One of the first state anti-spam laws in the United States, enacted by Washington State in 1998 and codified at chapter 19.190 of the Revised Code of Washington. The law prohibits sending a commercial email message that contains a false or misleading subject line, misrepresents its point of origin, or uses a third party’s domain name without permission, when the message is sent from a computer located in Washington or to an email address held by a Washington resident.
For years, CEMA sat in the shadow of the federal Controlling the Assault of Non-Solicited Pornography and Marketing (CAN-SPAM) Act. Congress preempted most state email regulation in 2003, but it explicitly carved out state laws that prohibit falsity or deception in commercial messages. That carve-out is exactly where CEMA lives, and it has turned a 1998 statute into one of the most consequential email marketing laws in the country.
What CEMA Prohibits
CEMA applies to commercial email sent from a computer located in Washington or to an email address that the sender knows, or has reason to know, belongs to a Washington resident. A covered message violates the statute if it contains any of the following:
- A false or misleading subject line: the provision driving nearly all modern CEMA litigation. Courts have applied it to manufactured urgency, countdowns and deadlines that pass without the offer ending, and discount claims that do not match the actual pricing.
- A misrepresented or obscured transmission path: falsifying header information or otherwise hiding the message’s point of origin, the classic spammer behavior the law was originally written to stop.
- An unauthorized third-party domain name: sending from, or routing replies through, a domain the sender has no permission to use.
A 2003 amendment extended the statute beyond the inbox: it is also illegal to send unsolicited commercial text messages over Short Message Service (SMS) to Washington residents’ phones. While the email provisions target deception, the text message provision is consent-based and closer in spirit to the federal Telephone Consumer Protection Act (TCPA).
The reason-to-know standard matters for marketers. A sender does not need to be certain that a recipient lives in Washington. The statute presumes knowledge when residency information is available on request from the registrant of the domain in the recipient’s email address, and plaintiffs routinely point to signup data, such as mailing addresses and ZIP codes stored in an Email Service Provider (ESP), to show that a national brand had reason to know.
Penalties and Enforcement
CEMA declares every violation a per se unfair or deceptive practice under Washington’s Consumer Protection Act, which opens the door to both attorney general enforcement and private lawsuits. The remedies are what make the statute dangerous:
- $500 per message for recipients: recipients recover the greater of $500 or actual damages for each violating email, with no requirement to prove financial harm.
- $1,000 per message for providers: an Internet Service Provider (ISP) whose network carries the offending messages recovers the greater of $1,000 or actual damages per message.
- No damages cap: liability scales with list size and send frequency, so a routine promotional calendar aimed at a large consumer list can generate enormous statutory exposure.
- A private right of action: unlike CAN-SPAM, which individual recipients cannot sue under, CEMA lets any Washington recipient sue, which is why it became a class-action vehicle.
The statute survived its constitutional challenge early on. In State v. Heckel (2001), the Washington Supreme Court upheld CEMA against a dormant Commerce Clause challenge, making it the first state anti-spam law validated by a state’s highest court.
CEMA vs. CAN-SPAM
Marketers often assume CAN-SPAM compliance covers them nationwide. The two laws answer different questions: CAN-SPAM regulates how you send commercial email, while CEMA polices whether what you say in it is true.
| Aspect | CEMA (Washington) | CAN-SPAM (Federal) |
| Scope | Email sent to Washington residents or from Washington computers | All commercial email in the United States |
| Legal theory | Deception: false subject lines, falsified origin, unauthorized domains | Opt-out mechanics, sender identification, and deceptive headers |
| Who can sue | Any recipient, plus ISPs and the state attorney general | No private right of action for recipients; enforced by the FTC, state attorneys general, and ISPs |
| Damages | Statutory: $500 per email for recipients, $1,000 per email for ISPs, uncapped | Civil penalties per violation, assessed by regulators |
| Text messages | Bans unsolicited commercial texts to Washington residents | Not covered; the TCPA governs texts federally |
| Preemption | Survives CAN-SPAM through the falsity and deception carve-out | Preempts state email laws except those targeting falsity or deception |
The Class Action Revival
After CAN-SPAM passed, CEMA went quiet for nearly two decades. Plaintiffs’ attorneys rediscovered it in the 2020s with a simple theory: promotional subject lines that manufacture false urgency are misleading information in a subject line, exactly what the statute prohibits.
The highest-profile example is the litigation against Old Navy in federal court in Washington, where subject lines promoted sales ending in hours that, in fact, continued for days or never ended at all. Courts allowed those claims to proceed, and similar class actions followed against other national retailers. The math explains the stakes: at $500 per message, a brand emailing a few hundred thousand Washington subscribers several times a week accumulates theoretical exposure in the billions within a single year.
Why CEMA Matters to Email Marketers
No mainstream email program can reliably exclude Washington residents, so CEMA effectively sets a national floor for subject line honesty. Practical compliance looks like this:
- Make deadlines real: if the subject line says the sale ends tonight, the sale must end tonight. Recurring or perpetual promotions dressed up as expiring offers are the exact fact pattern courts have already allowed to proceed as class actions.
- Match the subject line to the offer: percentage-off claims, free shipping thresholds, and product availability promised in the subject line must be accurate for the recipient who opens the message.
- Keep sender identity authentic: the From name and sending domain should identify the actual sender, and affiliate or partner sends need explicit permission to use another party’s domain.
- Get consent before texting: commercial SMS to Washington numbers requires clear, affirmative consent in addition to federal TCPA obligations.
- Audit urgency automation: countdown timers, resend-to-non-opener flows, and evergreen last chance campaigns should be reviewed against what the offer actually does.
CEMA’s lesson reaches beyond one state’s statute: deception in the inbox is no longer a soft brand risk; it is a quantifiable liability priced at $500 per send. A truthful creative review is cheaper than any settlement.
