Hope I am in the right place for this type of question. I am a developer that would like to start up a little project that is kind of a social experiment.

The idea is that I setup a mailing bot with a list of emails (say a few million from a online email dump). This bot will send an email that is somewhat misleading, maybe notifying the user they may have won a prize with a link to collect it.

The idea being that I can notify the user once the link is clicked that this was a fake mail designed to spread awareness of scam emails/virus emails and how easy it is to be tricked.

I would also like to collect this information and display on a webpage how many emails are sent out and how many people have clicked the link.

With the information I could collect it anonymously (not linked to the email address) but it would be better to put it against the email so they can visit the site later and see more stats about the project/social experiment.

So the overall question is... Is this possible to do without being in any sort of trouble with laws etc? This will be a worldwide project and poses no threat other than being classed as a spam email.

  • For Canada, you'd have to comply with anti-spam legislation. IIRC, you have to get their permission before you can send them an email or something like that.
    – Zizouz212
    Aug 30, 2017 at 16:16
  • @Zizouz212 That could be a problem! Thank you for your comment.
    – Ruddy
    Aug 30, 2017 at 16:30

1 Answer 1


In the US, your experiment is problematic in several respects according to the CAN-SPAM Act of 2003 CAN-SPAM Act of 2003 - Wikipedia.

You can legally send unsolicited email, as long as you have an unsubscribe link in the message, and you have obtained those email addresses in a legal manner.

Your project is problematic because

1) you using emails from an online dump, which more than likely came from a spam harvester, and those emails were probably not legally obtained.

2) the subject lines (and content) of the emails you send will be deceptive, because you are trying to get people to click on the link to give you data on the people who respond while not telling them the true nature of the email.

3) you will be displaying your collected data in a public manner related to those personal email addresses, after deceiving those people to the nature of your emails, and this could possibly be illegal in terms of privacy outside of the CAN-SPAM Act of 2003.

Beyond the CAN-SPAM Act of 2003, in order to send all of those emails in the US, you will need to use internet service provider, which will either be a commercial business, a government entity, or and an NGO. All of those will have terms of service which probably restrict sending mass unsolicited emails using their services.

This will be a worldwide project and poses no threat other than being classed as a spam email....

Wrong. You will more than likely be violating many email and privacy laws and those of many interest service providers in all of those jurisdictions, and will open yourself up to both civil and criminal liability.

  • I see. So overall this project isn't really viable? If there anyway you could see a "work around" maybe by changing the way I get the email address's and possibly wording the email in such a way that it will not be "deceiving" the recipient. I feel like this project could help educate people that are "tricked" and give useful information to others for future projects.
    – Ruddy
    Aug 30, 2017 at 16:29
  • 2
    You're getting into asking specific legal advice, which is off-topic here. You want to educate people to not be "tricked" by emails by tricking them with emails; you have a basic legal and ethical problem with your research idea. Aug 30, 2017 at 16:44
  • 1
    No problem. Its also just a great project for me to do but I see it may not be possible. Well thanks for the answer! Helped me a lot!
    – Ruddy
    Aug 30, 2017 at 19:34

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .