Tag Info

Basically, email providers include a small image with a unique identifier to see if the email was opened or not (if email is opened, the image is called from the server, hence the email was opened). If the receiver does not load these external images, or if the email is sent (or opened) in plain text and thus no external resources are being loaded, then ...

I am not a lawyer, and this is not legal advice. However, assuming you are in the US, if you otherwise follow the entirety of the CAN-SPAM act and put a warning on the refer a friend page ("Only refer people you know! Don't spam strangers!") then you should be ok, however, I would make sure to add a captcha or similar.