The Canada Anti-Spam Law (“CASL”) takes effect July 1, 2014—now is the time to make sure you are ready.
The first provisions of the Canada Anti-Spam Law (CASL) take effect on July 1, 2014. When the new provisions take effect, companies will need to comply with strict new content and opt-in consent requirements for their electronic marketing and commercial communications to recipients in Canada. The law includes several narrow exemptions and carve-outs, however, it is critical that companies take steps to ensure any marketing messages sent fall within an exception or comply with the CASL consent requirements. Below is a broad overview of the coverage of the CASL, the key compliance steps, and ways to prepare before July 1.
What does the CASL cover?
The CASL applies to any “Commercial Electronic Message” (CEM). The CASL defines “Commercial” as content that offers to provide a commercial opportunity. This differs substantially from the CAN-SPAM Act where the message itself must have only a primarily commercial purpose. Under the CASL, anything more than a hyperlink in a signature line—such as a promotional tagline with the hyperlink—will likely be commercial. The CASL will not apply, however, if the message is purely part of a transaction with a customer, such as a password reset form, or an electronic invoice.
“Electronic Messages” are messages sent to any electronic address, including: email, SMS, IM , phone accounts, or similar addresses. The CASL does not require consent to make or reply to posts made on a blog, twitter, or a Facebook wall, for example, but if a company sends a message to a Facebook user, the CASL will apply. Further, the CASL does not apply to interactive voice conversations, faxes, or voicemails, so clients may make calls or even seek verbal consent (so long as the communication complies with the Unsolicited Telecommunications Rules)
The CASL applies to CEMs that are sent or received within Canada—but not if they are merely routed through Canada. Further, a CEM may be exempt from the rules if the sender has reason to believe that recipient is outside Canada, so long as the sender complies with applicable local law (such as CAN-SPAM). Therefore, recipients who have provided a non-Canadian physical address will be exempt from the CASL. Finally, the CASL does not apply to CEMs between businesses so long as the CEM relates to the business of the recipient entity and the entities have an ongoing business relationship.
The CASL requires senders of a CEM to obtain consent from a recipient before sending a CEM. Consent may be express or implied, however the requirements of each are strict, and senders should be diligent to ensure the proper consent. The penalty for violating the CASL can be up to $10 million Canadian dollars for a business ($1 million for an individual).
The most effective consent under the CASL is the express opt-in consent by the intended recipient. If a company is able to obtain express consent, the consent does not expire until the customer unsubscribes or otherwise opts out from the communications. Express opt-in consent can be obtained orally or in writing and before or after the law takes effect, however, consent is more easily obtained before July 1.
Prior to July 1, express opt-in consent may be obtained via email, such as a simple email asking the customer click yes or no to receiving further communications. After July 1, any such email will itself be a CEM and therefore prohibited without prior consent by the recipient. Once the law takes effect, consent can be obtained easily using unchecked checkboxes, or asking for an email address after disclosing the intent to send CEMs.
Importantly, the CASL also requires senders to document and, upon request, provide proof of consent. Before sending a CEM, senders should document the following:
– whether consent was obtained in writing or orally;
– when it was obtained;
– why it was obtained; and,
– the manner in which it was obtained.
Consent may be implied if the sender and recipient have an “Existing Business Relationship.” An Existing Business Relationship exists when a recipient has made a purchase or other bartered exchange from the sender. If there is no purchase, then a Business Relationship may also exist upon an “inquiry or application” regarding the sender’s product or service. Remember, the purchase must be directly between the sender and recipient—modified rules apply to referrals and transactions executed through third parties.
If a recipient has made a purchase, entered a contract, engaged in another business exchange, or submitted an inquiry or application prior to July 1, 2014, that recipient is presumed to consent to communications until July 1, 2017. If a recipient makes a purchase or other exchange after July 1, 2014, consent is implied for 2 years from the date of purchase; or, if an application or inquiry, for 6 months after the application or inquiry. Consent may be renewed with each purchase, application, or inquiry. All CEM must be discontinued, however, if the recipient unsubscribes or otherwise opts out. Once a recipient opts out, they may no longer consent impliedly under the Business Relationship exception.
The CASL requires the same documentation and production requirements for both express and implied consent. Furthermore, senders should tag electronic addresses in the CRM or other database so that senders do not rely on expired consents. More importantly, consent may be updated, so documenting the consent allows for tracking renewed Business Relationships, or when the recipient expressly opts in or out.
There are two important content requirements for each CEM.
– CEM must identify the sender or entity on behalf of whom a CEM was sent
– There must be a link to unsubscribe (must remain valid for 60 days after CEM sent)
The unsubscribe mechanism may allow the customer to unsubscribe from all messages, or just a class of messages. The sender must give effect to the unsubscribe request as soon as practicable and not later than 10 days after it was sent. The sender may unsubscribe via reply email, through a website, or other similar means.
What to do today
– Consider sending an email to desired CEM recipients before July 1 to obtain express consent
– Make sure database/CRM systems include tagging for Canadian electronic addresses
– Ensure there is documentation of purchase, inquiry or application, if implied consent
– Ensure there is documentation of express opt in consent, if applicable
– Remove pre-checked boxes if requesting consent from Canadian users
– Make sure recipients are able to unsubscribe from every CEM sent
This article should not be construed as legal advice, and no attorney-client relationship is formed by reading this article or contacting the author, Austin Chambers, Law Clerk.