address harvesting
Address harvesting is an automated system used to collect email addresses in bulk with the intent of sending Unsolicited Commercial Email (UCE), often referred to as spam. Address harvesting is performed without the knowledge or consent of the address owners. A report submitted by the Senate Committee on Commerce, Science, and Transportation defined address harvesting as the use of an “automatic address gathering program or process from a website or proprietary online service that has a policy of not sharing its users’ emails” in order to obtain email addresses for use in spam. Section 5(b) of the CAN-SPAM Act of 2003 codified at 15 U.S.C. Chapter 103, prohibits address harvesting, as well as other data collection techniques that Congress has found to be deceptive or fraudulent.
Title 15 U.S.C. § 7706 details the civil enforcement and potential penalties for those engaged in address harvesting. The Federal Trade Commission (FTC) is the administrative agency responsible for enforcing regulations. Aside from the standard mechanisms that the FTC has at its disposal, 15 U.S.C. § 7706(e) eliminates the FTC’s burden to show the requisite mental state of the offender to enforce compliance through a cease and desist or injunction. Additionally, 15 U.S.C. § 7706(f) creates a cause of action for states and allows for money damages. The amount of damages is equal to the amount of violations. Each unlawful email sent is a separate violation, multiplied by up to $250. For standard violations, damages are capped at $2,000,000; however, address harvesting is an aggravated violation. Title 15 U.S.C. § 7706 (f)(3)(C)(ii) allows for treble damages; this triples the maximum penalty to $6,000,000. Under 15 U.S.C. § 7706 (g), internet service providers (ISPs) can recover damages using the same formula that states use, but the maximum recovery is set to half of what a state may recover.
[Last reviewed in July of 2026 by the Wex Definitions Team]
Wex