As some of you may know just by checking your mailboxes, David Barrett, the CEO of Expensify, recently sent out a political endorsement e-mail to all of Expensify's users (supposedly, 10 million people).

I'm not interested in discussing the (un)professionalism of such an e-mail or the validity of statements contained therein. I'm interested in the fact that it is an unsolicited political e-mail. As a side note, it is not an e-mail that is a call to vote - it is a call to vote for a specific candidate.

The author of the e-mail claims that the First Amendment gives him the right to send it, but this e-mail was sent globally and utilised a database of e-mail addresses of users who have not given consent to receive political messages.

It feels illegal to me, but I don't know anywhere near enough about law to know whether it actually is.

I'm curious as to what possible liabilities did this expose the company to and in what jurisdictions.

Full e-mail content available here

  • Comments are not for extended discussion; this conversation has been moved to chat.
    – Pat W.
    Oct 26, 2020 at 14:23

1 Answer 1


In the United States, at least, this is a pretty easy question.

There are of course plenty of reasons not to enjoy the e-mail. Perhaps the reader gets too much spam. Perhaps the reader is a fascist. But no one who accepts the American conception of free speech should have any trouble intuiting whether sending this e-mail was legal.

Communications in support of a political candidate are at the heart of First Amendment protection. Any suggestion that the e-mail violated the law because it communicated Barrett's electoral preferences is going to be a loser. Brinkman v. Budish, 692 F. Supp. 2d 855, 861 (S.D. Ohio 2010) ("First Amendment protection is at its zenith for core political speech which involves interactive communication concerning political change.” (quoting Buckley v. Amer. Const. Law Found., 525 U.S. 182, 186–87 (1999)).

The question of whether users consented is basically irrelevant. Americans do not need permission from the government or anyone else to communicate their positions on presidential elections, dog-catcher elections, or anything else. Watchtower Bible & Tract Soc'y of New York, Inc. v. Vill. of Stratton, 536 U.S. 150, 165–66 (2002) ("It is offensive — not only to the values protected by the First Amendment, but to the very notion of a free society — that in the context of everyday public discourse a citizen must first inform the government of her desire to speak to her neighbors and then obtain a permit to do so.").

Even if consent mattered, Expensify's users have presumably all agreed to its privacy policy, which alerts them that Expensify may send them "electronic newsletters" or "important notices," two categories of communications that are broad enough to include the e-mail in question. This also means that if Expensify is otherwise compliant with GDPR and other privacy obligations, there probably isn't much of an argument to be made that the e-mail violated any of those laws.

The fact that the e-mail is technically coming from a corporation does not matter, as corporate entities are allowed to take positions on political questions. Citizens United v. Fed. Election Comm'n, 558 U.S. 310, 342 (2010) ("First Amendment protection extends to corporations."). Nonprofit organizations are generally an exception, as they essentially surrender First Amendment protection in exchange for their tax exemptions.

One could attempt to argue that the e-mail is somehow an in-kind donation to the campaign. That argument would fail, but even if it were viable, that would not make the e-mail illegal; it would merely require Expensify to report it consistent with campaign-finance regulations.

  • 2
    Thanks for your thorough response. I will refrain from accepting it for now because I'm also curious about other jurisdictions, since as I said the e-mail was sent globally, although the "broad enough" part of the privacy policy probably explains that in other jurisdictions as well.
    – user622505
    Oct 26, 2020 at 2:17
  • 2
    I'm excited to see any answers from other jurisdictions, as well. I imagine there are plenty of countries that would frown on communications opposing the governing regime, but I assume those laws don't extend to opposing another country's governing regime.
    – bdb484
    Oct 26, 2020 at 2:19
  • 4
    I don’t think that this is GDPR compliant as the concept of “consent” is narrowly tailored as being for the purposes for which the information was provided. European users did not consent to receive political messaging.
    – Dale M
    Oct 26, 2020 at 4:21
  • 2
    It has been a while now and it doesn't seem like any non-US answers are showing up - gonna accept this one. Thanks again @bdb484
    – user622505
    Oct 28, 2020 at 23:13
  • I must disagree with this answer. Or rather I think it contains much that is true, but not applicable to the question. People in the US absolutely do not need a permit to communicate their political views. But people are entitled to opt out of receiving political messages, and the government is free to help enforce such decisions. I am not sure whether the users' agreement covered the msgs. But consent did and does matter.. May 21, 2021 at 22:35

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .