RFC 3098

How to Advertise Responsibly Using E-Mail and Newsgroups ✨

or - how NOT to $$$$$ MAKE ENEMIES FAST! $$$$$ 💅

okay bestie, this one is an RFC 🎀 It's RFC 3098, and it was published as an FYI document (FYI 38) in the Network Working Group in April 2001. The category is Informational, which means it shares information with the Internet community and isn't a standard. The authors are T. Gavin (Nachman Hays Consulting), D. Eastlake 3rd (Motorola), and S. Hambridge (Intel). Its header doesn't list any Obsoletes or Updates, so it's not replacing or changing any other document. 🦋

Status of this Memo 📝

This memo gives information to the Internet community. It is not an Internet standard of any kind. Distribution of this memo is unlimited. 🌸

Copyright Notice ©️

Copyright (C) The Internet Society (2001). All Rights Reserved. 💜

Abstract ✨

This memo has some useful tips for responsible advertising on the internet, in a space where advertisers, recipients, and the whole Internet Community can coexist in a productive and mutually respectful way. It also adds some clarity to the definitions, dangers, and details that come with Internet Marketing. 🧚

Table of Contents 📚

1.  Introduction ..............................................  2
2.  Image and Perception of the Advertiser.....................  4
3.  Collateral Damage .........................................  5
4.  Caveat Mercator ...........................................  5
5.  Targeting the Audience ....................................  7
6.  Reaching the audience .....................................  8
    A.   Dedicated website or web page ........................  8
    B.   "Shared" Advertising website .........................  9
    C.   Netnews and E-Mailing list group postings ............ 10
    D.   Compiled E-Mail Lists ................................ 11
7.  Opt-In Mailing Lists ...................................... 12
    A. Privacy ................................................ 13
    B. Integrity .............................................. 13
    C. Protection ............................................. 16

8.  Irresponsible Behavior .................................... 16
9.  Responsible Behavior ...................................... 17
10. Security Considerations ................................... 19
Appendices .................................................... 20
  A.1  The classic Pyramid .................................... 20
  A.2  What about Ponzi? ...................................... 22
  A.3  So all multi-levels are evil? .......................... 22
  B.1  Why Web Privacy? ....................................... 23
References .................................................... 25
Authors' Addresses ............................................ 26
Acknowledgments and Significant Contributors .................  27
Full Copyright Statement ...................................... 28

1. Introduction 🌍

okay so the Internet is NOT a free resource, bestie 💀 Being online and having a presence on the 'Net costs the participants, the service provider, and the recipients of whatever the Internet makes available. The internet got way more accessible, so users can now reach an unprecedented number of people. 🤯 Because the 'Net went fully mainstream and kept growing, new ways to spread information to the huge and ever-growing community of Internet users popped up. 📈

Some groups and individuals use the 'Net for stuff it was never meant for, which goes against what both the practitioners and the unwilling recipients agree on. 🙅‍♀️ The practice we're talking about is sending Unsolicited Commercial and Bulk E-Mail messages, posting to Netnews groups, or other unsolicited electronic communication. This has made the Internet community wake up and pay attention. 👀

There are some stereotypes we need to clear up before we keep going. Not everyone who's new to the Internet is clueless about the 'Net's history and evolution, or its proper and ethical uses. And not all the experienced, long-term Netizens are against using the Internet for advertising, marketing, or other business purposes. 🫶 Where these two groups agree is that they're both against using the Internet in irresponsible ways. Some of these irresponsible uses include, but are not limited to, sending Unsolicited Bulk or Commercial E-Mail to mailing lists, individuals, or netnews groups. People call this activity "spamming" (sending "spam" [1]). To get why this stuff is irresponsible, you have to first understand the real cost and the consequences of these actions. 🧠

The protocols and architecture the 'Net is built on are recognized and followed as standards, and they give us openness and availability that make communication easy. 🔓

Those standards were written at a time when nobody needed to think about the idea of "rejecting" information. Even though the standards have evolved, they still focus on open communication. Because of that, they don't attach costs or impact to the user-initiated activities that might happen. 🤷‍♀️ Since this openness exists, people can send large volumes of E-Mail with little to no cost or financial impact for the number of messages sent. Honestly, this is super tempting for anyone thinking about it, because it multiplies the recipients of their marketing material and, presumably, boosts their success rate. 📬 But, to repeat something said earlier in this text, there is a cost to this communication relationship, and it shows up at some point. For E-Mail advertising, the sender's cost of operation doesn't go up, so the cost has to go up on the recipient's side. 💸

And it does! 😭 Every recipient of every E-Mail message pays a cost, either directly (cost per message received, or an increase in connection charges) or indirectly (higher service fees to cover the infrastructure costs of the extra 'Net traffic that mass-mailings create). On top of that, other resources like the recipient's disk space and time get used up too. ⏳

Recipients can't control whether they get these messages, so those costs land on them involuntarily and without consent. 🚫 That's the root of the Internet Community's view that sending spam is a willful theft of service, money, and/or resources. 💅 Some people focus on indirect resources instead of the financial impact, and they've been known to call spam "Internet Pollution". 🌫️

The Internet is a huge opportunity for businesses, big and small. There's definitely money to be made using the 'Net as a resource. 💖 This paper recommends practices and ways to use the Internet that are NOT parasitic, meaning they won't, just by existing, invite automatic opposition, litigation, or other negative stuff. 🙌 It doesn't promise that you'll be totally free of those or other negative responses, though. Instead, it gives the reader a framework so the marketer/advertiser, the 'Net community, and (most importantly) the seller's target market can coexist as well as possible. 🌈

2. Image and Perception of the Advertiser 🪞

Okay, I know it can look financially attractive to advertise through Mass-Messaging ("spam"), but as a responsible Internet user, ADVERTISERS SHOULD AVOID THIS OPTION 🚫 The chance of making income or expanding your market or business is tiny compared to the risks:

• The alienation of the vast majority of the recipients of an advertising message [2][3]
• The damage or loss of credibility in the advertiser's market [2]
• Loss in advertiser's and/or seller's Internet connectivity (most service providers have strict "zero tolerance" policies which prohibit the use of their systems for the sending of spam, or for encouraging or enabling such activities)
• Civil and Criminal litigation. In the United States, (and progressively in other sovereign states), it has become accepted as fact that the theft-of-service associated with spamming often constitutes an unlawful use of private property and is actionable as trespass to chattels (a civil law term tantamount to "theft") in civil court [4][5][6][7] [8].

It's a fundamental rule for any Internet presence that a party is responsible for their Internet "image", or the persona they create. 🎭 If an advertiser sells a product that lots of people love, and they haven't annoyed, offended, or angered a way bigger number of uninterested recipients, that advertiser could be seen as a hero 👑 But if an advertiser blasts their product to millions of uninterested people, at those people's expense, they'll get labeled a "spammer", a thief, or other less flattering names. 💀 The advertiser is on the hook for those actions and for how they play out in the marketplace, which, let's be real, is the 'Net community. 🫠

"On the Internet, nobody knows you're a dog." [9] That was the caption on an illustration published in the 1990s. 🐶 The point is clear: the Internet makes everyone anonymous. The ways people sell stuff in traditional sales channels, like language, image, relationships, eye contact, or body language, don't work when you're measuring an Internet sale. Reputation, reliability, honesty, trustworthiness, and integrity have taken over from the more direct sales approaches used before. ✨ These get shaped by how fast both information and misinformation spread on the Internet. Just like Internet users can't control what messages get sent to them, Internet marketers can't control the information that gets spread about them or their activities. 😤 Some information will circulate that isn't accurate, and sometimes there will be info floating around that's just flat-out wrong. But a successful market reputation built on ethical behavior will make the inevitable piece of misinformation meaningless. 🔥 For an advertiser to exist responsibly on the Internet, the advertiser and the seller have to take active responsibility for their actions. 💖

3. Collateral Damage 💅

okay so bestie, this paper already pointed out that sending spam is basically asking for a big pile of drama 😭 like, a LOT of angry reactions get aimed at the advertiser and/or the seller. death threats, lawsuits, and revenge moves are literally commonplace 💀 so, for these reasons, "spammers" (especially the entities running mass-mailing services for other businesses) will usually go to great lengths to stay anonymous 🙈 and those hide-my-identity moves come in a few flavors, including:

• Forging the sender name, domain name, or IP Address of the sender (called "spoofing") 🎭
• Sending messages through any type of hardware, software or system which belongs to an uninvolved third-party (called "relaying") 🫣

ngl, each of these things, plus a bunch of others, are criminal acts in many countries 🚨 it's unethical to use the resources of any other party without their express permission, period 🫶 doing it breaks the laws of lots of jurisdictions and international agreements, and offenders have literally been successfully prosecuted in numerous jurisdictions ⚖️ not a vibe.

---

4. Caveat Mercator 🔥

"Let the Seller beware." 👀 Advertisers and Sellers can be held responsible for how appropriate (or inappropriate) their messages are when they land in the inboxes of the people they were sent to. so, for this reason, every prospective advertiser MUST first be absolutely certain that their recipients are appropriate 🌸 for example, an ad containing a link to a site with overtly sexual content can cause a whole lot of undesirable outcomes:

• In many countries, providing such material to under-age minors is a crime. As the provider of the link, the advertiser's position is tenuous. 😬
• In some countries, such material is a crime to view, possess, or distribute ("trafficking"). As the website owner or advertiser, a party engaging in such activities must consider the ramifications of international law. 🌍

to prevent that risk, advertisers SHOULD qualify the recipients of their advertising. however, it has to be noted that E-Mail addresses provide little useful information for that purpose 🙃 remember, "On the Internet, nobody knows you're a dog." 🐶 advertisers will have no way to qualify a prospective recipient as an adult with complete discretionary and plenipotentiary authority 💀 so basically, an ad targeting a high-income crowd looking for property investment could end up in the inbox of a group of school children. or a dog. 🐕

so how does the prospective advertiser/seller figure out the quality of their leads? the essential requirement is that the advertiser "know" their audience 🧠✨

okay, here's the tea: leads that are developed and generated by the advertiser who will actually use them are the most valuable 💎 there's an inherent value in collecting the data first-hand, because by collecting it directly from the prospective recipient, the advertiser can hit two big goals:

• The advertiser ensures that the recipient is genuinely interested in receiving information. Thus, the advertiser can protect themselves from the negative impact of sending Unsolicited E-Mail ("spam"). 🛡️
• The advertiser maintains the ability to "pre-qualify" the lead. One interested lead is worth more, from a sales and marketing perspective, than millions of actively uninterested potential recipients. 🤩

if an advertiser has an active website or uses other mass-marketing tools (like direct-mail), and they're interested in pursuing Internet Advertising, they can add a mechanism to gather sales lead data in a relatively simple way 📬 from the perspective of Responsible Use, the only such mechanism discussed in this text will be the "Opt-In" concept, which we'll get into in detail later in this document 🎀

whatever way the information gets gathered, there are certain steps the advertiser MUST follow. the advertiser MUST inform the person that data is being collected. on top of that, the reason why the information is being collected MUST be clearly stated. BE AWARE! 🚩 there are jurisdictions which restrict the collection of Personal Data 🔒 the laws about collecting and future handling of Personal Information vary from place to place, so advertisers MUST take steps to understand those laws 📚

prudence should be the advertiser's guide 🧚 if an advertiser is unsure about the applicability or legality of an action, in the jurisdiction of the advertiser OR that of the recipients, the action MUST be avoided entirely 🚫 advertisers would be well advised to realize that if they engage in spamming, they will inevitably break the laws of some jurisdiction, somewhere 🌈

---

5. Targeting the Audience 🦋

advertisers have something to sell 🛍️ it might be a product, a service, or some other tangible or intangible item. and of course, the advertiser needs to get the word out to the market, quickly ⚡ after all, neither the seller nor the advertiser is making sales and earning profits if nobody is buying the product 💸 however, before advertisers can advertise the product, they MUST first determine WHOM the product will be advertised to 🎯

there are a few things to consider when answering that question. this text has already covered how sending Unsolicited Commercial E-Mail ("spam") can cause a bunch of negative effects 😤 plus, numerous surveys cited here show that the vast majority of publicly-available mailing lists and Netnews groups similarly abhor spam 🙅‍♀️ the advertiser's first step should always be figuring out which avenues are appropriate for advertising. then, advertisers MUST determine which avenues are appropriate for EACH SPECIFIC ADVERTISEMENT 💖 advertisers have to figure out which Netnews groups accept ads, and then, of those, which groups cover a topic the proposed advertising is relevant to. the same work should be done for mailing lists 📋 advertisers should take some comfort in the fact that there are Netnews groups and mailing lists which welcome advertising 🥰 finding them is a worthwhile investment of the advertiser's time and resources 💜

for help locating those advertising-friendly websites, mailing lists, and Netnews groups, advertisers can consult existing ethical and responsible Internet advertisers 🤝 alternatively, any low- or no-cost research resource or search engine can be used to find those groups and lists 🔍 BUT UNDER NO CIRCUMSTANCES SHOULD AN ADVERTISER PURCHASE A MAILING LIST AND START MAILING! 🙅‍♀️💀 there are other reasons which will be addressed further into this document, but engaging in that kind of activity opens the advertiser up to the liabilities and negative ramifications already mentioned 😭 those negative conditions cost the seller/advertiser more when the risks (loss of connectivity, defense against litigation, avoiding discovery, etc...) are factored into the advertiser's overall operation 📉 in short, it's in the best interests of the seller and advertiser to make sure the proper audience is targeted before any further steps 🫶✨

6. Reaching the audience ✨

okay so once the advertiser has picked a target market for a specific ad, they have to choose how to actually reach those people 📣 there are SO many ways to do that, so this doc only looks at the ones that fit with using the Internet ethically 🫶 of those, these are the relevant ones to check out (ranked by how desirable and effective they are):

• A dedicated website or web page 🌸
• Ad placed on a "shared" advertising site 🛍️ (that's a page that's already up and already has people who've shown they might be into certain kinds of products). These can be text, links, "Click-Through Banners", or other stuff.
• Netnews posting 📰
• Targeted E-Mail messages 💌

bestie, real talk: any kind of blind broadcast ad that doesn't target who's getting it is NOT considered responsible behavior 🙅‍♀️💅

once the advertiser has picked their medium, there are key points to think about for each one 🧚

A. Dedicated website or web page

advertisers can make their own dedicated website, or just a page inside another site 🌷 if the advertiser isn't sure how to build a site technically, there are tons of resources out there 🙌 from free stuff like instructional websites, to low-cost options like books, videotapes or classes, to full-service businesses and consultants who can help at every step of the website or web page design, setup, and hosting process (or just whichever part they need) 💖 there is literally a solution for every kind of site and every budget ✨

B. "Shared" Advertising website

advertisers can also put their ads on a website run by a third party 🛒 for advertisers who need to get stuff out fast, these sites (also called "Electronic Malls", "E-Shops" or other names 🎀) have a bunch of perks 💜 sometimes a shared site is cheaper than building your own 💸 lots of them target a specific market (see Section 5 of this document 🦋). by using what already exists, advertisers skip the cost and hassle of owning their own site 🙌 a lot of these sites can aim an ad at a specific audience, so the research is basically done for you, and you get access to the most receptive crowd 🎯 ads on these sites can also be built into bigger stuff, like free e-mail services, Internet access, or news broadcasts 📺 that kind of integration can make the ad feel more legit than it would on its own 🫶

here are some notes on using ANY kind of website for ads 🌈

no matter how an advertiser decides to run their ads on the Web, there are a few specific caveats about how they interact with customers 💅

1. First, the advertiser must make sure their contact info (name, phone, e-mail address) is clear and easy to find 📇
2. Second, advertisers should be careful about forms that gather info about customers 🙈 there's concern in the United States and other countries about collecting info from minors without parental consent 😬 there's also concern about grabbing dynamic info through persistent state, like "cookies", or through data collection software running on someone's computer without them knowing 💀 info should only ever be gathered in a voluntary and informed way 🫶, not with cookies, forms, or other methods that might be available just because they're there
3. Third, if advertisers DO gather info about people and plan to use it for marketing in ANY way, they must be VERY clear about those plans when people submit their info 🔥

C. Netnews and E-Mailing list group postings

if an advertiser picks newsgroups as their target medium, there are some critical things to figure out first 🔍 the default assumption should be that a Netnews group will not welcome spam 🙅‍♀️ though there are some ad-friendly newsgroups out there 🌸 the only way to know if a group is cool with a certain type or form of advertising is to do one of these:

• read the Frequently Asked Questions (FAQ) to see what's specifically allowed or banned in that group 📖

or

• ask the group by posting a short message that says how you plan to advertise your product 💬 don't mention any product details in that message, just ask if the group would object 🙏

or

• if it's a "moderated" newsgroup, send an e-mail to the group's moderator 📬 lots of moderators have a specific preference for how ads get handled, like through compilation, "digest" formats, or other 🧚

it's recommended that prospective advertisers read the groups they want to post in for a while before posting 👀 generally, spending a long time reading the messages in a group gives you a good sense of how your ad will be seen or accepted there 💜

but this reading period should not be used as a replacement for the suggestions above 🙅‍♀️ lots of groups have specific instructions or requirements for posting ads ⭐ advertisers who don't meet those requirements are basically doing irresponsible stuff, and they'll deal with the consequences 💀

D. Compiled E-Mail Lists

okay this one needs repeating 🫢 Let the Seller Beware. 🚨 the material in Section 4 of this document is super relevant when it comes to E-mail and using compiled lists of addresses for advertising 🎀 advertisers should understand that they are responsible for making sure their recipients are properly targeted 🎯; for properly showing their own or their seller's identities 🪪; and for only using resources or systems with the express permission of the owners of those systems 🔐

when it's time to collect and compile recipient info, one option that keeps popping up is pre-compiled mailing lists 📋 these are usually advertised using the very method that's irresponsible in the first place, which is Unsolicited E-Mail 😤 there are lots of reasons these lists should not be used 🙅‍♀️

a lot of suppliers build their mailing lists from addresses they grabbed in mildly to extremely unethical ways 😬 many of these list-makers scrape up huge numbers of addresses without checking if they're legit 🤖 like, they send out software robots to snag addresses from News or Mailing List archives that could be many years old 💀 on top of that, lots of list owners generate addresses from a "dictionary", making tons of invalid addresses that then get sold to unsuspecting buyers 🫠 people change jobs, change ISPs, and change everything about themselves over time 🦋 so trusting a third party for a mailing list is just not wise 🙈

it's known that some mailing list providers have made lists from e-mail addresses of people who asked to be REMOVED from their mailing lists 😭 then they sell those lists to other advertisers who think they're getting people who actually want unsolicited info 🥲

no matter where the list came from, advertisers and sellers are still responsible for keeping their lists maintained 🧹 buying a list from a third party moves the maintenance costs of that list onto the advertiser who uses it 💸 honestly, this is only economical for the mailing list vendor 🙄

with all that in mind, all the evidence says the biggest amount of control over an advertiser's success and liability belongs to the advertiser themselves 👑 so advertisers have to compile their own lists of willing recipients for advertising-related E-Mail messages 📝 as discussed earlier, leads the advertiser generates on their own are the most likely to be interested in the ad, so they're also the least likely to complain about getting it by E-Mail 💖 that's exactly why an "Opt-In" list (see Section 7 of this text 🧚) is probably the most successful way to distribute ads on the Internet 🏆

it must be noted here, for the same reasons as above: if an advertiser has built their own mailing list for their purposes, that list must NEVER be sold to another party 🚫 just like buying a third-party list is considered unethical, being the provider of that list is equally unethical 😤 customers who want info about your product are not likely to respond well when your business associates contact them unsolicited 📩 protect your reputation from the backlash of bad faith that can happen in cases like that 🛡️💜

7. Opt-In Mailing Lists 💌

Okay bestie, so this whole doc has been building up to this 🫶 We've covered the basic facts of Internet Marketing, the advertiser is responsible for what they do, there will always be people who don't want the ads, and every action gets a reaction. And the big message is that Internet advertising can totally work for everyone involved ✨ The key tool for making that happen is the Opt-In mailing list! It gives the advertiser control over who their target audience is: whether the e-mail address is valid, whether the product actually fits them, and whether they're willing to get advertising by e-mail at all.

Opt-In mailing lists are consistently shown to work better at starting and keeping customer relationships than any other kind of Internet advertising 🔥 Studies found Opt-In mailing to be Eighteen (18%) Percent more effective than Banner advertising [10], and banners only get a response rate of 0.65%. Why is it so strong? Because the people getting those e-mails actually made a specific effort to sign up for them. They showed they were interested in hearing about products they felt were relevant to them. Main character energy for real 👑

Advertisers who want to use Opt-In mailing lists have a few places to get help 🌸 If you run your own website or web page, you already have the most important piece, a web presence to invite people to join the Opt-In list. If you use a shared website for your product instead, you can still use an Opt-In data gathering mechanism. There are loads of forms and technologies you can use to build an Opt-In list, but this document isn't going to go through them one by one 🙈 The point of this section is to give advertisers info that, when they use it, helps protect them and makes the whole advertising experience a successful one.

A. Privacy 🔒

As I mentioned before, advertisers need to be careful about gathering info from Opt-In participants 💅 First and foremost, the person giving the info has to know that they're giving it. Taking these early steps lowers the risk of messages being read as spam. If an advertiser plans to use the submitted or inferred data for any mailings, there should be clear language saying so. Also, people submitting data must be given the choice to "Opt-Out," which means they can submit the data but NOT receive any advertisements. A safe move is for the advertiser to set up their data-gathering so "Opt-Out" is the default. That way, every member of the list has made a real, deliberate effort to get on it 🫶 In almost every case, just having a "check-box" with this caption is enough:

   "Please send me E-Mail advertisements or
    announcements about your products."

It's super important that advertisers know different jurisdictions handle the collection of personal data in different ways 😭 The burden of checking those laws is on the advertisers, not anyone else. For more info on privacy, check out Appendix B of this document.

B. Integrity 🛡

When you keep a list where names can be submitted through some public or semi-public resource, like a website, advertisers should take steps to verify every single subscription 🧚 There are key pieces of data that can help check whether a subscription request is legit, but the only person who can actually confirm that the act of subscribing was genuine is the owner of the E-Mail address that got submitted.

To avoid accidentally spamming someone who had no idea, advertisers should immediately confirm any submission 💖 Doing that lets them meet all the requirements for responsible confirmation of a subscription request. Also, if someone's E-Mail address got put on a list without the owner knowing or agreeing to it, immediate notification plus supporting data lets the owner of that account act to protect it from future wrongdoing 🦋

When generating confirmations, the following information must be provided to the subscriber:

• the E-Mail address subscribed
• the manner in which it was subscribed (website or mailing list address)
• the Date and Time of the subscription request (via NTP, for uniformity in future reference)
• the IP Address of the host which submitted the request
• the full headers of the subscription request (where applicable, such as mailing lists)
• the Name, website address, and contact E-Mail address of the advertiser
• instructions to the recipient as to how to permanently remove themselves from the list

Beyond that, a well-represented business will make an effort to say all this stuff in a way the average recipient can understand and relate to 🎀 Here's an example [11]:

        - - - - - - C O N F I R M A T I O N - - - - - - - - - - - -

        Thank you for your interest in Widget Sales!

        This is confirmation of your subscription request for the
        Widget Sales E-mail list.

        You are currently subscribed with this address:

                foo@bar.example

        Your request was received via our website at

                http://www.example.com/input.html

        If you did not submit this request, someone may have
        submitted it for you, or may be pretending to be you.

        If you wish to be removed from this list, Reply to this
        message with the word UNSUBSCRIBE as the body of the
        message.

        If you feel you were added to the list without your
        permission, the information below should be forwarded to
        your ISP's Administrative staff for follow-up, with an
        explanation of your concern.

        As stated in RFC-2635, "you can do this by sending mail
        to "Postmaster@your-site.example".  Your postmaster should be
        an expert at reading mail headers and will be able to tell if
        the originating address is forged.  He or she may be able to
        pinpoint the real culprit and help close down the site.  If
        your postmaster wants to know about unsolicited mail, be sure
        s/he gets a copy, including headers.  You will need to find
        out the local policy and comply."

        Widget Sales, Inc.            |      http://www.example.com
        Responsible Internet          |            info@example.com
        Marketing - Made Easy!        |       cust-serv@example.com
        -----------------------------------------------------------

        Submission Information:

         Request received for foo@bar.example from 192.168.0.1 at
            06:41:55:13(GMT) on 07.03.1999 via

         http://www.example.com/input.html

        E-Mail headers follow:

         Received: from 01.anytown.dialup.example.net
            ([192.168.0.1]) by adshost.example.com
            (FooBarMail v01.01.01.01 111-111) with SMTP
            id <19990703054206.VDQL6023@77.anytown.dialup.example.net>
            for <marcel@example.com>; Sat, 3 July 1999 01:41:55 +0000
         From: Customer <foo@bar.example>
         To: mail-list@example.com
         Subject: Submission Request
         Date: Sat, 03 July 1999 01:41:55 -0400
         Organization: Zem & Zem Bedding Company, Inc.
         Reply-To: foo@bar.example
         Message-ID: <k???12qelNxp7Q=??3dbgLHWTLv@4??.bar.example>
         X-Mailer: FooBarMail HTTPMailer Extension 1.0.532
         MIME-Version: 1.0
         Content-Type: text/plain; charset=us-ascii
         Content-Transfer-Encoding: quoted-printable

C. Protection 💖

Advertisers should know about some ways to protect themselves 🛡 Often, especially when traffic on a mailing list is low, a subscriber just forgets they ever asked to join. Then a new message shows up, they get it, and they file a spam complaint. If that happens to several recipients, the advertiser and/or seller could lose their Internet access, even if they behaved responsibly the whole time 😭

So advertisers should keep an archive of every submission request they receive ✨ That archive should be looked after as carefully as the advertiser's operational data, and protected the same way. Having those requests on hand protects advertisers from spamming reports, whether the reports are malicious or just a genuine misunderstanding. For reasons that should be pretty obvious, those messages should stay archived for a period that lasts AT LEAST as long as the list remains active. This isn't strictly required for responsible behavior, but it's a solid safety measure for the responsible advertiser 🫶

---

8. Irresponsible Behavior 🙅

Shotgunning a message doesn't really work in any medium, but it's way easier to do on the Internet than with paper mail or telephone solicitations 💀 The steps in this paper will help the advertiser create a good environment for their work, keep a responsible presence on the Internet, and target the right types of customers and the right methods for reaching them. With all that in place, there are some actions that should be avoided as the basis for any Responsible advertising presence on the Internet 💅

DON'T advertise money-making opportunities that can, in any way, be construed as Pyramid or Ponzi schemes. (For information regarding those types of "investments," refer to Appendix A.1 of this document.)

DON'T forge E-mail headers to make it look as if the messages originate from anywhere other than where they really originate. Lots of domain owners have won litigation against advertisers who used their domain name to hide their true identity 🙈 [12][13][14]

DON'T send out any sort of bogus message to "cover" the intended activity, which is advertising. In other words, don't pretend that a personal message from the advertiser to someone else was sent to a mailing list by mistake so the body of that message can be used to advertise, like in this example:

      Dear Tony - had a great time at lunch yesterday.  Per your
      request, here's the information on the latest widget I
      promised [...].

DON'T use overly-general statements such as "Our research shows you're interested in our product." Most recipients know this is usually a bogus claim, and using it can rob the advertisement of any legitimacy it might have 💀

DON'T create mailing lists from third party sources (see Section 6; Part D of this document, above).

DON'T SELL MAILING LISTS!!! 🚫

Enough negativity! Now for some helpful suggestions 🌈

9. Responsible Behavior ✨

DO create a lively signature which tells the minimum about the product/service. But keep it to 4 lines total (four lines is the maximum recommended length for signatures). 💅

DO participate in mailing lists and newsgroups which discuss topics related to the particular product/service. Advertisers will find people of a similar interest there and many potential customers. So long as an advertiser isn't offensive in their interactions with these groups they can find their participation quite rewarding. 🫶

DO ask people if they want to be part of any mailing list that is created. Advertisers must be clear about their intentions of how they plan to use the list and any other information that is collected. 🎀

DO tell people how list data has been gathered. If recipients are signed up from a web page, make sure the prospective recipient is aware that they will be getting mail. Many web pages have getting mail selected as default. Our recommendation is that the default be that recipients do NOT wish to receive mailings, even if the prospective recipients find an advertiser's site of interest. 🙈

DO respect the privacy of customers. Keep a mailing list private. For an advertiser to sell a mailing list is not responsible or ethical. In addition, if offering any type of online transactions, advertisers should take care to encrypt any sensitive information The addresses of the list members should never be viewable by the list recipients, to protect your list members' privacy. 🔒💜

DO take steps to safeguard all of the personal information that is being taken from customers, such as Credit Card or other Payment information. Provide honest information regarding the methods being used to protect the customer's data. 👑

DO let recipients know how to remove themselves from a mailing list. Advertisers should make this as easy as possible, and place the instructions in every message sent. 🦋

DO let people know for what purpose any data is being collected. Advertisers must ensure that their plans regarding data collection are legal. 🌈

Advertisers and Sellers can check with the web site of the Better Business Bureau, which operates in the United States and Canada. (www.bbb.org) This organization has several programs and services which can help advertisers in those countries, and has other resources which will benefit advertisers of any nationality. 🍓

"Advertisers should advertise responsibly the better mousetrap they have built, and the world will beat a path to their E-mail address." 🪤✨

10. Security Considerations 🔐

This memo offers suggestions for responsible advertising techniques that can be used via the Internet. It does not raise or address security issues, but special attention should be paid to the section on "Privacy". While not strictly a network security consideration, privacy considerations can have legal ramifications that deserve special attention. 🚨 Privacy is literally the main event here, bestie, so read that section twice. 💀

Appendices 🧚

Most readers of this document are probably aware as to why "Pyramid" or "Ponzi" schemes are fraudulent, and in most places, criminal. Appendix "A" describes how these schemes work and some of the risks inherent in their operation and participation. 🙅‍♀️

For a topical review of Privacy law across multiple jurisdictions, including several sovereign nations, Appendix "B" provides some resources for advertisers or other interested parties. 📚

A.1 The classic Pyramid 🔺

In the classic Pyramid scheme, there is a list of a few people. A participant sends money to one or all of them, and then shifts that person off the list and adds their own name. The participant then sends the same message to N people....

The idea is that when a recipient's name gets to the special place on the list (usually at the "top" of the pyramid), they will get lots of money. The problem is that this only works for everyone if there are an infinite number of people available. 😬

As an example, examine a message with a list of four people where each participant sends US$5.00 to each; removes the first name, and adds their own name at the bottom. There may also be some content encouraging the participants to send "reports" to people who submit money. Presume the rules encourage the participants to send out lots of copies until they each get ten direct responses, 100 second level responses, etc., and claim there is a guarantee that the participants will earn lots of money fast if they follow the procedure. 🤑

First, some person or group has to have started this. When they did, they were able to specify all four names so it was probably four people working together to split any profits they might get from being the top of the pyramid (or maybe they sent out four versions of the original letter with their name order rotated). In some cases, all names on the list have been proven to be the same person, operating under assumed business names! 🕵️‍♀️

While the letters that accompany these things usually have all kinds of language about following the instructions exactly, the most rational thing for a dishonest participant to do if they decided to participate in such a thing would be to;

     (1) send no money to anyone else; and

     (2) find three other people and replace all the names on
         the list.

But, presume that not just this participant, but everyone who ever participates decides to follow the "rules". To avoid the start-up transient, assume that it starts with one name on the list and for the next three layers of people, one name gets added and only after the list is up to four does any participant start dropping the "top" name. 🌀

What does this look like after nine levels if everything works perfectly? The following table shows, for nine levels, how many people have to participate, what each person pays out, gets in, and nets. 📊

   Level         People       Out          In        Net
   1                  1         0     $55,550    $55,550
   2                 10        $5     $55,550    $55,545
   3                100       $10     $55,550    $55,540
   4              1,000       $15     $55,550    $55,535
   5             10,000       $20     $55,550    $55,530
   6            100,000       $20      $5,550     $5,530
   7          1,000,000       $20        $550       $530
   8         10,000,000       $20         $50        $30
   9        100,000,000       $20           0        -20

So if this scheme ever progressed this far (which is extremely unlikely) over 10,000 people would have made the "guaranteed" $50,000. In order to do that, one hundred million people (or over ten thousand times as many) are out twenty dollars. And it can't continue because the scheme is running out of people. Level 10 would take one billion people, all of whom have $20 to submit, which probably don't exist. Level 11 would take ten billion, more people than exist on the earth. 🌍💀

Pyramid schemes are _always_ like this. A few people who start them may make money, only because the vast majority lose money. People who participate and expect to make any money, except possibly those who start it, are being defrauded; for this reason, such schemes are illegal in many countries. 🚫

A.2 What about Ponzi? 🤔

A Ponzi scheme is very similar to a pyramid except that all of the money goes through a single location. This method of confidence fraud is named after Charles Ponzi, a Boston, Massachusetts "businessman" who claimed to have discovered a way to earn huge returns on money by buying international postal reply coupons and redeeming them in postage for more than their cost. Early "investors" in this scheme did get their promised return on investment, but with money that later investors were investing. Ponzi was actually doing nothing with the money other than deriving his own income from it, and paying latter investors' money to earlier investors. 🙄

Notice the similarity to early pyramid participants, who "earn" money from the later participants. 👀

Just as pyramids always collapse, Ponzi schemes always collapse also, when the new people and new money run out. This can have serious consequences. People in Albania died and much of that country's savings were squandered when huge Ponzi schemes that "seemed" to be partly backed by the government collapsed. 😭💔

A.3. So all multi-levels are evil? 🧚

Okay so, no! Not all multi-level systems are the same, and they're not all "evil" either 🙅

If all that's actually moving around is money, and maybe some "reports" or things like that which are super cheap to produce, then it's almost certainly a criminal scam 🚨. But if there are substantial goods and/or services being sold through a networked tier-system at reasonable prices, it's more likely to be legit ✨.

If the ad says participants can make money "fast", "easy" or "guaranteed", be very suspicious 💀. If it says participants may be able to make money by putting in lots of hard work over many months but there's no guarantee, then it may be legit 🌸. As always, bestie: if it seems "too good to be true", it probably is 🙈.

If people are paid to recruit "members" or can "buy" a high "level", it's almost certainly a criminal scam 🚩. If people are paid only for the sale of substantial goods and/or services, it's more likely to be legitimate 💅.

It's also worth looking at the history of the organization and its founders/leaders 🕰️. The longer it's been around, the more likely it is to keep being around 👑. If its founders or leaders have a history of fraud or crime, a person should think very carefully before being part of it 🛑.

---

B.1. Why Web Privacy? 🔒

Directories, lists or other collection sources of personal data are the current informational "gold rush" for Internet Marketers 🪙. In the United States and other countries, there's no explicit guarantee of personal privacy 😬. Under current legislation, that right stands little chance against certain electronic technologies. Some members of the global community have expressed concern about perceived intrusion into their personal privacy, and still, the collection and sale of such information abounds 💀.

Self-regulation by businesses utilizing the Internet is the first choice of legislators, commercial websites, and Internet aficionados 🫶.

However, the anticipated profit to be made by selling personal data and by using these lists for advertisement purposes often dissuades self-regulation 💸.

United States Senator Patrick Leahy, Ranking Minority member of the Judiciary Committee of the United States Senate (at the time of the writing of this document), states very succinctly why we should respect Internet Privacy 📣:

"Good privacy policies make good business policies. New technologies bring with them new opportunities, both for the businesses that develop and market them, and for consumers. It does not do anyone any good for consumers to hesitate to use any particular technology because they have concerns over privacy. That is why I believe that good privacy policies make good business policies."

The Center for Democracy and Technology suggests Five Conditions that websites should use to be considerate of individual's rights to privacy 🎀:

• Notice of Data Collection
• Choice to Opt Out
• Access to Data to rectify errors
• Adequate Security of Information Database
• Access to contact persons representing the data collector

Notice that the practice of data collection authorization can be accomplished using something as simple as an automated response E-Mail message 📧. Such notices should contain easily understood information about the collecting party's identity, and instructions as to how a customer can remove themselves from the collected population. This will help assure prospective customers that an advertiser is a business of integrity 🧡.

Businesses that pursue international trade (do business across national boundaries, overseas, etc...) bear the risk of facing legal prosecution for personal privacy violations ⚖️. The European Communities have legislation for the flow of Personal Information 🇪🇺. If an advertiser is interested in pursuing business interests across borders, and particularly if a business intends to solicit and/or share Personal Information, the advertiser/seller must be able to guarantee the same privacy considerations as a foreign counterpart, or as a business operating in the nation in which the advertiser is soliciting/performing their business 🌍.

Other countries and their legislation are shown below:

Germany     -     BundesDatenSchutzGesetz (BDSG)

France      -     Commision nationale de l'informatique et de
                  libertes (CNIL)

UK          -     Data Protection Act (DPA)

Netherlands -     Wet PersoonsRegistraties (WPR)

Australia   -     Privacy Act of 1998 (OECD DAta Protection
                  Guidelines)

Canada      -     The Personal Information Protection and
                  Electronic Documents Act

---

References 📚

[1] Hambridge, S. and A. Lunde, "DON'T SPEW: A Set of Guidelines for Mass Unsolicited Mailings and Postings (spam*)", FYI 35, RFC 2635, June 1999.

[2] Internet Spam / UCE Survey #1. http://www.survey.net/spam1r.html, July 24, 1997.

[3] ISPs and Spam: the impact of spam on customer retention and acquisition. Gartner Group, San Jose, CA. June 14, 1999. Pg. 7.

[4] CompuServe Inc. v. Cyber Promotions, Inc., No. C2-96-1070 (S.D. Ohio Oct. 24, 1996) (temporary restraining order) [WWW], preliminary injunction entered, 962 F. Supp. 1015 (S.D. Ohio Feb. 3, 1997) [WWW | Lexis | Westlaw], final consent order filed (E.D. Pa. May 9, 1997)[WWW]. http://www.leepfrog.com/E-Law/Cases/CompuServe_v_Cyber_Promo.html http://www.jmls.edu/cyber/cases/cs-cp2.html http://www.jmls.edu/cyber/cases/cs-cp3.html

[5] America Online, Inc. v. Cyber Promotions, Inc., No. 96-462 (E.D. Va. complaint filed Apr. 8, 1996) [WWW] (subsequently consolidated with Cyber Promotions' action filed in E.D. Pa.).

[6] Cyber Promotions, Inc. v. America Online, Inc., C.A. No. 96-2486, 1996 WL 565818 (E.D. Pa. Sept. 5, 1996) (temporary restraining order) [WWW | Westlaw], rev'd (3d Cir. Sept. 20, 1996), partial summary judgment granted, 948 F. Supp. 436 (E.D. Pa. Nov. 4, 1996) (on First Amendment issues) [WWW | Lexis | Westlaw], reconsideration denied, 948 F. Supp. 436, 447 (Dec. 20, 1996) [WWW | Lexis | Westlaw], temporary restraining order denied, 948 F. Supp. 456 (E.D. Pa. Nov. 26, 1996) (on antitrust claim) [WWW | Lexis | Westlaw], settlement entered (E.D. Pa. Feb. 4, 1997) [NEWS.COM report].

[7] America Online, Inc. v. Over the Air Equipment, Inc. (E.D. Va. complaint filed Oct. 2, 1997) [WWW] [NEWS.COM report], preliminary injunction entered (Oct. 31, 1997) [NEWS.COM report], settlement order entered (Dec. 18, 1997) [Wired News report].

[8] America Online, Inc. v. Prime Data Worldnet Systems (E.D. Va. complaint filed Oct. 17, 1997) [WWW] [NEWS.COM report].

[9] Steiner, P. "New Yorker". July 5, 1993. p.61.

[10] Spam slam -- opt-in e-mail gains favor. http://www.zdnet.com/zdnn/stories/news/0,4586,2267565,00.html. May 28, 1999.

[11] Eastlake, D., Manros, C. and E. Raymond, "Etymology of 'Foo'", RFC 3092, April 2001.

[12] Parker, Zilker Internet Park, Inc., Parker, Rauch, Texas Internet Service Providers Association & EFF-Austin v. C.N. Enterprises & Craig Nowak [WWW]. Available: http://www.rahul.net/falk/zilkerjudge.txt

[13] Parker, Zilker Internet Park, Inc., Parker, Rauch, Texas Internet Service Providers Association & EFF-Austin v. C.N. Enterprises & Craig Nowak [WWW]. Available: http://www.jmls.edu/cyber/cases/flowers3.html

[14] WebSystems v. Cyberpromotions, Inc and Sanford Wallace [WWW]. Available: http://www.jmls.edu/cyber/cases/websys1.html

---

Authors' Addresses 💌

Ted Gavin
Nachman Hays Consulting, Inc.
822 Montgomery Avenue, Suite 204
Narberth, PA 19072 USA

EMail: tedgavin@newsguy.com


Donald E. Eastlake 3rd
Motorola
155 Beaver Street
Milford, MA 01757

EMail: Donald.Eastlake@motorola.com


Sally Hambridge
Intel Corp
2200 Mission College Blvd
Santa Clara, CA 95052

EMail: sallyh@ludwig.sc.intel.com

---

Acknowledgements and Significant Contributors 🫶

JC Dill
jcdill@vo.cnchost.com

Barbara Jennings
Sandia National Laboratories

Albert Lunde
Northwestern University

April Marine
Internet Engines, Inc.

---

Full Copyright Statement ⚖️

Copyright (C) The Internet Society (2001). All Rights Reserved.

You're totally allowed to copy this document and share translations of it with others 🥰. You can also prepare, copy, publish and distribute derivative works that comment on or explain it, or help with implementing it, in whole or in part, without any restriction of any kind. The only catch is that the above copyright notice and this paragraph must be included on all such copies and derivative works 📌.

However, this document itself may not be modified in any way, such as by removing the copyright notice or references to the Internet Society or other Internet organizations 🚫. The one exceptions are: when needed for developing Internet standards, in which case the copyright procedures defined in the Internet Standards process must be followed; or when it's required to translate it into languages other than English 🌐.

The limited permissions granted above are perpetual and will not be revoked by the Internet Society or its successors or assigns 💜.

This document and the information contained herein is provided on an "AS IS" basis and THE INTERNET SOCIETY AND THE INTERNET ENGINEERING TASK FORCE DISCLAIMS ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION HEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE 🫠.

---

Acknowledgement 💖

Funding for the RFC Editor function is currently provided by the Internet Society ✨.