The new anti-spam and anti-spyware legislation has such a broad reach and is so complex that organizations that conduct business online will need to reassess their business practices for sending commercial electronic messages or face stiff new penalties that can go up to $1 million for individuals and $10 million for corporations for each violation, according to experts.