The state email laws that still pay

By MercPrivacy · Published 2026-06-28 · Updated 2026-08-05

You cannot sue under the federal spam statute — but states still punish email that lies. Forged headers and misleading subjects carry $1,000 per email in California; the record decides everything.

The first thing anyone learns about spam email law is discouraging: the federal statute gives ordinary recipients no right to sue. The FTC can act, state attorneys general can act, mailbox providers can act — you, personally, cannot. We covered [why that is](https://mercprivacy.com/knowledge/why-you-cannot-sue-over-spam-email), and most people stop reading there, delete the junk, and assume the law holds nothing for them.

The second thing is the part almost nobody learns. When Congress passed the federal law it swept aside most state spam statutes — except the ones aimed at falsity and deception. That carve-out is written into the statute itself. States may not regulate honest commercial email, but they remain free to punish lies: forged headers, misleading subject lines, senders wearing someone else's name.

Which means the doorway to a private claim is not "I got spam." It is "I got spam that lied about what it was." And an enormous share of spam lies.

## Falsity is the doorway

Read your junk folder with that lens and the sorting goes quickly. An email from a retailer you once bought from, honestly labeled, with a working opt-out — annoying, lawful, and if it stops when you [unsubscribe](https://mercprivacy.com/knowledge/when-unsubscribe-is-safe), the system worked as designed. An email whose From line claims a brand its own headers cannot back up, or whose subject announces a delivery problem while the body sells something unrelated — that is not marketing with bad manners. That is the deception state law survived to reach.

The falsity is also unusually easy to document, because receiving mail servers grade every message on arrival. A failed authentication verdict, preserved in the original file, is a neutral machine recording that the sender is not who they claimed to be. If those words are unfamiliar, ten minutes with [SPF, DKIM and DMARC in plain English](https://mercprivacy.com/knowledge/spf-dkim-dmarc-plain-english) will pay for themselves.

## California: the workhorse

The strongest surviving state route is California's, Business and Professions Code section 17529.5. In plain terms:

- **What it reaches** — commercial email with falsified, misrepresented or forged header information, or a subject line calculated to mislead the recipient about the message's contents. - **What it sets** — liquidated damages of $1,000 per email, capped at $1,000,000 per incident. Liquidated means the amount is fixed by statute; you do not have to prove the email cost you money. - **Why it matters at volume** — spam is never one email. A campaign of forged messages, each one preserved, compounds into arithmetic that gets a sender's full attention.

Liquidated damages exist because spam's per-message harm is real but individually unprovable — nobody can invoice a sender for eleven seconds of stolen attention. The statute skips that argument by fixing the number in advance, which is what makes preservation, not injury, the practical center of these cases.

Part of the statute's practical force is that the anonymous sending machine is not the only thing in the picture: most campaigns exist to promote an identifiable business, and the beneficiary is usually far easier to find than the infrastructure.

> Congress closed the courthouse door on ordinary spam. The states left a window open for lies.

## Texas, and the honest map

Texas comes at the problem from the telemarketing side. Its consumer statutes carry a private action at $500 per violation, more where the conduct is willful, and the legislature strengthened the remedies effective September 2025. The boiler-room operations that forge email rarely confine themselves to one channel — when the email campaign has a calling or texting arm, the Texas remedies and the federal telephone rules come into play alongside the email analysis. Several other states maintain email statutes of their own aimed at deceptive practices; scope varies, and where a claim fits depends on the facts, including where you are and who sent what. The same logic generally holds for company inboxes — falsity statutes turn on the lie, not on who owns the mailbox.

One honest correction to the older internet lore: Washington State's email law, long cited as the most consumer-friendly in the country, was significantly weakened by recent amendments. Articles still circulating that promise a per-email recovery under Washington law describe a statute that no longer works that way. Treat any legal recipe more than a year or two old as unverified until checked — this field moves.

## What a claim actually requires

None of this converts irritation into money by itself. The situations that get evaluated seriously share three features:

1. **Preserved originals** — the .eml files with complete headers, not screenshots and not recollections. [Here is how to pull and save them](https://mercprivacy.com/knowledge/how-to-find-email-headers) in Gmail, Outlook and Apple Mail. 2. **Documented falsity** — failed authentication, forged sender identities, subject lines that misrepresent the body. The header block is where all of this lives. 3. **A pattern** — the same operation or the same advertised business across many messages and dates. Volume is what the liquidated-damages math runs on, and pattern is what separates a campaign from a stray.

Build the file as the mail arrives and the question "is this worth pursuing" becomes answerable by someone qualified to answer it. Wait and delete, and it never is. Claims of every kind also run on clocks — one more argument for building the record in real time instead of reconstructing it from memory later.

## What we would do with yours

Evaluating a spam corpus against the surviving state routes is exactly the analysis we run. Show the picture to [Stephanie](https://mercprivacy.com/stephanie) — instant and free — or call (830) 587-5011, and we will tell you honestly whether what you have is filter fodder or a file worth building, and [how the process works](https://mercprivacy.com/how-it-works) if it is the latter. We are not a law firm; when a matter requires legal representation, a licensed attorney is engaged.