# REFERRAL PROGRAM — US VARIANT

> **Region:** United States, Canada
> **Email rules:** CAN-SPAM (opt-out OK for cold reach with caveats)
> **SMS rules:** **TCPA — WRITTEN CONSENT MANDATORY** for marketing SMS; the strictest rule in US referrals
> **Endorsement rules:** **FTC 16 CFR Part 255** — "material connection" disclosure required
> **State data laws:** CCPA/CPRA (California), VCDPA (VA), CPA (CO), CTDPA (CT), more rolling out
> **Cash incentives:** Allowed; many states require contest/sweepstakes registration if structure is lottery-like

---

## TCPA — Telephone Consumer Protection Act (the BIG US risk)

### What TCPA covers

TCPA regulates marketing calls and **automated SMS** to US phone numbers. Penalties:
- **USD 500 per text** (negligent violations)
- **USD 1,500 per text** (knowing/willful violations)
- Class actions are common; settlements often USD millions

### When TCPA applies to referral

- Customer's friend gets SMS from your platform: TCPA risk if no consent
- Pre-filled SMS with referrer sharing personal phone: Lower risk (peer-to-peer)
- Bulk SMS blast to imported "referred contacts": HIGH RISK
- "Refer a friend" form that auto-SMSes the friend: HIGH RISK without friend's consent

### Practical compliance

| Approach | Compliance |
|----------|-----------|
| **Auto-SMS to referee from your platform** | Need EXPRESS WRITTEN CONSENT from referee — almost impossible at referral moment |
| **Referrer's own phone sends SMS via share button** | Peer-to-peer; lower risk; legally referrer's communication |
| **Email referral with no SMS** | Safe under CAN-SPAM (still need accurate footer) |
| **WhatsApp share via deep link** | Peer-to-peer same as native SMS share |

**SAFEST DEFAULT:** Use share buttons that open the user's OWN messaging apps (SMS, WhatsApp, iMessage). Do NOT auto-SMS referees from your platform.

### Risky tactics (TCPA litigation magnets)

- "Tell us your friend's number, we'll text them for you"
- Bulk SMS to anyone who signed up for "future offers"
- Re-engagement SMS to dormant subscribers
- "Reply YES to confirm" without prior express consent

---

## FTC Endorsement Rules

### When they apply

If your referrer has a "material connection" (financial reward) to your brand AND posts publicly:
- Social media post about your product
- Blog post / YouTube video reviewing
- Affiliate link sharing on Twitter/X, Instagram, TikTok

### Disclosure requirements (16 CFR Part 255)

Referrer must clearly disclose:
- "I get a commission/discount/credit when you use my link"
- Disclosure must be CLEAR and CONSPICUOUS (not buried in hashtags)
- Acceptable: "#ad", "#sponsored", "I'm a [Brand] partner — affiliate link below"
- NOT acceptable: tiny text, "thanks to [Brand] for sponsoring"

### Practical compliance

- Tell referrers about FTC rules in T&C of program
- Provide example disclosure language
- For affiliates: contractually require disclosure
- Educational email after signup: "How to share legally"

---

## Email referral — CAN-SPAM compliance

### What you can / cannot do

| Action | OK? |
|--------|-----|
| Customer enters friend's email; you send "X invites you to try [Brand]" | Risky; some courts consider this commercial email needing CAN-SPAM compliance |
| Customer copies referral link; emails friend themselves | Yes (peer-to-peer; not your email) |
| Bulk-import "referred" contacts and email them | NO — CAN-SPAM applies; needs unsubscribe + footer; ISPs will junk |

### Safer pattern

```
Referrer fills form -> "Email yourself this template, then forward to your friend"
   |
   --> Customer (referrer) sends from their own inbox
   |
   --> Friend receives from someone they know — not from your domain
   |
   --> Click tracked via referral code/link
```

This pattern keeps the email squarely peer-to-peer (no CAN-SPAM applies to referrer's personal email).

---

## CCPA / state privacy laws — referee data

### When privacy laws apply

If you store the referee's PII (email, phone, name) before they sign up:
- CCPA (California): subject to data subject rights
- VCDPA (Virginia), CPA (Colorado), CTDPA (Connecticut): similar
- Privacy notice must cover this collection

### Practical compliance

- **Don't collect referee data unless you must** — referral codes work without it
- If you must store referee email/phone: privacy notice + CCPA opt-out mechanism
- Honor "do not sell or share" requests
- Keep retention short (delete if not converted within 30-60 days)

---

## Cash incentives + state lottery / sweepstakes laws

### When risk arises

- "Refer 5 friends, win USD 1000" -> may be a contest/sweepstakes
- States like NY, FL, RI have specific registration requirements
- "No purchase necessary" rule must apply if structured as sweepstakes

### Practical compliance

- Avoid "drawings" / "winners" structure unless you've reviewed legally
- Standard tiered cash rewards (each successful referral = USD 50) are NOT sweepstakes
- Add "void where prohibited" boilerplate
- Consult legal for any large-prize promotion (>USD 500)

---

## US referral structures that work

### B2C DTC standard (skincare, supplements, fashion)

```
Referrer: USD 25 store credit (or 25% off next order)
Referee: USD 20 off first order (or free shipping)
Trigger: Referee makes first purchase
Hold: 30 days (after return window)
```

### SaaS subscription

```
Referrer: 1 month free OR USD 30 credit
Referee: 50% off first month OR 14-day free trial extension
Trigger: Referee subscribes (first paid month)
Hold: 30 days
```

### High-ticket service (coaching, agency)

```
Referrer: USD 500 cash (or service credit)
Referee: 10-15% off first engagement
Trigger: Referee signs and pays first invoice
Hold: 60 days (post-payment)
```

### Multi-tier affiliate (creators / influencers)

```
Tier 1 (intro): 20% commission on first purchase
Tier 2 (recurring): 10% on next 90 days
Tier 3 (super-affiliate, 50+ refs/month): 30% commission, dedicated manager
```

---

## US tools for referral

| Tool | Best for | Pricing |
|------|---------|--------|
| **ReferralCandy** | Shopify DTC | USD 49+/mo |
| **Friendbuy** | Mid-market | USD 249+/mo |
| **Rewardful** | SaaS (B2B/B2C) | USD 49+/mo |
| **FirstPromoter** | SaaS | USD 49+/mo |
| **PartnerStack** | B2B partnerships | USD 500+/mo |
| **Talkable** | Enterprise DTC | Enterprise |
| **Mention Me** | Premium DTC | Enterprise |

All major tools include TCPA / CCPA compliance options out of the box.

---

## US email referral templates

### Subject lines

- "[First name] thought you'd like this"
- "A gift from [Referrer name]"
- "Your friend [First name] just sent you USD 20"
- "From one [profession/audience] to another: [Brand]"

### Body framing

- Lead with WHO referred (relationship signal)
- WHAT the friend uses it for (use case)
- WHY they'd benefit (specific outcome)
- Reward CTA (USD off, free trial)
- Unsubscribe link (CAN-SPAM)

---

## US benchmarks (2025-2026)

| KPI | Range |
|-----|-------|
| Share rate | 10-25% of customers |
| Conversion rate (refs to purchase) | 15-30% |
| K-factor | 0.2-0.5 typical; 0.7+ excellent |
| CAC via referral | USD 5-30 (vs paid ad USD 30-100+) |
| Referred LTV vs non-referred | +20-40% |

---

## US compliance checklist

### Before launch

- [ ] TCPA review: confirmed no auto-SMS to referees from platform
- [ ] FTC disclosure language prepared for affiliates
- [ ] CCPA-compliant privacy notice updated
- [ ] CAN-SPAM-compliant footer on referral emails
- [ ] T&C reviewed for state law compliance (sweepstakes if applicable)
- [ ] Tax forms ready (W-9 for affiliates earning >USD 600/year; 1099-NEC issued)

### Ongoing

- [ ] Monitor for self-referral fraud
- [ ] Honor opt-out / "do not sell" requests
- [ ] Track FTC disclosures by affiliates (sample audit)
- [ ] Pay affiliates on time (avoid bad-faith claims)

---

## US-specific risk flags

- **TCPA class actions:** Active legal area; a single SMS misstep can cost USD millions
- **State sweepstakes:** Don't structure as "win"; structure as "earn"
- **Influencer non-disclosure:** FTC has issued warnings + fines (Lord & Taylor, CSGO Lotto, etc.)
- **Children COPPA:** If your product or referral could reach under-13s, COPPA applies; need parental consent
- **Cross-border (Canada CASL):** Treat Canadian referrals like EU GDPR (opt-in)

---

*US Variant | Global Skill 18 | Over Powers Agency | v1.0.0*
