Is reading someone's address book with his permission and knowledge and sending bulk email an act of spam?

There is this scenario.

I registered dropbox.com (hereafter DB) and were using it. And DB offered me a referral program that I'll get 250mb for every free register from my referrer. So I gave DB my gmail username/password so DB can read my address book and send bulk email to everyone. Strange thing is not all services send emails to "everybody" which is over 2,000, for instance, groupon limits to 50 recipients.

So Q1: Is DB's matter legal?

The other day I signed up and affiliate program and wanted to send the affiliate link to everybody in my address book. Gmail also has the limitation like 50 to 100 recipients so I was looking for an online service that I can enter my email address, password and send to everybody in my address book. But I could not find one. So I got an idea to write that kind of service on my own (something like openinviter but hosted).

Q2: Is that kind of service legal?

Q3: Is it still legal if I append some ads in the email body and generate revenue from it?

It doesn't matter if the owner of the address book gives you permission.

If the recipients didn't give you permission, it is considered spam and, in the United States, this is a federal offense. See also http://business.ftc.gov/documents/bus61-can-spam-act-compliance-guide-business, about the CAN-SPAM Act (incidentally, "CAN-" does not mean you are allowed to spam, it means spam must be stopped :-)

(Not a Lawyer)

OK having read the details of the CAN-SPAM act it would appear that you can do it ... IF

1. you say what your doing in the email
2. you ensure they setup the message according to the rules.
3. you provide opt out
4. you actually honour the opt out

My reading of it says that any one time hit would be considered a warning shot for a given "messager" provided they followed the rules. Also point 7 says its your customers problem not yours ... get a lawyer to cover this one off in the terms of service.

To address your DM 500 or 2000 I don't think it matters if its only 1 person ... if they complain your in the firing line.

So for your actual business concept which is harvest other peoples inboxes, by request on a third parties behalf ... if I understood the question correctly.

1. It reads like its your customers liability not yours
2. If you provide all the measures and don't let your cusotmer contact that specific person (target) again regardless of the inbox being havested.
3. have a huge dislaimer
4. talk to a real lawyer.

Then you should be ok as simply offering it as a service any other DB style company dones't have to write and manage themselves.

Is it in the "spirit of the law" ... borderline ... just don't have magic gmail addresses with a laundry list of email address that just "happen to cover your closest 5 million friends" ... you will get nailed sooner or later, and good thing too.

... that said, don't send to my email address or I will find you :)