selling goods online 163 of services that may be provided as long as subscribers give their consent and are informed of the data processing implications. 3 Gives subscribers the right to decide whether or not they want to be listed in subscriber directories. Subscribers must be given clear information about the directories in question, including any reverse search-type functions, for which additional specific consent is required. 4 Requires that unsolicited commercial e-mail and SMS to individual subscribers is subject to a prior-consent requirement, so that it may only be sent if the recipient has agreed in advance. There is an exception to this rule in the context of an existing customer relationship, where companies may continue to market their own similar products or services on an `opt-out' basis. The US CAN-SPAM Act Despite its name, the CAN-SPAM act doesn't just apply to bulk e-mail. It covers all commercial messages, including e-mail, that promote content on commercial websites. The original 2003 Act was amended in 2008 and the original four requirements were extended to seven. The main requirements are: 1 2 3 4 5 6 7 Don't use false or misleading header information. Don't use deceptive subject lines. Identify the message as an ad. Tell recipients where you are located. Tell recipients how to opt out of receiving future e-mail from you. Honour opt-out requests promptly. Monitor what others are doing on your behalf. You can find out more information about the CAN-SPAM Act on the Federal Trade Commission website, www.ftc.gov/spam, including a useful explanatory document entitled `The CAN-SPAM Act: A compli- ance guide for business', which can be downloaded as a PDF file. The key difference between the CAN-SPAM Act and the EU directive is that the EU directive requires prior consent from the recipient before any direct-marketing e-mail messages can be sent (`opt-in'), whereas the CAN-SPAM Act allows direct marketing messages to be sent to anyone, without permission, until the recipient explicitly requests that they cease (`opt-out').