What can states (and state-funded organizations) regulate?
The answer to this question ultimately depends on the extent to which courts interpret state anti-spam regulations to be preempted by the CAN-SPAM Act.
The U.S. Court of Appeals for the Fifth Circuit has determined that, where a state actor (such as a state university) is also an "internet access service" provider, there is a conflict or ambiguity in the preemption provisions. See White Buffalo Ventures v. University of Texas at Austin, 420 F.3d 366 (5th Cir. 2005). This means that, under similar circumstances (at least in the Fifth Circuit), a state university's anti-solicitation IT policy (which may prescribe the blocking of spam emails) will likely survive a preemption challenge.
Courts have held that the following state law claims survive CAN-SPAM preemption analysis: claims for violation of consumer protection acts, deceptive content, and ISP claims for fraud and deception. See Asis Internet Services v. Consumerbargaingiveaways, 622 F. Supp.2d 935 (N.D. Cal. 2009); Asis Internet Services v. Vistaprint USA, 617 F. Supp.2d 989 (N.D. Cal. 2009); Gordon v. Impulse Marketing Group, 375 F. Supp.2d 1040 (E.D. Wash. 2005).
However, courts have also held that the CAN-SPAM Act preempts state law claims differing from CAN-SPAM Act provisions in ways that, if enforced, could create confusion about the law that applies to commercial email. See Ferguson v. Active Response Group, 348 Fed. Appx. 255 (9th Cir. 2009); Gordon v. Virtumundo, 575 F.3d 1040 (9th Cir. 2009); Omega World Travel v. Mummagraphics, 469 F.3d 348 (4th Cir. 2006).
See also CAN-SPAM Act of 2003: Preemption