* **Federal Law:** Under 18 U.S.C. § 2261A, it is a federal crime to use any interactive computer service to engage in a course of conduct that causes substantial emotional distress to a person. A conviction under this statute can carry significant prison time and fines. * **State Laws:** Most states have specific cyberharassment or online harassment laws. These statutes make it illegal to use electronic communications to torment or harass an individual repeatedly. ### Computer Fraud and Abuse Act (CFAA) When subscription bombing is done on a massive scale, it can overwhelm the victim’s email server or device, effectively acting as a denial-of-service (DoS) attack. Under the federal Computer Fraud and Abuse Act (18 U.S.C. § 1030), it is illegal to knowingly cause the transmission of a program, information, code, or command that intentionally causes damage without authorization to a protected computer. If the flood of emails disrupts a business or causes financial loss, the perpetrator could face federal felony charges. ### Online Impersonation and Identity Theft Signing someone up for services requires entering their personal information, such as their name and email address, into web forms without their consent. In many jurisdictions, this constitutes online impersonation or identity theft. For example, several states have laws that criminalize using another person's name or identity online to harm, defraud, intimidate, or threaten them. ## Civil Liability and Lawsuits

In addition to criminal prosecution, individuals who sign others up for spam can be sued in civil court. Victims can seek financial compensation for the damages caused by the harassment. ### Intrusion upon Seclusion This is a legal claim based on the invasion of privacy. To win an intrusion upon seclusion lawsuit, the plaintiff must prove that the defendant intentionally intruded upon their private affairs in a way that would be highly offensive to a reasonable person. Flooding a private inbox with unwanted, offensive, or explicit spam generally meets this standard. ### Intentional Infliction of Emotional Distress (IIED) If the spam campaign causes severe emotional suffering, the victim may sue for IIED. The plaintiff must demonstrate that the defendant's conduct was extreme and outrageous, and that it directly caused severe emotional distress, anxiety, or physical symptoms. ### Tortious Interference and Business Loss If the target of the spam is a business or a professional email account, the influx of spam can disrupt operations, block legitimate client communications, and require IT resources to resolve. In these cases, the business can sue the perpetrator for tortious interference with business relations or seek damages for the actual financial losses incurred to clean up the email system.

## How Perpetrators Are Traced Many people mistakenly believe that signing someone up for spam is anonymous. However, digital footprints make it relatively easy for law enforcement or private investigators to trace the activity back to the source. * **IP Addresses:** Every time a form is submitted online, the hosting website logs the IP address of the user. Submitting dozens of forms from the same IP address creates a clear digital trail. * **Metadata and Headers:** Email headers contain routing information that can help identify the origin of the subscription requests. * **Subpoenas:** In legal proceedings, courts can issue subpoenas to internet service providers (ISPs) and website hosts to reveal the identity of the person associated with the IP address used to submit the spam sign-ups. ## The Role of the CAN-SPAM Act

A common misconception is that the CAN-SPAM Act of 2003 applies to individuals who sign others up for spam. The CAN-SPAM Act primarily regulates commercial email senders (businesses sending marketing emails) and establishes rules for commercial messages, such as providing an opt-out mechanism. While the CAN-SPAM Act does not directly penalize an individual who maliciously signs someone else up for a newsletter, the businesses sending the emails must still comply with opt-out requests. However, the individual initiator remains liable under the harassment and computer abuse laws mentioned above. ## Conclusion What might begin as an attempt to annoy an acquaintance or retaliate against an enemy can quickly escalate into a serious legal matter. The legal consequences of signing someone up for spam emails include criminal records, substantial fines, and civil judgments for damages. With modern digital forensics, anonymity is difficult to maintain, making the risks of this behavior far outweigh any temporary amusement.