The new law basically reconstitutes what it can of the old law that isn't preempted. CAN SPAM says states can make fraudulent e-mail more illegal, so that's what it does. If a commercial e-mail advertisement uses a third party domain name without permission, or has forged header information, or a misleading subject line, it's illegal in California. More interestingly, any of the recipient, the recipient ISP, or the Attorney General can sue for $1000 per message, up to a million dollars per incident.

To limit nuisance suits, the court can decrease the penalty to $100 and $100,000 if the defendant ``established and implemented, with due care, practices and procedures reasonably designed to effectively prevent unsolicited commercial e-mail advertisements that are in violation of this article.'' This is copied from the old law, but it seems pretty unlikely to be used. How likely is someone to have such policies and send fraudulent spam anyway?

Like the phishing law, this isn't going to make spam go away, but it does make small claims suits against California spammers possible, if there are any left.