In Retailers on Alert: The New Wave of Email Marketing Lawsuits, we discussed a growing wave of lawsuits targeting common email marketing practices under state anti-spam statutes, particularly Washington’s Commercial Electronic Mail Act (“CEMA”). Since then, Washington’s legislature has taken action. On March 23, 2026, Governor Bob Ferguson signed House Bill 2274 (“HB 2274”) into law, delivering targeted reforms to CEMA that will take effect on June 11, 2026. While the new law provides some meaningful relief, including lowering statutory damages and adding a knowledge requirement, it falls short of the comprehensive overhaul many in the business community had advocated for, and it offers no help to retailers already defending pending lawsuits.
A Surge of Email Subject Line Lawsuits
As we previously discussed, the catalyst for the current litigation wave was the Washington Supreme Court’s 2025 decision in Brown v. Old Navy, LLC. In that case, the Court held that CEMA’s prohibition on “false or misleading information in the subject line” of commercial emails is not limited to subject lines that disguise the commercial nature of the email. Rather, the prohibition reaches any false or misleading information in the subject line, including urgency claims, discount representations, and time-limited offers, regardless of whether the body of the email clarifies or corrects the claim.
The Brown decision expanded the scope of potential CEMA liability. Under the prior understanding of the statute, CEMA was seen as a tool to combat outright spam: emails with subject lines designed to trick recipients into opening what appeared to be personal messages but were, in fact, commercial solicitations. CEMA was enacted in 1998 to address the “Wild West” of early internet email, when consumers paid to dial in and download messages.
After Brown, however, plaintiffs began filing lawsuits challenging the kinds of promotional subject lines that are routine in modern retail email marketing: “Today Only,” “Ends Tonight,” “Extended,” “Three Days Only,” and similar urgency-driven language. The theory is straightforward: if a subject line says “Ends Tonight” but the promotion is later extended, or if “50% Off” appears in the subject line but only applies to select merchandise, the subject line is arguably false or misleading regardless of what the body of the email says.
The stakes have been substantial. CEMA provided $500 in statutory damages per violation (i.e., per email) without any requirement that the recipient prove individualized harm, open the email, or rely on the subject line in any way. For retailers sending marketing emails to large lists of Washington residents, the potential exposure from even a single campaign could be enormous. The math can be unforgiving: per-email damages multiplied by large distribution lists and frequent sends can rapidly produce staggering aggregate liability figures. Plaintiffs have brought these claims as putative class actions, and the availability of statutory damages and attorney fees has driven significant settlement pressure.
CEMA violations also constitute per se violations of Washington’s Consumer Protection Act (“CPA”), which means plaintiffs do not need to independently prove that an unfair or deceptive act occurred, that it occurred in trade or commerce, or that it affected the public interest. They need only to show injury and causation, elements substantially eased by CEMA’s per-email statutory damages framework.
What HB 2274 Does
HB 2274 is a direct legislative response to the post-Brown litigation surge. The bill passed the Washington House on February 16, 2026, by a vote of 86-11, and the Senate on March 6, 2026, by a vote of 43-5, reflecting strong bipartisan support.
The new law makes two key changes to CEMA. First, HB 2274 lowers statutory damages for sending a commercial email in violation of CEMA from $500 per violation to $100 per violation. Actual damages remain available where they exceed the statutory amount. While the reduction from $500 to $100 is significant, it does not eliminate the fundamental dynamic that drives these cases: per-email statutory damages applied to high-volume email campaigns can still produce substantial aggregate exposure.
Second, the original statute prohibited subject lines that “contain[ ] false or misleading information.” HB 2274 amends this standard to require that the subject line contain false or misleading information “based on the person’s actual knowledge or knowledge fairly implied on the basis of objective circumstances.” In other words, liability is now tied to what the sender knew or reasonably should have known at the time the email was sent. This is a meaningful change because it introduces a scienter element that did not previously exist. Under the prior version of CEMA, a plaintiff did not need to demonstrate that the sender intended to mislead or even knew the subject line was inaccurate. The new knowledge standard should provide a defense in situations where, for example, a promotion is unexpectedly extended after emails have already been sent, or where the sender had a good-faith basis for the claims in the subject line.
HB 2274 provides that it “applies to all causes of action commenced on or after the effective date of this section, regardless of when the cause of action arose.” This means that lawsuits filed on or after June 11, 2026, will be governed by the amended statute, including claims based on emails sent before the effective date. However, lawsuits that were already filed before June 11, 2026, remain subject to the original version of CEMA, including the $500-per-email damages and the absence of a knowledge requirement. For retailers already facing CEMA litigation, HB 2274 provides no relief.
Where HB 2274 Falls Short
While HB 2274 is a positive and meaningful step, it is best understood as an interim stabilization measure rather than a comprehensive reform. The legislation that was ultimately signed into law is significantly narrower than what was originally introduced. As initially proposed, HB 2274 would have made several additional changes, including narrowing the “false or misleading” standard to require that a subject line be “likely to mislead a recipient, acting reasonably under the circumstances, about a fact material to the relevant transaction,” requiring that a recipient actually receive, review, and detrimentally rely upon the email in order to claim damages, and repealing the per se CPA violation designation for CEMA claims. None of these broader reforms survived the legislative process.
As a result, several structural features of CEMA that have fueled the litigation wave remain intact. The statute still does not require proof of consumer harm. A plaintiff need not demonstrate that they opened the email, read the subject line, or were in any way misled, only that a commercial email in violation of the statute was sent to their address. Subject-line litigation is not eliminated; businesses remain exposed to claims that common promotional language is actionable. And the per se CPA violation framework remains available, continuing to ease the plaintiff’s burden in bringing claims.
Furthermore, HB 2274 addresses only Washington law. Other states, including California, have their own anti-spam statutes with private rights of action and per-email statutory damages. California’s Business and Professions Code § 17529.5, for instance, provides for statutory damages commonly pled at $1,000 per email. Plaintiffs in California have pursued strict-liability theories, and the plaintiff’s bar in that state remains active.
Conclusion
HB 2274 reduces but does not eliminate CEMA litigation risk, and it does nothing to change the landscape in other states. Retailers and other businesses engaged in email marketing should ensure that every subject line is independently accurate and does not rely on the body of the email to qualify or correct the headline claim. Marketing teams should favor durable, flexible language and should avoid committing to rigid deadlines that may later shift. Email deployment systems, promotional calendars, and offer end-times should be synchronized with subject line claims. And because HB 2274’s new knowledge standard rewards senders who can demonstrate a good-faith basis for their representations, retailers should document what was known at the time each email was sent, including promotional calendars, approval workflows, and the factual basis for subject line claims. Retailers that rely on third-party vendors, affiliates, or email service providers should ensure those partners adhere to the same compliance standards, as affiliate-generated emails can create liability for the advertiser. Finally, because HB 2274 addresses only Washington, retailers should assess exposure under the laws of all states where their email recipients reside, with particular attention to California and other jurisdictions with private rights of action and per-email damages.
The passage of HB 2274 is a welcome development for the business community, but it is not the end of the story. Email marketing litigation remains a live and evolving risk, and retailers should consult with experienced counsel to evaluate their current email marketing practices, assess multi-state exposure, develop a defensible compliance framework, and address any pending or threatened CEMA claims.
