Supporting Statement OMB 3060-1078 (FINAL VERSION)

OMB Control Number: 3060-1078 October 2007

Rules and Regulations Implementing the Controlling the Assault of Non-Solicited Pornography and Marketing Act of 2003 (CAN-SPAM Act); CG Docket No. 04-53

SUPPORTING STATEMENT

A. Justification

1. On March 19, 2004, the Federal Communications Commission (FCC or Commission) issued a Notice of Proposed Rulemaking (NPRM), Rules and Regulations Implementing the Controlling the Assault of Non-Solicited Pornography and Marketing Act of 2003; Rules and Regulations Implementing the Telephone Consumer Protection Act of 1991, CG Docket Nos. 04-53 and 02-278, FCC 04-52, pursuant to the Controlling the Assault of Non-Solicited Pornography and Marketing Act of 2003 (CAN-SPAM Act), Public Law 108-187.

Congress passed the CAN-SPAM Act to address the growing number of unwanted commercial electronic mail messages,⁴ which Congress had determined to be costly, inconvenient, and often fraudulent or deceptive. Section 14 of the CAN-SPAM Act requires the FCC, in consultation with the FTC, to promulgate rules to protect consumers from unwanted “mobile service commercial messages.”² Section 14 also directs the FCC to provide wireless subscribers with the ability: (1) to avoid receiving mobile service commercial messages sent without the subscribers’ prior consent and (2) to indicate electronically a desire not to receive future such messages.

On August 12, 2004, the Commission released the Report and Order (Order), Rules and Regulations Implementing the Controlling the Assault of Non-Solicited Pornography and Marketing Act of 2003; Rules and Regulations Implementing the Telephone Consumer Protection Act of 1991, CG Docket Nos. 04-53 and 02-278, FCC 04-52, which adopted rules to prohibit the transmission of commercial messages to any address referencing an Internet domain name associated with wireless subscriber messaging services, unless the individual addressee has given the sender express prior authorization.

To assist the senders of such messages in identifying those subscribers, the Commission requires that Commercial Mobile Radio Service (CMRS) providers submit those domain names to the Commission, for inclusion in a list that will be made publicly available on the FCC’s website. No individual subscriber’s electronic mail addresses will be collected or included on this list. CMRS providers will be required to supply the Commission with names of all Internet domains on which they offer mobile messaging service. The rules prohibit sending any commercial messages to addresses that contain domain names that have been included on the official list for at least 30 days or at any time prior to 30 days if the sender otherwise knows that the message is addressed to a wireless device.

Among other things, the information collection requirements consist of:

(A) 47 CFR § 64.3100(d): In the Order, the Commission adopted a rule that no person or entity may send commercial messages to wireless subscribers unless certain conditions are met, one of which is that the person or entity sending the message has obtained the recipient’s prior express authorization as defined in 47 CFR § 64.3100(d). Specifically, 47 CFR § 64.3100(d) states: “Express Prior Authorization” may be obtained by oral or written means, including electronic methods, as follows:

(1) Written authorization must contain the subscriber’s signature, including an electronic signature as defined by 15 U.S.C. § 7001 (E-Sign Act).

(2) All authorizations must include the electronic mail address to which mobile service commercial messages can be sent or directed. If the authorization is made through a website, the website must allow the subscriber to input the specific electronic mail address to which commercial messages may be sent.

(3) Express Prior Authorization must be obtained by the party initiating the mobile service commercial message. In the absence of a specific request by the subscriber to the contrary, “express prior authorization” shall apply only to the particular person or entity seeking the authorization and not to any affiliated entities unless the subscriber expressly agrees to their being included in the express prior authorization.

(4) Express Prior Authorization may be revoked by a request from the subscriber, as noted in paragraph 47 CFR §§ 64.3100(b)(2) and (b)(3).³

(5) All requests for express prior authorization must include the following disclosures:

(i) that the subscriber is agreeing to receive mobile service commercial messages sent to his/her wireless device from a particular sender. The disclosure must state clearly the identity of the business, individual, or other entity that will be sending the messages.

(ii) that the subscriber may be charged by his/her wireless service provider in connection with receipt of such messages.

(iii) that the subscriber may revoke his/her authorization to receive MSCMs at any time.

(6) All notices containing the required disclosures must be clearly legible, use sufficiently large type or, if audio, be of sufficiently loud volume, and be placed so as to be readily apparent to a wireless subscriber. Any such disclosures must be presented separately from any other authorizations in the document or oral presentation. If any portion of the notice is translated into another language, then all portions of the notice must be translated into the same language.

(B) 47 CFR § 64.3100(a)(4): The Commission adopted a rule that no person or entity may send commercial messages to wireless subscribers, with certain exceptions. Such an exception, under 47 CFR § 64.3100(a)(4), is that the address to which the message is sent or directed does not include a reference to a “domain name”⁴ that has been posted on the FCC’s wireless domain names list for a period of at least 30 days before that message was initiated, provided that the person or entity does not knowingly initiate a mobile service commercial message (MSCM).

To assist the senders of such messages in identifying wireless subscribers, the Commission has made available to the public a list of mailing domain names used for mobile service messaging (an example of such a domain name would be “@wirelesscompany.com”). Businesses or individuals that market by sending commercial electronic mail messages may take advantage of this exception by checking the publicly available list and avoid sending such messages to addresses associated with the domain names on the list.

(C) 47 CFR § 64.3100(f)⁵: Carriers are also required to file any updates to their listings with the Commission. Specifically 47 CFR § 64.3100(f) states:

Each CMRS provider is responsible for the continuing accuracy and completeness of information furnished for the FCC’s wireless domain names list. CMRS providers must:

(1) file any future updates to listings with the Commission not less than 30 days before issuing subscribers any new or modified domain name;

(2) remove any domain name that has not been issued to subscribers or is no longer in use within 6 months of placing it on the list or last date of use; and

(3) certify that any domain name placed on the FCC’s wireless domain names list is used for mobile service messaging.

The Commission is requesting an extension of this information collection to review the full three year OMB approval/clearance.

The statutory authority for this information collection is the CAN-SPAM Act of 2003, 15 U.S.C. § 7701 – 7713, Public Law No. 108-187, 117 Stat. 2719.

2. The information collection requirements apply only to senders of commercial electronic mail messages and CMRS providers. The Commission uses the data, i.e., the list(s) of domain names, which are supplied by these commercial electronic mail messaging services and CMRS providers, to allow these entities to avoid sending unwanted commercial electronic mail to wireless subscribers and to determine if these entities are violating the CAN-SPAM Act. Among other things, the data show:

(a) what domain names are associated with wireless subscriber addresses so that senders can avoid sending messages to such addresses; and

(b) that companies have secured the necessary authorization from any wireless subscriber to whom they wish to send commercial electronic mail.

If subscribers receive commercial electronic messages for which they have not provided express prior authorization, or if they believe the Commission’s CAN-SPAM rules have been otherwise violated, they can file an informal complaint with the Commission.

The collection of information may contain personally identifiable information on individuals (PII).

(a) The FCC maintains an information system, including both paper files and electronic data, which is covered by a system of records notice (SORN), FCC/CGB-1, “Informal Complaints and Inquiries.” The SORN covers the collection, purposes(s), storage, safeguards, and disposal of the PII that individuals (respondents) may submit to the Commission as part of filing informal complaints regarding potential violations of the Commission’s CAN-SPAM rules.

(b) The Privacy Impact Assessment (PIA) that the FCC completed on June 28, 2007 gives a full and complete explanation of how the FCC collects, stores, maintains, safeguards, and destroys the PII, as required by OMB regulations and the Privacy Act, 5 U.S.C. 552a. The PIA may be viewed at: http://www.fcc.gov/omd/privacyact/Privacy_Impact_Assessment.html.

(c) The FCC last published this SORN on October 11, 2001 (66 FR 51955).

(d) The FCC intends to update its inventory of SORN’s, including FCC/CGB-1, “Informal Complaints and Inquiries,” and to publish a Notice in the Federal Register as required by OMB regulations and the Privacy Act, 5 U.S.C. 552a(e).

3. Because the FCC’s CAN-SPAM rules apply only to the transmission of electronic mail messages, most records continue to be kept electronically. The Commission’s wireless domain name list enables entities that market through electronic mail to:

(a) download the information so that they can use it in conjunction with their own databases of electronic mail addresses or to view it on a computer screen; and

(b) print or manually copy the entire list or applicable portions.

Senders access the list as often as they wish. CMRS providers submit their domain names to the Commission electronically.

4. The information collection requirements are not duplicative of any currently existing federal regulatory obligation.

5. There will not be a significant impact on a substantial number of small businesses/entities by this information being collected.

6. The CAN-SPAM Act directs the Commission to provide subscribers with the ability to avoid receiving unwanted mobile service commercial messages. Congress determined that such unwanted messages are costly, inconvenient, and often fraudulent or deceptive. The Commission determined that the statute’s mandate required it to adopt a prohibition on sending mobile service commercial messages without the subscriber’s authorization.

The CAN-SPAM Act requires the Commission to consider the technical ability for senders of such messages to know which messages will go to wireless devices. The Commission compared and evaluated alternatives to creating a wireless domain name list that can identify for these commercial senders the addresses of the mobile wireless services subscribers who do not wish to receive these messages, and in doing so, determined that the list best protects subscribers from unwanted electronic mail messages. The Commission concluded that the alternatives were more costly and/or ineffective for both businesses and consumers and that the wireless domain list was the best option. Without the domain name list collection, or if the collection were conducted less frequently, wireless subscribers would receive more unwanted commercial messages, defeating the purpose of the CAN-SPAM Act’s protections.

7. The Collection is not conducted in any manner that is inconsistent with the guidelines in 5 C.F.R. § 1320.6.

8. Pursuant to 5 CFR §1380, the Commission published a notice in the Federal Register on August 8, 2007 (72 FR 44529). The Commission received no comments following publication of this notice.

9. The Commission does not anticipate providing any payment or gift to any respondents.

10. Confidentiality is an issue to the extent that individuals’ and households’ information is contained in the Commission’s operations support for complaint analysis and resolution (OSCAR) and consumer information management system (CIMS) databases, which is covered under the Commission’s system of records notice (SORN), FCC/CGB-1, “Consumer Inquiries and Complaints Division.”

(a) The Commission is requesting that individuals (consumers/respondents) submit their names, addresses, and telephone numbers, which the Commission’s staff need to process the complaints. A privacy statement is included on all FCC forms accessed through our Internet web site.

(b) In addition, respondents are made aware of the fact that their complaint information may be released to law enforcement officials and other parties as mandated by law (i.e. court-ordered subpoenas). The PII covered by this system of records notice is used by Commission personnel to handle and to process informal complaints from individuals and groups. The Commission will not share this information with other federal agencies except under the routine uses listed in the SORN.

The PIA that the FCC completed on June 28, 2007 gives a full and complete explanation of how the FCC collects, stores, maintains, safeguards, and destroys the PII, as required by OMB regulations and the Privacy Act, 5 U.S.C. 552a. The PIA may be viewed at: http://www.fcc.gov/omd/privacyact/Privacy Impact_Assessment.html.

11. This information collection does not raise any questions or issues of a sensitive nature.

(a) Additionally, consumers are cautioned not to provide personal information such as social security numbers, credit card numbers, etc.

(b) As noted earlier, the Commission does require consumers (respondents) to provide their names, addresses, and telephone numbers so that Commission staff may process these complaints more expeditiously and if the Commission needs to contact the complainant for any additional information to resolve the complaint.

(c) In instances where consumers provide PII, the FCC has a SORN, FCC/CGB-1, “Informal Complaints and Inquiries,” to cover the collection, use, storage, and destruction of the PII. A full explanation of the privacy safeguards may be found in the Privacy Impact Assessment that the FCC completed on June 28, 2007 and that may be viewed at: http://www.fcc.gov/omd/privacyact/Privacy_Impact_Assessment.html.

12. Estimates of the hour burden for the collection of information are as follows:

Current OMB Approval.

Total Annual Burden Hours: 115,645,100

Total Respondents: 11,027,600

Total In-House Costs: $1,379,646,044

Extension Request.

The Commission has reevaluated the burdens associated with this information collection and concluded that the total annual costs/burden hours have decreased. The Commission bases this conclusion on several factors that have occurred since it adopted the CAN-SPAM rules and published the wireless domain name list. First, the FCC adopted by cross-reference certain Federal Trade Commission (FTC) rules defining when the “primary purpose” of an electronic mail message will be considered to be “commercial advertisement or promotion of a commercial product or service as those terms are used in the CAN-SPAM Act.”⁶ These rules permit senders of commercial electronic mail messages to better determine which messages are commercial messages sent to a wireless device, thereby triggering the requirement to obtain express prior authorization, and which messages are transactional or relationship messages sent to a wireless device, for which no express prior authorization is required. Second, after the initial listing of several hundred wireless domain names, addition of newly-activated domain names to the list by CMRS providers has not occurred at the rate anticipated. Finally, the volume of complaints to the FCC’s Consumer Center regarding unwanted commercial messages to wireless devices has been relatively low.

From the FTC rulemaking and this experience we conclude that, at present, the number of unwanted commercial messages received by consumers on their wireless devices is fairly low. Therefore, the Commission has reduced its estimate of the number of businesses sending commercial messages to wireless devices by half. The Commission further concludes that senders of commercial messages to wireless devices are complying with the Act’s requirements by the comparatively less burdensome method of refraining from sending unwanted commercial messages to wireless devices using domain names on the FCC’s published list rather than the comparatively more burdensome method of obtaining the recipient’s express prior authorization. Finally, due to the passage of time since publication of the wireless domain name list, the Commission concludes that, after completing the initial effort of downloading the wireless domain name list, senders of commercial messages to wireless devices have to devote less effort than originally estimated to checking the FCC list and updating their own mailing lists. For all of these reasons, the Commission concludes that total annual costs/burden hours have decreased.

1. 47 CFR § 64.3100(d): The Commission adopted a rule that no person or entity may send commercial messages to wireless subscribers unless certain conditions are met, one of which is that the person or entity sending the message has obtained prior express authorization as defined in 47 CFR § 64.3100(d).

The Commission estimates that there are approximately 22,620,000 businesses in the United States. The Commission believes that, at most, one quarter of those businesses (5,655,000) send unwanted commercial electronic mail messages. Out of these 5,655,000 businesses, the Commission estimates that one quarter—1,413,750 businesses (respondents)—will comply with these rules by obtaining authorization before adding that electronic mail address to their marketing list.

This process will be done “on occasion” and requires approximately 10 hours for the 1,413,750 respondents obtaining the authorization.

Annual Number of Respondents: 1,413,750 businesses

Annual Number of Responses: 1,413,750 authorizations for commercial electronic mail messages

Annual Burden Hours:

1,413,750 respondents x 1 authorization/respondent x 10 hours/authorization = 14,137,500 hours

Annual In-House Cost: The Commission assumes that respondents use “in house” personnel to obtain authorization whose pay is comparable to a federal employee GS- 3/1, plus 30% overhead. Thus, the Commission estimates respondents’ cost to be about $16.08 per hour to comply with the requirements:

1,413,750 respondents x 1 authorization/respondent x 10 hours/authorization x $16.08/hr = $2227,331,000

2. 47 CFR § 64.3100 (a)(4): The Commission adopted a rule that no person or entity may send commercial messages to wireless subscribers unless certain conditions are met, one of which is that “the address to which that message is sent or directed does not include a reference to a domain name that has been posted on the FCC’s wireless domain names list for a period of at least 30 days before that message was initiated, provided that the person or entity does not knowingly initiate a mobile service commercial message.”

The Commission estimated that there are approximately 22,620,000 businesses in the United States. The Commission believes that, at most, one quarter of those businesses (5,655,000) send unwanted commercial electronic mail messages. Out of the 5,655,000 businesses, the Commission estimates that three quarters – 4,241,250 businesses (respondents) -- will comply with these rules by consulting the FCC’s public list of wireless mailing domain names to purge their marketing lists. The Commission believes that 5 percent (212,063) of these 4,241,250 respondents will hire outside consultants to do so, so that only 4,029,187 will consult the list themselves:

This process will be done on “on occasion” and will require approximately 4 hours annually for the 4,029,187 respondents to check periodically the wireless domain name list.

Annual Number of Respondents: 4,0291,187 businesses

Annual Number of Responses: 4,0291,187 Domain Name List

Annual Burden Hours:

4,029,187 respondents x 1 domain name list check/respondent x 4 hours/list check/respondent = 16,116,748 hours

Annual In House Cost: The Commission assumes that respondents use “in house” personnel to check periodically the wireless domain name list, whose pay is comparable to a federal employee GS- 3/1, plus 30% overhead. Thus, the Commission estimates respondents’ cost to be about $16.08 per hour to comply with the requirements:

4,029,187 respondents x 1 domain name list check/respondent x 4 hours/list check/respondent x $16.08= $259,157,307.84

(c)(i) 47 CFR § 64.3100(f): CMRS providers are responsible for the continuing accuracy and

completeness of information furnished for the FCC’s wireless domain names list.

The Commission estimates that there will be approximately 350 wireless carriers (respondents) at most that will supply mailing domain names to the Commission, which will take approximately 1 hour per respondent.

Annual Number of Respondent: 350 Wireless Carriers

Annual Number of Responses: 350 Mailing Domain Name List Requirements

Annual Burden Hours:

350 respondents x 1 mailing requirement/respondent x 1 hour to supply mailing domain names/respondent = 350 hours

Annual “In House Cost”: The Commission assumes that respondents use “in house” personnel to obtain authorization whose pay is comparable to a federal employee GS- 3/1, plus 30% overhead. Thus, the Commission estimates respondents’ cost to be about $16.08 per hour to comply with the requirements:

350 respondents x 1 mailing requirement/respondent x 1 hour to supply mailing domain names/respondent x $16.08 = $5,628.00

Total Number of Annual Respondents:

1,413,750 businesses + 4,029,187 businesses + 350 carriers = 5,443,287 businesses/carriers (respondents)

Total Number of Annual Responses:

1,413,750 authorizations + 4,029,187 domain list checks + 350 mailing requirements = 5,443,287

Total Annual Burden Hours:

14,137,500 hours + 16,116,748 hours + 350 hours = 30,254,598 hours

Total In-House Costs:

$227,331,000 + $259,157,307.84 + $5,628.00 = $486,493,935.84

13. The potential cost to senders of commercial mail messages of complying with these rules may depend on whether they hire a third party to set up a system to remove the electronic mail addresses on their own marketing lists which contain those domain names on the wireless domain name list. It is unclear how many senders may hire third parties to check their marketing lists to make sure they do not contain such wireless domain names unless permission has been obtained. However, the Commission estimates that approximately 5 percent (0.05) of senders may hire a third party to perform this function. Thus, the following represents the Commission’s estimate of the annual cost burden to respondents or record keepers resulting from all the foregoing collections of information.

(a) Total annualized capital/start-up costs, calculated as follows: $0

(b) Total annual costs (maintenance and operation), calculated as follows:

212,063 senders (5% of 4,241,250) x 1 list check/respondent x $16.08/hour x 4 hours/list check = $13,639,892

(c) Total annualized cost requested: $13,639,892

14. The FCC administers the wireless domain name list “in house” (using Commission staff):

(a) the Commission will use technical support staff at the GS-13/Step 5 level, to post the domain name list to the FCC website, and we estimate the time to process each carrier domain name list to be approximately 15 minutes (0.25 hours); and

(b) the Commission will use staff attorneys at the GS-14/Step 5 level, to write the rulemakings that may be necessary to keep its CAN-SPAM rules current with revisions to the FTC’s CAN-SPAM rules and any changes in technology used in sending commercial messages to wireless devices. The Commission estimates the time to write each Order to be approximately 80 hours.

On average, the Commission estimates that CMRS providers will send the FCC their domain list postings approximately 4 times a year, thus:

350 domain name lists x 0.25 hours/posting x $43.12/hour = $ 3,773.00

4 rulemakings x 80 hours/rulemaking x $50.95/hour = $16,304.00 30% Overhead = $ 6,023.10

Total Cost to the Federal Government: $26,100.10

15. The Commission has re-evaluated its previous assessments of the various burdens for this

information collection for the existing information collection requirements. Due to this re-evaluation:

(a) the Commission estimated the number of respondents decreased from 11,027,600 to 5,443,287;

(b) the Commission estimated the number of responses decreased from 11,027,600 to 5,443,287;

(c) the Commission estimated the total annual hourly burdens decreased from 115,645,100 to 30,254,598

(d) the Commission estimated the total annualized cost burden decreased $37,105,000 to $13,639,892.

There are no program changes to the information collection.

16. There are no plans to publish the result of the collection of information.

17. The Commission does not intend to seek approval not to display the expiration date for OMB approval of this information.

18. In the 60 day Federal Register notice (Notice) published on August 8, 2007 (72 FR 44529), the Commission reported the total number of respondents to be 11,027,600, the total annual hourly burden to be 115,645,100 and the total annualized cost to be $37,105,283. The Commission corrects the total number of respondents to 5,443,287 respondents, the total annual burden hours to 30,254,598 hours and the total annualized costs to $13,639,892. The Commission also reported the estimated time per response in its Notice as “1 - 11 hours.” The Commission corrects those numbers to read “1 – 10 hours.” Also, individuals are apart of this information collection. Lastly, the obligation to respond is “required to obtain or retain benefits” instead of “mandatory” which was reported in the Commission’s Notice.

There are no other exceptions to the Certification Statement in Item 19, “Certification for Paperwork Reduction Act Submissions,” of OMB Form 83-I.

B. Collections of Information Employing Statistical Methods.

The Commission does not anticipate that the collection of information will employ statistical methods.

4 A “commercial electronic mail message” means the term as defined in the CAN-SPAM Act, 15 U.S.C. § 7702. The term is defined as “an electronic message for which the primary purpose is commercial advertisement or promotion of a commercial product of service (including content on an Internet website operated for a commercial purpose).” The term “commercial electronic mail message” does not include a transactional or relationship message. See 47 C.F.R. § 64.3100(c)(2).

2 “Mobile Service Commercial Message” means a commercial electronic mail message that is transmitted directly to a wireless device that is utilized by a subscriber of a commercial mobile service (as such term is defined in section 332(d) of the Communications Act of 1934 (47 U.S.C. 332(d))) in connection with such service. A commercial message is presumed to be a mobile service commercial message if it is sent or directed to any address containing a reference, whether or not displayed, to an Internet domain listed on the FCC’s wireless domain names list. See 47 C.F.R. 64.3100(c)(7).

3 The Commission notes that it has required, under 47 CFR § 64.3100(b), that any person or entity initiating any mobile service commercial message must: (1) Include a functioning return electronic mail address or other Internet-based mechanism that is clearly and conspicuously displayed for the purpose of receiving requests to cease the initiating of mobile service commercial messages and/or commercial electronic mail messages; (2) Provide to a recipient who electronically grants express prior authorization to send commercial electronic mail messages with a functioning option and clear and conspicuous instructions to reject further messages by the same electronic means that was used to obtain authorization. 47 CFR § 64.3100(b)(3); (The Commission notes that this is a technical requirement. If a company allows a consumer to provide authorization through other technologies—such as a three letter code which speed-dials them into the company’s e-mail system, the company must also permit the consumer to revoke the authorization using the same method. The Commission will not collect any data as a result of this requirement); and (3) Identify themselves in the message in a form that will allow a subscriber to reasonably determine that the sender is the authorized entity. 47 CFR § 64.3100(b)(5). (The Commission already requires that the entity identify itself to the wireless user.)

4 Under 47 CFR § 64.3100(c)(3), a domain name means any alphanumeric designation which is registered with or assigned by any domain name registrar, domain name registry, or other domain name registration authority as part of an electronic address on the Internet.

5 Under 47 CFR § 64.3100(c)(1), a Commercial Mobile Radio Service (CMRS) Provider means any provider that offers service defined in 47 CFR § 20.9.

6 Rules and Regulations Implementing the Controlling the Assault of Non-Solicited Pornography and Marketing Act of 2003; Rules and Regulations Implementing the Telephone Consumer Protection Act of 1991, CG Docket Nos. 04-53 and 02-273, Order, 20 FCC Rcd 5931 (2005).

10