John Lewis fined over spam emails | Hacker News Reader

John Lewis fined over spam emails

thedrum.com

68 pointsiamben59 comments

This comment right below the article: "Using pre-populated opt-in boxes now means breaking the law?"

Yes. It does mean exactly that. You need my permission to send me unsollicited marketing emails. The law (at least here in the EU) is very clear about that.

I'm a marketer, and I never understand why companies do this. I'd much, much rather have a smaller list of people who actively signed up for my emails than a large list of people who you've conned into subscribing. CTR and conversion on these lists are rubbish, and annoying people is never a good tactic for a long-term business relationship. This goes the same for people who you've done business with. If they did not actively sign up for your newsletter you should't send it to them. Legal or not.

The best way to grow a high-quality list? Let people subscribe to it (opt-in, not opt-out) and if they didn't engage/open the email for the past 5-10 newsletters or so, inform them they'll be bumped off the list. In a friendly way, of course, but still.

And, err, how is a “pre-populated opt-in box” not exactly the same as opt-out? In order not to receive spam, the user has to take an action (i.e. opt out) by unticking the box.

    >>> "Using pre-populated opt-in boxes now means breaking
    >>> the law?"

    >> Yes. It does mean exactly that. You need my permission
    >> to send me unsolicited marketing emails.

    > ... how is a "pre-populated opt-in box" not exactly
    > the same as opt-out? In order not to receive spam,
    > the user has to take an action (i.e. opt out) by
    > unticking the box.

A "pre-populated opt-in box" is exactly the same as opt-out.

EU law requires opt-in. Having opt-out is not lawful.

Thus having a pre-populated opt-in box is breaking the law.

Added in edit: I didn't down-vote you. I have little doubt that others share your confusion, and hence your question adds value. In fact, I've now up-voted you.

>EU law requires opt-in. Having opt-out is not lawful.

And that's all there is to it. There is no room for confusion here guys.

I don't even think that claudius misunderstood. We're getting so used to beginning a sentence with "and" as an affectation that we're losing the ability to recognize it as a continuation.

Thank you :) I was after some reason why one could possibly think this to be opt-in rather than opt-out, but it appears that there truly is none.

It is exactly the same. In fact:

- Opt-out: user has to take action to NOT receive emails

- Opt-in: user has to take action to receive emails

- Double opt-in: user has to take action AND confirm his/her email address.

The double opt-in process ensures that the person who submitted the form on your website is indeed the recipient of the email address. It's not mandatory by law but good practice.

These laws exist in the EU to protect the customer. The OPTA has the power to make you pay a hefty fine (up to €450,000) for sending spam. Unfortunately, these laws do not apply for business to business relationships. In B2B, your company can still send my company unsollicited emails without breaking the law.

The irony of ironies - this is exactly what you see when you try to post a comment on that article:

http://imgur.com/4w3uZzZ

> John Lewis argued that because I had not opted-out of receiving their emails, I had automatically opted-in.

I phoned a company which spammed me a few years ago. I had a long conversation with an annoying man in marketing who assured me it was all perfectly legal because they had an "unsubscribe" link in the email, and it worked! I pointed out that he also needed my consent to email me, but he was having none of it. I'm not sure if he was genuinely confused or conveniently misinterpreting the law. I hope this ruling helps to focus his and others' attention on what's legal rather than just expedient.

I had a bit of a fun exercise that I unfortunately didn't follow through on a while back. A computer parts retailer started sending me spam, so I replied along the lines of:

---

Thankyou for contacting the xxxxx proofreading service. Thankyou for choosing this service, providing efficient and accurate proofreading services for all users of email advertising. To use this service, simply send emails to be proofread to xxx@xxx. Proofreading services will be charged at £200 per email, and payment is due within one month of receiving an invoice. By sending emails to be checked, you agree to the charges, and you agree that the primary point of contact for yourselves is the email address from which the emails originate. Results and invoices will be sent to this address, so make sure it is valid. Please do not send emails if you do not agree to these points.

Since you are a new customer, this first email is proofread below for free:

---

Their email didn't mention that their sending email address would not receive, and British contract law has a presumption that communication that is sent is received, so when they followed up with ten or so subsequent spams, all of which I proofread, I probably would have had a fairly strong case in court to be paid for my work. Especially given one of their emails had "[pre-send]" in the subject line. It's kind of a shame I didn't take it any further than emailing invoices.

For a legally binding contract to be in place don't you need an offer and acceptance - and silence generally isn't consider acceptance?

That's the point - they weren't silent. They continued to send emails.

I’m really interested to know if that would stand up in court

There is some relevant precedent in Dutch courts over this. If you have a fine clause for spamming, and you provide the terms of conditions in a proper manner, both can be enforced by a judge.

In one case ("zaaknummer 676425") a community website got awarded 5000Euro in penalties (500Euro for every private spam message, up to maximum of 5000Euro). The website had put a penalty clause for spamming in their terms of conditions, and continued use of the service meant agreeing to their conditions.

With law it is about intent too. If you try tricks like a proof-reading service, a judge may frown on that or find it silly. But if you send back your terms of service stating: "I charge a freelance administrative fee of 50Euro for reading, evaluating, and storing commercial communication that is send to this e-mail address without explicit opt-in permission. Unsolicited e-mail can be send to this alternative address." and yet they continue, it could stand up in Dutch court (and may earn them a bigger fine for breaking Telecom laws).

Almost assuredly not. Where did they agree?

Just because I define a series of steps that constitutes them agreeing with the contract I design, it doesn't mean that following those steps means they agree.

Absurd example: if the New York Times continues to publish, they agree to pay me $1000 a day. (This example is missing consideration[1] but you can imagine that in yourself. It's an absurd example anyway.)

[1] http://en.wikipedia.org/wiki/Consideration

Sure, I agree with you, the courts would most certainly not rule in favor of a judgement of £200 per e-mail, but I'm sure that's not the point.

They "consented to be billed for proofreading services" every bit as much as this person "consented to receive their spam marketing e-mails". In other words, not at any time or in any reasonable form that could have been construed as consenting or agreement.

I have no doubt the point of the joke was lost on the spammers/marketers, even if they even ever actually saw those terms and associated invoices.

If I want to make a comment on your website, and you have a form auto-checked that lets you send me spam, I have at least a choice, and it was something that, in your absence, I wouldn't automatically have a right to do.

Now the question arises: do I have a right to send things to your inbox? You certainly have created an interface with an API that I am obeying, but I've never liked treating APIs as legal constructs (although many of my fellow nerds wish it were so) so it doesn't necessarily follow.

There is one issue with lack of notification. I could say that anyone who goes on my property owes me $500,000 for the pleasure of being on my property. I could even send registered mail to every person on the country to inform them of this rule. I don't think walking on my property indicates agreement, because even if they read and internalized my mail they have no way of remembering.

I really don't know where I'm going with this.

It's really just posturing; hypothetically, going with your example you don't send those letters because you want or expect to get $500,000 from each uninvited guest, you send them because when you find the intruders on your property unauthorized you're going to be able to fire a round into the air and tell them "this is your second warning".

The goal is to get them to leave, or to never even come. Unless you were really trolling for $500,000. To part with that example, the law in question here specifically regarding inboxes requires opt-in, so only providing an interface to opt-out is directly against the law.

There is definitely no compatible land-owner analogy: if you greeted people at the border of your property and made them sign a declaration that they would pay you $500,000 for this temporary use of your property, you might have a case. They opted in.

I have a harder time imagining a judge who would see it your way when "you spent the $200 million required to reach every person and you said very clearly, 'your presence on my property constitutes acceptance of these terms,' so by law you should get the $500,000."

The two examples are not equivalent. One is about whether or not a contract is formed, which requires specific steps under English law (roughly: offer, acceptance and consideration).

The other (consent to receive spam emails) has nothing to do with contract law.

We can probably at least agree that two wrongs don't make a right... they are not equivalent but both are wrong according to the law, if not totally illegal. In fact I'm no English law expert, but I'd wager that while the spamming is actually illegal according to the law and the judge, the invoices GP proposed are simply unenforceable and not actually against the law.

Under US law they were probably correct. CAN-SPAM Act does not require consent. (Though it does require more than just a working unsubscribe)

UK law, in my case. You need consent and recipient must be able to unsubscribe.

Some parts of this are also covered under the Data Protection Act, which is generally taken very seriously (by government, at least) in the UK. You can only use data for the purpose for which it was collected. So just because you have my email address for sending me updates about my order, doesn't mean you can email me with offers unless I agreed to that.

Irony is that when you try to comment The Drum will ask for your email address - and then have a pre-ticked input box for their daily newsletter.

Edit: Was already pointed out elsewhere: https://news.ycombinator.com/item?id=7839398

Sometimes you need to do a little bit of investigation of your own to see what the real story is and, with Sky News, that is definitely highly advised.

Turns out that the producer has a track record of trying to get 'damages' for this. Here is one incident starring the same Roddy character:

http://www.marketingweek.co.uk/disciplines/direct-marketing/...

You might not like it but the convention is to have the newsletter sign up box checked. It has been that way for almost two decades now. It is not as if this Roddy character is some blind 83 year old woman terrified by John Lewis newsletters, he specifically created an account on the John Lewis website to specifically get the newsletter specifically so he could take them to court and get damages.

It is actually relatively hard to sign up to the John Lewis newsletter, you need to create an account as they don't have a 'subscribe' box on their homepage. Furthermore, creating an account is something you would only do if you were making a purchase or specifically wanting to subscribe to their newsletter.

I think that the Roddy character is the scam artist here and I despise his ilk, not only has he sold his soul to work for the evil Murdoch empire he is also a troll.

It sounds like using the legal system as a regulation system. Instead of the government needing to go look into everyone's business, it lets recipients become regulators by giving them the ability to extract fines.

Did you mean to post a different link? That appears to be discussing the same case.

Pre-ticked boxes signing you into "interesting" marketing propaganda are the pits, no argument here.

But what is even worse is when (for example) you book a flight and the airline adds some totally useless "insurance" to your booking. Bangkok Airways comes to mind. This scheme is outright dirty, if not borderline fraudulent.

With some pre-ticked box hidden deeply in the form.

While I believe this to be illegal in Europe it's apparently not around the world.

The tactic is loathsome and still the amounts are relatively small, so that it's not worth it to complain to your credit card company. Plus: hey! you agreed to the crappy, useless insurance to begin with.

Here is how RyanAir do it - one hell of an anti-pattern:

https://imgur.com/zh95qHq

I think companies which use weird double negative language by these options on forms aught to be penalised.

[ / ] uncheck this box if you don't not agree.

Or the ones that have two boxes, one positive and one negative:

    [x] Send me marketing emails
    [ ] Don't pass my email on to third party spammers

or the ones that do something like:

    [ ] Accept terms and conditions and send me marketing emails*
    *required

I'm mostly surprised that this didn't count as an existing 'business relationship', which has always been enough in the UK to send marketing emails to someone. The guy registered with the John Lewis website, and the only reason to do so is to purchase something. An odd case in my opinion.

The article says:

unless it can be proven that the recipient consented to them or was a customer – with John Lewis unable to satisfy either requirement

So it sounds like in this case he didn't actually purchase anything.

I've never been a big fan of the "existing business relationship" rule. It basically means I have to click an unsubscribe link once for every company I buy from.

When does an "existing business relationship" end? If I buy a £1 widget for auntieswidgetstore.co.uk, do they have an "existing business relationship" until the day I die?

In my books, once payment has been made, the goods received, and the sales contract completed, the business relationship is over. Comments? Anyone here a (British) lawyer?

IANAL but the ICO has a readable summary. They say you should be given a simple way to opt out in every communication:

from http://ico.org.uk/concerns/marketing/11

The law says that marketers are allowed to send marketing messages if:

the marketer has obtained your details through a sale or negotiations for a sale (this includes asking for a quote); the messages are about similar products or services offered by the sender; and you were given an opportunity to refuse the marketing when your details were collected and, if you did not refuse, you were given a simple way to opt out in every future communication.

To me it sounds like John Lewis met all of those conditions. I can see there might be some grey area in the first one. But I would argue that when the guy signed up on their site, he was at least taking the first step in negotiations for a sale. But it seems John Lewis argued that and lost so I guess I would lose too.

Edit to add: I do think that pre-checked opt-ins are a bit sleazy.

What if there's a recall of those widgets? What if the company's DB is compromised and they need to notify you of a possible privacy breach? There has to be some leeway for contacting someone with whom you've done business online.

EU law makes a distinction between service emails and emails with a commercial message.

A recall message (we've noticed a problem with a widget you have) is perfectly legal, while a message like "since you're an avid user of our widget we present you widget v2" isn't.

Do you expect any kind of warranty with your widget? Should the relationship be considered to be ongoing if you might go back in the future for service or advice?

You might just want to maintain a wish list which others can make use of. There might be other legitimate reasons for having a user account and not a 'business relationship'. I’ve always been taught that 'opt out' is illegal, so this is a welcome ruling, IMO.

Perhaps if companies and web-marketers could capture how disinclined I am to buy stuff from companies that spam me - then this would stop.

I guess they can't AB test that type of unseen negative. But you would think they might speculate based on their own experience?

> But you would think they might speculate based on their own experience?

Yes, but they speculate based on their own experience of what happens to their bottom line, not to what happens with their inbox.

And they find that there are few people like you and a whole bunch of people that still respond to advertising, no matter how sleazy, un-sollicited, un-wanted and in general insulting. As long as that doesn't change spam is here to stay. Which probably means it is here to stay forever.

I am sick of companies that abuse consent. For example, one online retailer - from whom I have only ever made one purchase, which was returned, due to poor quality - regularly sends 3-8 emails a month.

Further, their unsubscribe form actually resulted in another spam message.

It's almost a guarantee that when you buy a single item from a retailer, ensuring you uncheck/check properly all the boxes, you will be bombarded with promotional marketing emails from them forever.

This is why you set up a email address at your own domain, and give any company asking for your email <company.domain>@<your.domain>

(And possibly complain publicly when unsubscribe links don't work)

Some email providers ignore '+' signs and periods in email addresses, but more and more companies have gotten wise to that.

I've found an increasing number of sites use validation preventing the use of '+' in email addresses (which I used extensively when on Gmail). To get around this, I use a feature of Fastmail to give me something similar - <myname>@<company>.<my.domain>. By putting the unique part in the domain, it's less likely to be stopped by a fussy validator. Combine with some of their auto-filtering and I have an easy way to track who's abusing their ability to mail me, and to take action appropriately.

These sorts of practices are despicable to say the least, and I'm glad to see the EU is actively fighting against them (or at least more so than most).

Oddly enough however, this gets attention while the same ideas applied in real life don't. The forceful behavior of advertisers and marketers everywhere seems to get little notice, despite people like Banksy, among others, trying to speak out [1].

Similarly, a friend and I went to the movies recently and noticed that while seat prices have gone up considerably over the years, you now also get a good fifteen minutes of adverts right before the movie starts. Why should I pay twice (actively and passively)? At no point before or during the purchase process was I told that I'd have adverts shoved down my throat.

I keep hoping that advertising is a necessary evil leading to the greater benefit, but one can dream... [2]

[1] http://www.readingfrenzy.com/ledger/2012/03/taking_the_piss

[2] https://news.ycombinator.com/item?id=6800312

Perhaps we could use a similar law for software that says you have to opt-in for that. If you try to install Adobe Reader on a Windows PC, for instance, you have to untick to install the Ask! toolbar. I don’t like that

I hate spam as much as the next guy, but this is more of a case of the plaintiff not reading before he clicks and agrees to things. We all do it, but we don't then sue a company for it. I really wish a ruling like this was made on a case in which there was no opt-in, but this guy (even by his IN-action of NOT un-ticking the box) opted in.

You don't understand what Opt In means. In any case, EU law is pretty clear on this.

You should always use double opt-in. There's really no reason to not use it. Your open rates and click throughs will be much higher and you will get far fewer people flagging it as spam.

A project manager onced asked my team for an opt-in checkbox that, once checked, would disappear and never be shown again. Thankfully, we managed to talk him out of it.

Deleted comment

The few bad apples have historically always spoilt it for the good people. So even if you're entitled to your opinion you can bet that there will be more laws rather than fewer, and that these laws will predominantly affect the good parties while occasionally allowing a bad party to be affected. (the latter would need a fortunate alignment of jurisdiction wrt to perp, medium and target).

It's a pity, but that's how it is. If you feel like blaming someone for this aim at those that would rather abuse a gift of freedom at the expense of others and those that would use such abuse to curb everybody's freedoms. The rest of us are caught in the crossfire between greed and excuses.

The one thing that concerns me about this ruling is:

"As Mansfield was unaware that he had been opted-in the court ruled in his favour however."

How on earth does one prove they were unaware that they were opted-in?

If it were a true opt-in without a pre-checked input as suggested then it becomes a moot point surely.

It is very unlikely someone would opt in by accident if the box was unticked by default.

This is great news. Particularly as John Lewis has a supposedly trustworthy brand but in reality they're an importer and shit shoveler with an insane markup and abysmal service. So many problems with them over the years that I'd rather shop in Argos.

Corporate true colours shining through here.

On the other hand, John Lewis is employee-owned and regularly pays out at least one additional monthly paycheck in profits per year. I shop mostly in Waitrose (a subsidiary), and as long as their service is excellent and their food real (e.g. they had the least problems of all UK retailers (with the possible exception of Whole Foods) in the horse-meat scandal), I will gladly pay their higher-than-normal margins (though it's not much more expensive than Tesco).

The problem I have is that in the space of a year I've had to return and get refunded:

1. A sofa that the frame broke on (their own brand one at £2600).

2. Two pairs of own brand children's shoes which didn't even last a day without splitting or the lining coming out.

3. A cot that cracked down one side.

As far as returns go, I was accused on the children's shoe returns of lying about them despite returning them the very next day after being worn for only an hour. The sofa died after a month and I had to go via the credit card company because I was told that they couldnt replace it and it was end of line so they were at a stalemate with their supplier. The cot, took three letters and a small claims summons to get them to replace.

Also one fine evening, I needed an SD card for my camera. JL being the only place open, I went in there. £55 for 2x no brand 8Gb SD cards. And they wouldn't price march maplin selling them for £28 round the corner which was overpriced.

Complaints about the above resulted in "we're sorry but there's nothing we can do".

As for Waitrose I rather like to not have my meat's throat cut and hung upside down to bleed out but they don't mark that up in there. They do in Morrisons. As for horse meat, that's what you get if you buy preprocessed foods. Just don't buy them.

Reply on news.ycombinator.com