharing database access among an increasing number of companies. As these companies grow in size, they and their partners are being acquired by successively larger companies, moving your personal information higher and higher in the food chain. Now, the online marketers that large corporations employ have access to your email address, your name, your street address, and more. The only thing stopping the largest of corporations from spamming you is their fear of public opinion. But their self-restraint won't last long.

The real spam explosion will come when large corporations give in to the marketers.

And that explosion is coming soon.

I'm predicting that unless consumers complain publicly and loudly about this situation, Submission-Based Marketing will make the mailboxes of most Internet users virtually unusable within the next 6 to 9 months... a year if we're lucky.

What can you do?

Complaining to the marketers does no good. If they respond at all, they only ask you to hand over your email address for unsubscription. That, of course, won't help a thing. Demands for unsubscription are a form of extortion; surrendering your address to a spammer is like giving your social security number to an identity thief. On the other hand, some mailer/marketers are actually ethical— just clueless. But there's no way to know which mailers are trustworthy. And your email address is already — and continues to be — so widely and rapidly distributed that the number of Clueless Mailers spamming you will begin to increase much faster than you can — or care to — unsubscribe from their lists. Spammers only understand pressure from outside their organizations. But...

Complaining to the ISPs and web hosts of these marketers does no good. ISPs and hosts have proven unwilling to enforce their own abuse policies when it comes to their larger clients. Abuse reports sent to Exodus, Verio and other large providers are being ignored. So...

The only effective thing left to do is to complain to the advertisers. Keep on complaining to the marketers and the service providers, since a large enough volume of complaints might get their attention. But if large advertisers are told that what they're doing is unethical and irresponsible — and that you won't do business with companies that spam — maybe they'll wake up and smell the potted meat product.

The spam problem is going to get much, much worse before it gets better... if it ever does. If you report spam, keep reporting. If you don't, start. Write and call the well-known advertisers. And if you're of the opinion — as I am — that legislation is necessary, write to your congressman and senator. Let them know that closed-loop opt-in confirmation is a must, and that opt-out is not an option.

Good luck to all spam victims!

All Contents of this Website are © Copyright 2002-2003, Robert M. West, All Rights Reserved.
More Legal Info