CASL basics for business email and texts

A commercial electronic message (CEM) is an electronic message that encourages participation in a commercial activity: promoting a product or service, a sale, an event, a business opportunity. Email is the obvious case, but the Canadian Radio-television and Telecommunications Commission (CRTC), which enforces CASL, is clear that commercial messages sent by text or Bluetooth messaging are covered as well, and so are some app notifications. Messages sent to recipients in Canada from another country must also comply.

The CRTC sums up the core obligations in three requirements for every CEM: obtain consent, provide identification information, and provide an unsubscribe mechanism. Some messages are exempt or partially exempt, such as certain business-to-business messages between organizations with a relationship, and messages sent by or for registered charities to raise funds. Exemptions are narrow and fact-specific, so check them with counsel rather than assuming.

Express consent is a clear, positive opt-in. The CRTC says it can be obtained in writing or orally, does not expire, and can be withdrawn at any time. Pre-checked boxes are not valid: silence or inaction cannot be treated as express consent, and the person must take a positive action, such as ticking an empty box.

Implied consent arises from certain relationships. The most common is an existing business relationship, such as a purchase within the past two years, or an inquiry or application within the past six months. Implied consent can also arise when a person conspicuously publishes their business email address and the message is relevant to their role, or where an address was provided without a statement that the person does not want messages. Unlike express consent, implied consent based on a relationship has a time limit.

The CRTC's practical advice is worth repeating: if you are unsure whether you have implied consent, ask for express consent.

Every CEM must identify the sender, and anyone on whose behalf it is sent, with contact information including a mailing address and a phone number, email address or web address. Home-based businesses don't have to list a home address, but must provide a valid mailing address where they can be reached.

Every CEM must also contain an unsubscribe mechanism that can be 'readily performed': for example, a clear link that leads to a simple page, or replying STOP to a text. The CRTC gives an example of a six-step process involving logins and searching for links as non-compliant. The unsubscribe link must remain valid for at least 60 days after the message is sent, and requests must be processed without delay and no later than 10 business days after receipt.

Under CASL the onus is on the sender to prove consent. The CRTC notes there is no prescribed retention period for consent records, but because express consent does not expire, you need to keep the evidence for as long as you keep sending messages based on it. This is where most organizations are weakest. Good practice:

• Capture the date, time, source (web form, event, in-store), the exact consent wording shown, and the IP address or staff member for each opt-in.
• Store consent in your email platform or CRM, not in scattered spreadsheets, and keep the form versions you used.
• Track implied-consent start dates, such as purchase or inquiry dates, so the platform can expire them automatically.
• Sync unsubscribes across every system that sends messages, including sales reps' own mailboxes.
• Restrict who can import lists, and record the consent basis for every import.
• Include consent evidence and unsubscribe handling in vendor contracts if an agency sends on your behalf.

CASL's section 8 also covers installing computer programs on another person's computer system in the course of commercial activity, where the person installing is in Canada or the computer system is. You need express consent from the owner or an authorized user, and the request must clearly describe the function and purpose of the program. Programs that do things the user would not expect, such as collecting personal information, changing settings or allowing remote activation by a third party, require additional prominent disclosure, separate from the licence agreement. Some installations are deemed consented to based on the person's conduct, such as certain updates and programs that run only through software the user already agreed to install.

Penalties are significant. The CRTC can impose administrative monetary penalties of up to $1 million per violation for an individual and $10 million for a business.

• Buying or renting lists and assuming the seller's consent covers you.
• Treating a business card or a trade-show badge scan as express consent without the required wording.
• Pre-checked boxes on checkout pages and contact forms.
• Assuming an old customer list still carries implied consent years after the last purchase.
• Unsubscribe links that require a login, or that only remove the person from one list.
• Forgetting implied-consent expiry dates.
• No records of how a contact entered the list.