UnsubCentral  Service Overview

Privacy Futures Symposium June 2004

The CAN-SPAM Act It doesn’t change much for legitimate marketers.

The CAN-SPAM Act Clear rules for marketers –No deceptive or fraudulent tactics –Must include physical address –Must include opt-out link for Advertiser Stops the frivolous law suits –Clearly assigns liability to the Advertiser –Clearly defines who can enforce this – the FTC, Attorneys General, and the ISPs

One thing does change… New requirements for Advertisers –Creating a centralized suppression list –Providing suppression lists to affiliates –Updating suppression list with new opt- out requests New Data Challenges –Integrating across sales channels –Maintaining data privacy & security

Not just bulk mail… CAN-SPAM applies to all commercial messages, not just bulk ones –Viral marketing –Independent sales force –In-house newsletter –Auction notifications –Online communities – dating / networking –Forward-to-Friend

Not so clear… Newsletters –What is the primary purpose? –Does having an advertisement = commercial? Single / Multiple Advertisers –Show one unsubscribe link or multiple? –Does unsubscribing apply to each Advertiser? Postal Address –Are PO Boxes and Mail Drops acceptable? –Can it be displayed as part of an image?

Multi-Channel Integration

New Processes Create the Initial List –Look for sources across your organization –Internal database –3 rd party vendors Keeping it Up-to-Date Create channels for… –Tech support –Customer service –Sales people –Website forms –3 rd party vendors

New Processes Share with Partners, Affiliates, 3 rd Parties –Internal access control –Control who accesses it –Make sure they use it –Audit trail for all access Filter Outbound SMTP Mail –Channel through common SMTP gateway –Gateway checks against suppression list before sending each message Collect new Optouts –Web-based, one-click unsubscribe page –Track where each optout comes from –Report on optouts by advertiser –Detect optouts received after 10 day deadline –Integrate with list management options

Security List Seeding 1.Register a bunch of domains. 2.Make up unique addresses. 3.Assign a few to each partner and insert them into the suppression file. 4.If you ever receive a message at the seed address, you know exactly who is at fault. MD5 Hashing 1. addresses are encrypted one- way into gobbly-gook. 2.Once encrypted, they cannot be decrypted. 3.Still can be used to compare one list against another. 4.No chance of revealing addresses. Server Based Suppression 1.Maximum security solution 2.Advertiser list maintained by 3 rd party 3.Partner uploads list for cleaning 4.3 rd party performs the suppression and returns the “cleaned” list 5.Entire operation can be MD5 hashed Suppression Relay 1.Ensure that all outbound mail is compliant 2.Stop suppressed s at the MTA 3.Every outbound message is checked against the suppression list.

Auditing Signup Process 1.Save all information you have 2.MINIMUM – , IP address, datestamp, signup URL or action 3.Referrer URL 4.Other environmental information, message trail, or website trail Optout Process 1.Save all information you have 2.MINIMUM – , IP address, datestamp, optout URL or action 3.Channel source – was this optout from an in-house mailing or a partner? Which partner? 4.Other environmental information, message trail, or website trail Sanity Checks 1.Notice if a duplicate optout is received >10 days after the first 2.Notice if a partner accesses a suppression list but then doesn’t generate any optouts 3.Notice if one partner or channel source creates too many optouts Monitor Complaints 1.Monitor your IP space with SpamCop 2.Make it easy for consumers to find you Be Cautious 1.Given the option, take the safe route 2.If in doubt, suppress the address 3.Make sure suppression is timely

Build vs. Buy In-house solutions make sense for organizations –With a single house list –With no marketing partnerships or 3 rd party relationships –With strong IT and development resources Outsourcing has many advantages –3 rd Party Bonded Entity to act as broker between Advertisers and Affiliates –Enhanced security and fraud detection –Integration with A ffiliate Networks and ESPs, API’s for customization –Fast implementation –No internal resources –Low Cost

? Questions

Background Standards Development – Service Provider Coalition (ESPC) Technology Committee –IronPort Bonded Sender Program –Co-author Internet RFC 2369 (1998) creating List-Unsubscribe header Carnegie Mellon University –Computer Science –Information & Decision Systems –Don Jones Entrepreneurship Center Enterprise Award with Distinction Joshua Baer SKYLIST, Inc. –One of first Service Providers –Advanced targeting, tracking, reporting –ISP Management & Deliverability –Partnered with IronPort Systems Trilogy Software Incubator –Trilogy University Bootcamp –Founded IveBeenGood.com / Uberworks, acquired by public company in mid-2000 UnsubCentral, Inc. –Launched in response to CAN-SPAM –Helps Advertisers manage their suppression lists, sales force, and refer-a-friend viral marketing –Custom TRUSTe Review Process Underway industry veteran of almost 10 years Active in recent regulatory development Cross-industry support, leading customer base