Email Marketing

The Evolving Landscape of Digital Marketing Liability: Washington’s CEMA Reform and the New Era of Email Litigation

For two decades, Washington State’s Commercial Electronic Mail Act (CEMA) remained a dormant legislative relic. Enacted in 2005, the law was designed to curb spam, yet it sat largely ignored by the legal community, recording a mere eight lawsuits against major retailers in its first twenty years of existence. That era of complacency ended abruptly in April 2025, when the Washington Supreme Court issued a landmark ruling in Brown v. Old Navy.

The court’s decision transformed the regulatory landscape overnight. It established that a false or misleading subject line constituted a violation of CEMA per se, regardless of whether the recipient relied on the information or suffered any actual financial harm. Following that ruling, a floodgate of litigation opened. Within a single year, more than 100 class-action lawsuits were filed against retailers, each leveraging the law’s provision for $500 in statutory damages per email. Because CEMA violations were tied directly to the state’s Consumer Protection Act (CPA), plaintiffs could theoretically seek to treble those damages, creating an existential financial risk for companies with large mailing lists.

On June 11, 2026, the legislative pendulum swung back. With the enactment of HB 2274, signed by Governor Bob Ferguson on March 23, the state has fundamentally altered the economics and legal standards governing electronic marketing.


The Chronology of a Legal Storm

The recent legislative shift is the direct result of an unprecedented litigation frenzy that overwhelmed Washington’s court system. To understand the current climate, one must trace the timeline from the dormancy of the mid-2000s to the legislative intervention of 2026.

  • 2005–2024: CEMA exists as a quiet statute with minimal enforcement. Retailers operate with relative freedom regarding email subject line practices.
  • April 2025: The Washington Supreme Court rules in Brown v. Old Navy. The decision removes the "reliance" requirement, effectively making any "misleading" subject line a strictly liable offense.
  • May 2025 – May 2026: A litigation gold rush ensues. Plaintiffs’ firms file over 100 lawsuits, targeting "false urgency" claims—such as "Today Only" or "Ends Tonight" offers that persist beyond their stated deadlines.
  • May 19, 2026: In Liss v. Skechers, a federal judge denies a motion to dismiss, rejecting the defense that federal CAN-SPAM laws preempt state-level CEMA claims. This signals that the "old" $500-per-email rule will remain a potent weapon for ongoing cases.
  • June 11, 2026: HB 2274 officially takes effect. The rules of the game change, but the cutoff is determined by the date of the lawsuit’s filing, not the date the email was sent.

Supporting Data and the Economic Impact

The urgency behind HB 2274 was driven by the sheer scale of potential liability. Under the pre-reform regime, a retailer sending a marketing blast to 100,000 Washington residents with a subject line deemed "misleading" could face statutory damages of $50 million. Even without proof of actual harm to consumers, the per-email penalty structure created a "jackpot" litigation model that many argued was disconnected from the actual impact on the consumer.

The industry response was swift. Retailers argued that the vagueness of what constitutes a "misleading" subject line in a fast-paced retail environment—where flash sales are common—made it nearly impossible to comply with the high-stakes standard set by Brown v. Old Navy. The threat of treble damages under the Consumer Protection Act meant that a simple error in a marketing automation tool could lead to bankruptcy-level liabilities.


Key Regulatory Changes: A Two-Pronged Approach

HB 2274 introduces two fundamental changes that recalibrate the relationship between marketers and the law.

1. The Reduction of Statutory Damages

The most immediate relief for businesses is the reduction of statutory damages from $500 to $100 per email. While this remains a significant penalty for large-scale mailings, it represents an 80% reduction from the previous standard. Notably, the law preserves the right for plaintiffs to sue for "actual damages" if they can prove those losses exceed the statutory cap, ensuring that consumers who suffer genuine financial harm are not left without recourse.

2. The Shift to a "Knowledge" Standard

Perhaps more important than the reduction in damages is the change in the legal standard for liability. Previously, a subject line could be found misleading based on an objective, strict-liability standard. Under the new law, a plaintiff must demonstrate that the sender acted with "actual knowledge or knowledge fairly implied on the basis of objective circumstances."

This change effectively introduces a mens rea (guilty mind) component to CEMA. It protects companies from being penalized for unintentional errors or ambiguous phrasing, provided the sender did not intend to deceive or have clear reason to know the subject line was false. This shift moves the burden of proof closer to traditional fraud standards, making it substantially more difficult for plaintiffs to win summary judgments based solely on the text of an email.


Official Responses and Stakeholder Positions

The passage of HB 2274 was the result of intense lobbying by the business community, which characterized the post-2025 litigation environment as a "shakedown" of retailers. However, the legislation did not satisfy all parties.

Business lobbyists had initially pushed for a more comprehensive overhaul, including the total removal of the per se link to the Consumer Protection Act. That effort failed. By keeping the CPA link intact, the legislature signaled that it still views electronic mail marketing as a high-risk area for consumer protection.

Consumer advocacy groups, meanwhile, maintained that the $500 penalty was necessary to deter large corporations from using deceptive marketing tactics. They argue that $100 per email is a "cost of doing business" that major retailers can easily absorb, potentially leading to a return to the aggressive marketing tactics that characterized the pre-2025 era.


Implications for Future Litigation

The most critical takeaway for legal departments and marketing teams is the "cutoff" rule. Because the new law applies only to lawsuits filed on or after June 11, 2026, the legal system will operate under two distinct sets of rules for the foreseeable future.

Cases already on the docket—like Liss v. Skechers—remain under the shadow of the $500-per-email standard. These cases are essentially "legacy" risks. Plaintiffs’ firms rushed to file cases in the days leading up to June 11 to ensure they qualified for the higher statutory damages, creating a long tail of litigation that will likely occupy Washington courts for years to come.

The Outlook for 2027

Observers of the Washington legislature suggest that HB 2274 is merely the first installment of a longer, more complex legislative project. Because the law did not fully satisfy the business lobby—specifically regarding the CPA link—and because consumer advocates are likely to monitor the effectiveness of the $100 penalty, further amendments are widely expected in the 2027 session.

For now, marketers targeting Washington residents should:

  • Audit Internal Standards: Ensure that subject lines are reviewed not just for engagement, but for factual accuracy against the "knowledge" standard.
  • Document Processes: Maintain clear records of how subject lines are vetted to demonstrate a lack of "actual knowledge" of falsity.
  • Monitor Legal Developments: Stay tuned for the 2027 session, where the definition of "misleading" and the role of the Consumer Protection Act will likely be revisited.

In conclusion, while HB 2274 provides a vital cooling-off period for the retail sector, it does not mark the end of CEMA as a tool for litigation. Instead, it marks the transition of the law into a more nuanced, evidence-based phase. The era of easy, automated wins for plaintiffs is waning, but the regulatory scrutiny of digital communications remains as high as ever. Organizations that fail to adapt their internal compliance protocols to this new, intent-based reality do so at their own peril.