UCEM: any commercial electronic message sent through any communication mode (where there is no prior relationship between sender and recipient and no prior consent from the recipient).

Electronic message: any message sent using a network service or applications service to an electronic address, endpoint or similar communication mode (regardless of whether the address exists or whether the message reaches the intended recipient).

A CEM is considered to have a Malaysian link if it meets any of the following conditions:

Sender-based connection: The sender is physically present in Malaysia, a Malaysian citizen or permanent resident (regardless of physical location), or an organization formed, incorporated, or carrying on business in Malaysia (regardless of where the message is sent or the infrastructure used).

Recipient-based connection: The message is sent to an individual physically present in Malaysia, a Malaysian citizen or permanent resident, or an organization formed, incorporated, or operating in Malaysia.

Infrastructure-based connection: The message is accessed via a computer, server, or network infrastructure located in Malaysia.

Express Consent: Requires a clear, affirmative act from the recipient, such as checking an unchecked box or submitting a form.

It must be voluntary, specific to the purpose of receiving CEMs, and the sender's identity, message purpose, and message types must be transparently disclosed.

Recipients must have a free and accessible way to withdraw consent, with requests processed within 10 working days.

Senders must also keep verifiable records of how and when consent was obtained.

Implied Consent: Can be reasonably inferred from an existing or prior relationship, such as a commercial transaction, membership, or subscription.

The content of the message must be directly related to that relationship.

Implied consent is subject to time limitations: up to 24 months from the last transaction or six months from a last inquiry if no transaction occurred.

Recipients must still be able to opt out.

Senders must maintain records of the relationship from which consent was derived.

Clear Sender Identification: The message must clearly display the sender's name or legally registered business identity and provide functional, responsive and accessible (e.g., no obscure navigation) contact details that can be easily used. This contact information must be accurate and functional for at least 30 calendar days.

Functional Opt-Out Facility: Every message must contain a free, clear, and functional mechanism for recipients to unsubscribe. This mechanism must be user-friendly, easily accessible, and remain operational for at least 30 calendar days. All opt-out requests must be processed within five business days.

Accurate Message Labelling: The subject line must accurately reflect the message's content and not be false, misleading or deceptive.

The letters  followed by a space must appear at the beginning of the subject line (or the first line of the message body if there's no subject line) to identify the message as an advertisement.

The Proposed Framework prevents any person from acquiring, distributing, making available, or using:

1. Automated tools or software designed to extract electronic addresses from online sources
2. Software that generates addresses through automated or pattern-based guessing, known as dictionary attacks
3. Any databases or lists of electronic addresses obtained through these methods
4. The rights to access, sell, or use such software or harvested lists, including those obtained indirectly