What the Costco Email Lawsuit Means for Multi-State Compliance

Last reviewed: July 29, 2026. The Costco email lawsuit matters less as a single retailer settlement than as a warning that commercial email risk now changes by recipient state. A national “ends today” or “5 days only” campaign can carry one damages figure for a Washington resident, another for a Florida resident, another for a California resident, and a different enforcement posture under CAN-SPAM.

Costco’s proposed $14 million settlement, preliminarily approved on June 23, 2026, covers Washington residents who received Costco commercial emails from June 2021 through July 2026. The challenged subject lines included “Today is the last day to access Member-Only Saving” and “Hot Buys available for 5 Days Only,” with a final approval hearing scheduled for October 2, 2026.[1] For the Costco settlement details, see our Costco case analysis. This tracker maps the broader compliance problem beyond that one case.

Current State Anti-Spam Risk Map

The table is the practical starting point. A promotional calendar may be national, but the complaint is not. The first compliance question is no longer only “does this subject line match the offer?” It is also “which state’s recipients received it, under which version of that state’s statute, and during which effective-date window?”

Why Washington Became the First Operational Fire Drill

Washington’s risk changed after Brown v. Old Navy. The Washington Supreme Court held that any false or misleading information in a commercial email subject line can violate the state’s Commercial Electronic Mail Act.[2] That ruling turned familiar retail phrasing into litigation material: sale timing, discount framing, and missing conditions were no longer just creative-review issues.

The caseload moved quickly. Morgan Lewis reported eight total CEMA lawsuits between 1998 and early 2025, more than 100 between April 2025 and April 2026, and nearly 200 by June 2026.[2] Those figures come from litigation summaries rather than a separately audited court database, but the direction is still the point for marketers: after Brown, Washington became a state where routine promotional subject lines could support class-action filings at scale.

The eye-catching exposure math should be handled carefully. Benesch Law illustrated that one email per week for a year to 100,000 recipients could create a $2.6 trillion theoretical maximum under the old Washington CEMA damages structure.[3] That is useful as a warning label, not as a settlement forecast. Costco’s proposed $14 million settlement is a better anchor for real-world expectations, while still showing why an ordinary campaign can become material once multiplied across a large list.[1]

HB 2274 changed the forward-looking Washington map. Effective June 11, 2026, it reduced statutory damages from $500 to $100 per email and added a knowledge requirement, while applying prospectively only; pending cases remain under the old framework.[2] That before-and-after split matters in campaign audits. A June 2026 send and a July 2026 send may not sit in the same risk bucket, and an old triggered series may need review by send date, recipient state, and subject-line version.

What HB 2274 Does Not Yet Prove

The new Washington knowledge requirement is not the same thing as a marketer being able to point to a checklist and end the dispute. Because the provision only took effect on June 11, 2026, the supplied materials do not show meaningful court testing of that defense.[2] Documentation may become important evidence, but its value is still a legal question.

The Subject-Line Theories That Keep Showing Up

The risky language is not limited to one Costco phrase. Litigation coverage has identified three theories that courts have allowed to proceed: sale duration, where the promotion allegedly lasted longer than the subject line suggested; omission, where the subject line allegedly left out material conditions; and perpetual discounting, where discounts allegedly compare against inflated or recurring reference prices.[7]

• Sale-duration claims target phrases such as “last day,” “ends tonight,” or “5 days only” when the campaign, promo code, or similar offer continues.
• Omission claims target subject lines that advertise a benefit while leaving the qualifying condition outside the inbox view.
• Perpetual-discount claims target promotional calendars where the “sale” appears to be a standing pricing strategy rather than a time-limited event.

These are not exotic fact patterns. They live inside normal retention marketing: holiday extensions, “surprise” encore sales, segmented thresholds, member-only language, dynamic product feeds, and evergreen markdown pages. The compliance break usually happens when the subject line is approved as copy, the offer logic changes in CRM or ecommerce, and no one reopens the legal question before send.

Florida Is No Longer a Footnote

Florida’s Electronic Mail Communications Act brings a different risk profile: $500 per email in liquidated damages, a four-year statute of limitations, and criminal penalties for high-volume senders.[4] In April 2026, Ballard Spahr reported what it described as Florida’s first subject-line class action, involving a “Free $20 Gift Card” email where the gift card allegedly required a $100 purchase.[4]

That case does not prove Florida will generate Washington-level volume. It does change the review posture for national lists. A Florida-heavy file can no longer be treated as lower-priority merely because the post-Brown wave started in Washington. The per-email damages figure is the same as Washington’s old $500 level, and the four-year lookback can pull old subject-line practices into current dispute windows.[4]

The operator-level takeaway is narrow but important: Florida claims need their own routing in compliance review. If a campaign uses “free,” “gift,” “bonus,” or “no cost” language, the condition should be visible enough that the subject line is not carrying more promise than the offer can support.

California’s Strict-Liability Problem

California is the cleanest example of why state geography matters. Its anti-spam law can impose $1,000 per email per recipient without proof of intent or actual harm.[5] The limited safe harbor can reduce damages to $100 per email, with a $100,000 incident cap, if the sender proves reasonable compliance procedures.[5]

That safe harbor is worth building toward, but it should not be described inside a marketing team as a switch that turns California exposure down to $100. The burden is on the sender to prove reasonable procedures.[5] A folder of approvals, offer terms, QA records, suppression logic, and change logs may matter later, but only if the underlying process actually controlled the claim that reached the inbox.

For California recipients, subject-line review should be paired with evidence preservation. If the creative says “today only,” keep the promotion schedule. If the email says “free,” keep the qualifying terms. If a discount references a former price, keep the pricing basis. Without that record, the team is asking a future reviewer to reconstruct the campaign after the risk has already attached.

CAN-SPAM Is a Floor, Not the Map

CAN-SPAM still matters, but it answers a different question. The FTC says each separate email that violates CAN-SPAM can be subject to penalties of up to $53,088, and the statute is enforced by government agencies rather than through a private right of action for ordinary recipients.[6] That makes federal compliance necessary, but it does not resolve the private state-law class-action problem.

Preemption is also not a dependable planning assumption. The supplied materials point to Ma v. Nike, decided in January 2026, as part of the Ninth Circuit line allowing state laws aimed at falsity or deception to survive CAN-SPAM preemption.[5] That position is not binding everywhere, and preemption arguments are still being litigated. A national sender should not approve aggressive subject-line language on the theory that federal law will automatically erase state claims.

Secondary Signals Worth Tracking

The active map is wider than Washington, Florida, and California, but the supplied materials do not support a full 33-state enforceability guide. Ballard Spahr notes that at least 33 states have commercial email or spam-specific statutes on the books, while litigation summaries identify Maryland and Indiana as additional jurisdictions with activity signals: Maryland with 10 suits and Indiana with two outlier suits.[4][2]

Those states belong on the watchlist, not in the same risk tier by default. The practical move is to tag recipient geography, preserve subject-line claims, and update the review matrix when a new filing pattern, statutory amendment, or appellate ruling gives one of those states a clearer operational profile.

How This Changes Campaign Review

The compliance workflow has to move closer to the send. Annual legal guidelines are too far upstream if the promotion changes on Thursday and the list goes out Friday morning. The review needs enough campaign context to test what the recipient actually sees against the offer that actually runs.

None of this requires treating every promotional email as catastrophic. The Costco settlement is large, but it is nowhere near theoretical maximum exposure. HB 2274 also lowered Washington’s future damages figure. At the same time, the settlement does not make the risk safely contained, because it confirms that familiar retail copy can produce real money, real notice programs, and real approval hearings.

For multi-state email programs, the working standard is now recipient-state risk review, controlled subject-line claims, and documented compliance procedures. The part that cannot be outsourced to a checklist is judgment: whether the inbox promise still matches the offer after merchandising, CRM, creative, and legal have all touched the campaign.

References

1. $14M Costco Settlement Resolves Class Action Lawsuit Over Promo Emails with Allegedly Misleading Subject Lines, ClassAction.org
2. Washington Legislature Narrows State Anti-Spam Law After Retail Litigation Surge, Morgan Lewis, June 2026
3. Time to Re-Act: The Washington Supreme Court’s Recent Email Subject Line Ruling Poised to Put Retailers on the Hook for Trillions - September 2025 Update, Benesch Law, September 2025
4. Trouble in Paradise: Subject Line Class Actions Come to Florida, Ballard Spahr, April 2026
5. California’s Anti-Spam Law Takes Center Stage in a Growing Wave of Class Action Lawsuits, FMG Law
6. CAN-SPAM Act: A Compliance Guide for Business, Federal Trade Commission
7. Sale Ends Today, and the Lawsuit Starts Tomorrow: Looking at the Wave of Email Marketing Class Actions, The Legal Intelligencer, June 15, 2026