California B&P Code § 17529.5 Defense

Spoofing vs. Legitimate ESP Routing

Definition Under the Statute

§ 17529.5(a)(2)(A) targets email that contains "falsified, misrepresented, or forged header information." But the statute does not define these terms with technical precision, which creates the critical battleground for defense.

The defense position: standard ESP email routing is not, and has never been, "spoofing." It is how email works.

How Email Actually Works: ESP Routing

When a business sends email through a legitimate ESP, the email infrastructure works like this:

This is exactly how every major email platform operates. Mailchimp, SendGrid, Hive.co, Constant Contact, HubSpot, Klaviyo, and every other legitimate ESP route email in this manner. The visible From: field shows the sender's domain. The routing infrastructure reflects the ESP. This is not deception — it is standard architecture.

Why ESP Routing Is NOT Spoofing

1. SPF Records Explicitly Authorize the ESP

When a domain owner publishes an SPF record, they are telling the world: "These servers are authorized to send email on my behalf." This is a deliberate, affirmative act of authorization:

If the receiving mail server checks SPF and it passes, the sending server was authorized to deliver that email. There is no "forgery" — the domain owner explicitly blessed this routing.

2. DKIM Provides Cryptographic Verification

DomainKeys Identified Mail (DKIM) adds a digital signature to each email. The signature can be verified against a public key published in the sender's DNS:

• The sender's domain publishes a DKIM public key in DNS
• The ESP signs each outgoing email with the corresponding private key
• The recipient's mail server verifies the signature against the public key
• If DKIM passes, the email content has not been altered in transit and the sending domain authorized it

3. DMARC Alignment Confirms Everything

Domain-based Message Authentication, Reporting & Conformance (DMARC) ties SPF and DKIM together, ensuring alignment with the visible From: domain:

• SPF alignment: The domain in the Return-Path aligns with the From: domain
• DKIM alignment: The DKIM signing domain (d=) matches the From: domain
• DMARC pass: At least one alignment check passes — confirming the email is legitimate

What Actual Spoofing Looks Like

For contrast, here is what genuine email spoofing looks like — the scenario § 17529.5 was designed to address:

Case Law Analysis

Balsam v. Trancos (2012)

The court analyzed what constitutes "falsified" headers under § 17529.5. Key holdings:

• Headers must be actually falsified, not merely routed through a third party
• The fact that routing headers show an intermediary server does not make them "forged"
• The court distinguished between deceptive header manipulation and standard email infrastructure

Hypertouch v. ValueClick (2011)

Addressed misleading header analysis in the context of affiliate marketing email:

• Court examined whether headers "misrepresented" the sender's identity
• Analyzed the relationship between the advertiser, the affiliate, and the email sender
• Headers that accurately reflect the sending infrastructure, even through intermediaries, are not inherently "misrepresented"

Asis Internet Services v. Optin Global (N.D. Cal.)

Federal court addressed authentication records as evidence in a § 17529.5 context:

• Authentication records (SPF, DKIM) are relevant evidence of whether headers were falsified
• Passing authentication tests supports the defense position that headers are legitimate
• The court recognized that modern email authentication standards are probative on the question of header integrity

Standing & Venue Requirements

Who Can Sue Under § 17529.5

The statute creates a private right of action for two categories of plaintiffs:

1. Electronic Mail Service Providers (ISPs)

• Definition: An entity that provides email services to end users — hosting email accounts, processing inbound/outbound email
• Injury theory: The ISP's infrastructure was burdened by processing spam emails
• Examples: Companies operating mail servers (e.g., hosting providers with email services)
• Challenge: Verify the plaintiff actually operates as an ISP and was injured in that capacity

2. Actual Recipients

• Definition: The person who actually received the email at their email address
• Key requirement: The plaintiff must be the actual recipient, not a downstream party
• Challenge: Verify the email address actually belongs to the named plaintiff

Standing Challenges: Professional Plaintiffs

Indicators of Professional Plaintiffs

• Multiple lawsuits: The plaintiff has filed numerous § 17529.5 cases against different defendants
• Purpose-built email addresses: Email accounts created with no purpose other than receiving marketing email
• Deliberate subscription: Evidence the plaintiff affirmatively signed up for email lists or used catch-all domains
• No actual harm: Plaintiff cannot articulate any concrete injury beyond "receiving an email"
• Boilerplate complaints: Identical or nearly identical complaint language across multiple cases

Key Standing Case Law

Case	Holding	Defense Application
Balsam v. Tucows	Analyzed standing requirements for § 17529.5 plaintiffs; scrutinized whether plaintiff qualified as an ISP or actual recipient	Challenge plaintiff's characterization of their role; demand proof of ISP operations or actual receipt
Kleffman v. Vonage	Examined recipient standing; addressed whether the plaintiff's use of the email address established standing	Probe plaintiff's actual use of the email account; look for manufactured standing

Discovery Into Standing

Defendants should serve early discovery targeting standing issues:

1. Email account history: When was the account created? What was its purpose? How often is it used?
2. Subscription records: Did the plaintiff subscribe to email lists? Did they use the address on web forms?
3. Litigation history: How many § 17529.5 cases has the plaintiff filed? Against how many defendants?
4. ISP status proof: If claiming ISP standing, what email services do they provide? To how many users?
5. Actual damages: What concrete injury did the plaintiff suffer from receiving this email?

Venue

Where These Cases Are Filed

• LASC (Los Angeles Superior Court): If the defendant is in Los Angeles County or the email was sent to an LA-based address
• Other California Superior Courts: Based on defendant's location or where the email was received
• Federal Court: If diversity jurisdiction exists (different states, amount in controversy exceeds $75,000) or if federal question jurisdiction is invoked alongside CAN-SPAM claims

Corporate Defendants: Counsel Required

What This Means

• If the defendant is a business entity, it must retain a licensed California attorney
• An officer, director, or owner cannot file an answer or demurrer on behalf of the entity without counsel
• Failure to appear through counsel can result in a default judgment
• If the entity cannot afford counsel, it may still face default — inability to pay for a lawyer is not a defense to the requirement

Practical Considerations

Entity Type	Can Self-Represent?	Notes
Individual / Sole Proprietor	Yes	Can appear in pro per in unlimited civil
Corporation	No	Must have licensed counsel
LLC	No	Must have licensed counsel
Partnership	No	Must have licensed counsel

Defense Strategies

Defense Strategy Matrix

Defense	Best For	Timing	Result if Successful
ESP Authentication	Any "forged header" claim	Throughout case	Judgment / Summary judgment
CAN-SPAM Preemption	Claims really about unsolicited email	Demurrer / MSJ	Dismissal
§ 128.7 Sanctions	Boilerplate, uninvestigated complaints	Early (after safe harbor)	Withdrawal + fees
Anti-SLAPP	Political / public interest emails	Within 60 days of service	Dismissal + fees
Demurrer	Deficient complaints	Within 30 days of service	Dismissal (with or without leave)
Serial Plaintiff Discovery	High-volume filers	After answer filed	Credibility damage / sanctions

Timeline & Deadlines

Response Deadlines

Special Motion Deadlines

Discovery Timeline

Trial Setting

Milestone	Typical Timing	Notes
Case Management Conference	90-120 days after filing	Court sets trial date and discovery cutoffs. File a CMC statement before the hearing.
Discovery Cutoff	30 days before trial	All discovery must be completed by this date. Expert discovery may have an earlier cutoff.
Motion Cutoff	Varies by court	Summary judgment motions typically must be heard at least 30 days before trial (CCP § 437c requires 75-day notice).
Mandatory Settlement Conference	30-60 days before trial	Court-ordered settlement conference. Attend with settlement authority.
Trial	12-18 months after filing	LASC unlimited civil. Bench trial unless jury is demanded (and jury fees posted).

Deadline Summary Quick Reference

Action	Deadline	Authority
Answer or demurrer	30 days from service	CCP § 412.20, 430.40
Stipulated extension	30 additional days (one time)	LASC CIV 229
Anti-SLAPP motion	60 days from service	CCP § 425.16(f)
128.7 sanctions (serve)	Any time	CCP § 128.7(c)(1)
128.7 safe harbor	21 days after service	CCP § 128.7(c)(1)
Discovery responses	30 days from service	CCP § 2030.260
Motion to compel	45 days from deficient response	CCP § 2030.300
Summary judgment notice	75 days before hearing	CCP § 437c(a)
Statute of limitations	4 years	CCP § 340