The phrase "today only" has always been marketing shorthand. In Washington state, it is now a legal statement.
Since a 2025 court ruling, a single false or misleading line in a commercial email subject can trigger statutory damages — with no need to prove that anyone was harmed. By 2026, that ruling had produced a wave of class actions, a failed federal preemption defence, and a legislative rewrite.
This article covers the full 2025 to 2026 arc in one place, then does the part most coverage skips: a practical breakdown of where the line falls between harmless puffery and an actionable claim.
What you will learn:
- What Washington's CEMA prohibits and who it covers
- What Brown v. Old Navy decided, and why the 5–4 split mattered
- How the litigation, preemption rulings and HB 2274 unfolded
- Which subject line phrases are safe puffery and which are factual claims
- How the damages work, before and after the 2026 amendment
- How to audit your subject lines and build a review process
The Ruling That Started It: Brown v. Old Navy
On April 17, 2025, the Washington Supreme Court decided Brown v. Old Navy, LLC (4 Wn.3d 580, 567 P.3d 38), a 5–4 ruling on a question certified by a federal district court.
Washington's Commercial Electronic Mail Act (CEMA) says no person may send a commercial email to a Washington resident that:
"(b) [c]ontains false or misleading information in the subject line." — RCW 19.190.020(1)(b)
The question before the Court was narrow: does that mean any false or misleading information, or only information that misleads the reader about the email's commercial nature?
Old Navy argued for the narrower reading, pointing to an earlier federal decision (Chen v. Sur La Table) that limited the provision to statements about whether the message was an advertisement. The Court disagreed. It held that a subject line does not need to conceal the email's commercial purpose — it merely needs to contain a false or misleading statement.
What CEMA Actually Prohibits
Before the ruling, most marketers had never heard of CEMA. It is worth understanding its scope, because it is broader than "spam."
- It covers commercial email. The statute targets messages sent to promote real property, goods or services for sale or lease.
- It applies to Washington residents. It reaches mail sent from a computer in Washington or to an address the sender knows, or has reason to know, is held by a Washington resident.
- It regulates the subject line specifically. The law does not regulate the body of the email — only the subject line and transmission information.
- It also covers commercial text messages under the same damages provision.
- A violation is a per se Consumer Protection Act violation, which is why the exposure can compound with treble damages and attorney fees.
Why the 5–4 Split Mattered
The decision was not unanimous. The dissent would have limited CEMA to subject lines that conceal an email's commercial nature — the interpretation federal courts had applied under Chen v. Sur La Table.
The majority read the words "any false or misleading information" literally. That one phrase is why a promotional deadline, not just a disguised advertisement, became a legal risk.
Crucially, the Court also drew a boundary that works in marketers' favour: mere puffery is not prohibited. It defined puffery as subjective statements, opinions and hyperbole, and contrasted it with representations of fact — the duration or availability of a promotion, its terms and nature, the cost of goods, and other facts consumers rely on.
The 2025 → 2026 Timeline
The story did not end with the ruling. Here is how it unfolded.
| Date |
Development |
| Apr 17, 2025 |
Washington Supreme Court decides Brown v. Old Navy 5–4: any false or misleading subject line violates CEMA. |
| Mid-2025 |
Class actions surge. Roughly 8 suits had been filed from 1998 through June 2025; more than 100 follow in the year after the ruling. |
| Dec 18, 2025 |
Harrington v. Vineyard Vines rejects a CAN-SPAM preemption defence. |
| Jan 14, 2026 |
Ma v. Nike holds CAN-SPAM does not preempt CEMA's subject line provision. |
| Feb 12, 2026 |
Kempf v. Fullbeauty rejects preemption and the dormant Commerce Clause challenge, and holds CEMA claims do not sound in fraud (no heightened pleading). |
| Feb 27, 2026 |
Shahpur v. Ulta rejects a CAN-SPAM preemption defence. |
| Mar 18, 2026 |
Agnew v. Macy's also rejects preemption. |
| Mar 23, 2026 |
Governor signs HB 2274, amending CEMA. |
| Jun 11, 2026 |
HB 2274 takes effect: damages cut to $100 and a knowledge requirement added. |
The pattern is clear. Defendants tried two main defences — federal preemption and constitutional challenge — and courts rejected both. The legislature then intervened.
Puffery vs. an Actionable Claim: Where the Line Falls
This is the part that matters for anyone writing subject lines today. The Court's puffery-versus-fact distinction is the practical test.
- Puffery (safe): vague, subjective or hyperbolic language that cannot be proven true or false. Opinions and sales talk live here.
- Representations of fact (actionable if false): concrete, verifiable claims — especially about time, price, availability and terms.
The examples below show how the distinction plays out.
| Subject line |
Category |
Risk |
Why |
| "Best Deal of the Year" |
Puffery |
Safe |
Opinion and hyperbole; not a verifiable fact. |
| "Our Biggest Sale Ever" |
Puffery |
Safe |
Hyperbolic sales talk the Court treats as non-actionable. |
| "You'll Love These Deals" |
Puffery |
Safe |
Subjective prediction, not a factual claim. |
| "30% off today only" |
Fact — duration |
Risky |
If the sale continues past today, the deadline is false. |
| "Sale ends tonight" |
Fact — duration |
Risky |
Same problem: the deadline is a factual claim. |
| "Last chance — final hours" |
Fact — availability |
Risky |
Implies the offer is ending; must actually end. |
| "2 days only: save up to 50%" |
Fact — duration and price |
Risky |
The deadline must hold and the "up to" maximum must be attainable. |
| "Free gift with every order" |
Fact — terms |
Risky |
Must be true for every qualifying order, without hidden conditions. |
| "Only 3 left in stock" |
Fact — scarcity |
Risky |
Verifiable availability claim; false if untrue. |
The Four Factual Risk Zones
Most actionable subject lines fall into one of four categories. If a subject line touches any of them, it needs a factual check before it sends.
| Risk zone |
Examples |
The test |
| Time / deadline |
"today only", "ends tonight", "48 hours left", "final day" |
Will the offer actually end when you say it does? |
| Price / discount |
"30% off", "up to 70% off", "lowest price of the season" |
Is the figure accurate and the maximum genuinely attainable? |
| Availability / scarcity |
"only 3 left", "selling out fast", "back in stock" |
Is the stock claim true right now? |
| Terms / inclusion |
"free shipping", "free gift with every order", "no exclusions" |
Are there conditions the subject line omits? |
The "Today Only" Problem
Urgency language is not banned. The problem is that a deadline is a promise.
When Old Navy sent subject lines like "today only" or "three days only" and then extended the promotion, the original statement became false. The Court's logic is straightforward: a deadline describes the availability of an offer, and availability is a fact, not puffery.
Two habits reduce the risk immediately:
- Do not hard-code deadlines in evergreen automations. A welcome email that says "this week only" will eventually be wrong.
- If you state a deadline, honour it. A genuine, enforced end date keeps urgency accurate.
The Grey Areas
Some subject lines sit between puffery and a factual claim. Treat these with extra care.
- Comparative claims — "lowest price we've ever offered" is arguably factual and verifiable. If a deeper discount follows, the original claim can be exposed.
- "Up to" discounts — safe only if the maximum is real. If no customer can realistically reach 70% off, the claim misleads.
- Personalisation that implies a fact — "Your order is ready" or "Your exclusive code" must reflect something true about that recipient.
- Emoji and symbol urgency — a countdown clock or fire emoji does not change the analysis; the words still carry the claim.
When a subject line is borderline, the safest move is to make it an opinion ("our best deals of the season") or remove the specific number, date or quantity.
CEMA vs. CAN-SPAM: Why the State Rule Bites Harder
Both federal and Washington law prohibit deceptive subject lines. The differences are what make CEMA the bigger practical risk.
|
CEMA (Washington) |
CAN-SPAM (federal) |
| Deceptive subject line rule |
Any false or misleading information |
Only if likely to mislead about a material fact |
| Proof of harm required |
No — receiving the email is the injury |
Yes — materiality is part of the standard |
| Private right of action |
Yes, by recipients |
No — enforced by the FTC and state attorneys general |
| Damages |
$100 per violation (was $500) or actual, whichever greater; per se CPA claim |
Civil penalties enforced by regulators |
| Knowledge requirement |
Required for cases filed on or after June 11, 2026 |
Intent standards vary by provision |
The takeaway: a subject line that would not concern the FTC can still support a CEMA class action, because CEMA does not require materiality, reliance or actual harm.
For how these rules fit alongside GDPR, CASL and others, see email marketing laws in 2026 and the anti-spam law glossary entry.
What the Damages Actually Are
The statute is what creates the risk, so it is worth stating precisely what it says — and what remains unsettled.
- Statutory damages are $100 per violation under the amended RCW 19.190.040, down from $500 before June 11, 2026. Where actual damages are greater, a recipient can seek those instead.
- No proof of harm is required. The Washington Supreme Court treated the receipt of a violating email as the injury itself.
- A violation is a per se Consumer Protection Act violation, so treble damages and attorney fees may also be available under the CPA.
- How damages aggregate across a class is not settled. Plaintiffs argue for a per-email, per-recipient calculation. No court has conclusively resolved that multiplier.
The practical point is simpler than any headline number: the penalty is recoverable for violating subject lines, and a violation is also a consumer protection claim. A lower statutory amount reduces the incentive to litigate — it does not remove the risk.
Why This Is a Live Risk, Not a History Lesson
Three 2026 developments keep CEMA relevant for every email marketer who reaches Washington residents.
1. The Preemption Defence Failed
Companies argued that the federal CAN-SPAM Act preempts CEMA. On January 14, 2026, in Ma v. Nike, Judge Robart rejected that argument. CAN-SPAM's preemption clause contains an express carve-out for state laws that prohibit "falsity or deception" in commercial email, and CEMA's subject line rule falls squarely within it. Later decisions — Kempf v. Fullbeauty, Shahpur v. Ulta, Agnew v. Macy's — agreed. To date, no court has held that CAN-SPAM preempts CEMA's subject line provision.
2. Constitutional Challenges Failed Too
Defendants also argued that applying CEMA to nationwide campaigns violates the dormant Commerce Clause. Courts rejected that as well, relying on State v. Heckel and finding that increased compliance costs — such as filtering recipients by state — are not a substantial burden on interstate commerce.
3. CEMA Claims Are Easy to Plead
Because CEMA violations are per se Consumer Protection Act violations, and courts have held the claims do not sound in fraud, plaintiffs do not need to meet the heightened pleading standard of Rule 9(b) or show reliance. Washington's Attorney General has intervened in several cases to defend the law.
The practical consequence: a defendant cannot usually make a CEMA claim disappear at the pleading stage. The case proceeds to discovery, where the sender's promotion calendar and internal communications become central.
The Legislative Fix: HB 2274
In March 2026, Washington's legislature passed HB 2274 to narrow the statute. It took effect on June 11, 2026. Two changes matter most.
| Feature |
Before HB 2274 |
After HB 2274 (from Jun 11, 2026) |
| Liability standard |
Effectively strict liability |
Knowledge required: actual knowledge, or knowledge fairly implied from objective circumstances |
| Statutory damages |
$500 per violation, or actual damages if greater |
$100 per violation, or actual damages if greater |
| Interactive computer service damages |
$1,000 |
$1,000 (unchanged) |
| Retroactivity |
— |
Applies only to actions filed on or after June 11, 2026 |
What the Knowledge Requirement Means
Under the amended RCW 19.190.020, a subject line violates CEMA only if, based on the sender's actual knowledge or knowledge fairly implied from objective circumstances, it contains false or misleading information. Plaintiffs must now plead and prove what the sender knew at the time of sending.
In practice, that rewards documentation. If your promotion plans and timelines were set in good faith when the email went out, and reality diverged because of a later business decision, that record supports a defence.
The amendment does not require proof that the recipient was actually misled. It shifts the focus from the reader's reaction to the sender's state of mind — a higher bar, but still one that internal records can either help or hurt.
What HB 2274 Does Not Do
- It is not retroactive. Lawsuits filed before June 11, 2026 still proceed under the old $500 strict-liability framework.
- It does not eliminate exposure. $100 per violation is still a recoverable statutory amount, and a CEMA violation remains a per se Consumer Protection Act claim.
- It does not change the underlying rule. False or misleading subject lines remain prohibited; only the penalty and the knowledge standard changed.
- It does not stop new theories. Plaintiffs can still pursue related Consumer Protection Act claims and other state-law angles.
What It Means for Your Subject Lines
Treat every concrete claim in a subject line as a statement you may have to defend.
- Audit for factual claims, not just "spammy" words. Deadlines, prices, discounts, availability, free gifts and terms are the high-risk categories.
- Keep urgency honest. Use "today only" only when it is true, and make sure automated sequences never carry stale deadlines.
- Verify "up to" claims. The maximum discount must be genuinely attainable, and the qualifying conditions must be accurate.
- Lean on puffery for hype. Opinions and hyperbole are safe; specifics are where the risk lives.
- Document promotion plans. Under HB 2274, showing what you knew at send time can be the difference between a defence and a settlement.
- Remember it is about the subject line, not the body. CEMA regulates the subject line specifically, so review it as its own legal statement.
- Location does not exempt you. If you email Washington residents, the law applies regardless of where your business sits.
- Watch recurring templates most closely. A one-off campaign is reviewed before it sends; an evergreen automation runs for years without a second look.
For subject line mechanics that keep messages accurate and effective, see how long a subject line should be, why some subject lines feel impossible to ignore, and our subject line best practices reference.
Common Myths, Corrected
Several assumptions about CEMA are wrong, and each one creates avoidable risk.
| Myth |
Reality |
| "Only blatantly false subject lines are risky." |
A deadline that slips is enough. Accuracy, not exaggeration, is the test. |
| "If the body explains the terms, the subject line is fine." |
CEMA regulates the subject line on its own. The body does not cure a misleading subject line. |
| "CAN-SPAM preempts state law, so CEMA does not apply." |
Courts have repeatedly rejected preemption for the subject line provision. |
| "HB 2274 ended the lawsuits." |
It is not retroactive, so earlier suits still face the old $500 standard, and the $100 amount is still recoverable. |
| "Puffery like 'best sale ever' is banned." |
Puffery is expressly protected. Facts are the exposure. |
| "This only affects Washington-based companies." |
It applies to email sent to Washington residents from anywhere. |
How to Audit Your Subject Lines
A short review can catch most of the risk. Work through these steps.
- List every recurring subject line. Focus on automated and evergreen sequences, where time-based claims age badly.
- Flag time, price, availability and terms. Any of these in a subject line is a factual claim that must be accurate at send time.
- Check the deadline will be honoured. If a promotion may be extended, avoid naming a hard end date in the subject line.
- Test the claim against the offer. Run the wording through the urgency and scarcity checker and the subject line analyzer to spot verifiable claims.
- Review compliance posture. The GDPR compliance checker and subject line compliance guide help you build a repeatable review, even though CEMA is a US state law.
- Keep a record. Store the promotion calendar and approval trail so you can demonstrate good-faith knowledge under HB 2274.
Who Should Own Each Check
Risk drops when the review is a process, not a person's memory. A simple split of responsibility helps.
| Step |
Owner |
What to confirm |
| Draft wording |
Copywriter |
No unverifiable facts; prefer puffery for hype |
| Approve the offer |
Campaign manager |
Price, discount ceiling, deadline and inclusions are accurate |
| Sign off templates |
Legal / compliance |
Recurring subject lines are reviewed and documented |
| Audit automations |
Lifecycle / automation owner |
No stale deadlines or outdated prices in evergreen flows |
For a fuller framework, see the email compliance audit and regulatory compliance entries. If your subject lines also affect deliverability, the same accuracy discipline helps there — see what triggers email client spam filters and how much a spam complaint actually hurts.
If You Receive a Demand Letter or Class Action Notice
CEMA claims often arrive as a demand letter or a class action complaint. The response matters.
- Do not ignore it. Deadlines to respond are real, and silence rarely ends the matter.
- Preserve records immediately. Subject lines, send dates, recipient segments and the promotion calendar are the evidence that matters.
- Check the filing date. Actions filed before June 11, 2026 fall under the old $500 strict-liability standard; later filings face the knowledge requirement and $100 damages.
- Identify the specific subject lines. Determine whether the claim targets one campaign or a recurring template, since the theory drives the exposure.
- Engage counsel early. Preemption and constitutional defences have largely failed, so the strongest ground is usually factual accuracy and documented good faith.
- Fix the template, not just the case. The same subject line may be running in other flows and markets.
Key Takeaways
- On April 17, 2025, Brown v. Old Navy held that any false or misleading information in a commercial email subject line violates Washington's CEMA — not just information about the email's commercial nature.
- The law carries statutory damages with no proof of harm, and CEMA violations are per se violations of Washington's Consumer Protection Act.
- The Court protected puffery (subjective opinions and hyperbole) but not representations of fact such as deadlines, prices, terms and availability.
- More than 100 CEMA class actions followed the ruling, and federal courts rejected both CAN-SPAM preemption and dormant Commerce Clause defences.
- HB 2274, effective June 11, 2026, cut statutory damages from $500 to $100 and added a knowledge requirement — but only for cases filed on or after that date.
- The practical fix is simple: do not state a fact in a subject line you cannot stand behind — especially a deadline you might extend.
Sources and Further Reading
Related Articles
Related tools: Check claims with the urgency and scarcity checker, review wording with the subject line analyzer, measure length with the subject line character counter, and score risk with the spam score checker.
This article explains a legal development for email marketers and is not legal advice. For guidance specific to your programme, consult qualified counsel.
