Do you need a precedent or checklist
to comply with CASL (Canadian anti-spam law)?
We offer Canadian anti-spam law (CASL) precedents and checklists to help electronic marketers comply with CASL. These include checklists and precedents for express consent requests (including on behalf of third parties), sender identification information, unsubscribe mechanisms, business related exemptions and types of implied consent and documenting consent and scrubbing distribution lists. We also offer a template CASL corporate compliance program.
For more information and to order, see: CASL Compliance Checklists and Precedents.
If you would like to discuss CASL legal advice or advice for other advertising or marketing in Canada, including contests/sweepstakes, contact us: Contact.
****************
COMMON CASL (CANADIAN ANTI-SPAM LAW)
COMPLIANCE ERRORS
Canada’s federal anti-spam legislation (CASL) came into force in 2014. Since then, marketers and their advisors have been working to comply with what remains a complex law with outstanding uncertainties in some key areas.
In providing CASL advice to clients since the law came into force, we have regularly seen some of the same compliance errors being repeatedly made.
The following are some of the most common CASL compliance errors that we see.
USING AGGREGATED DISTRIBUTION LISTS
THAT FAIL TO COMPLY WITH CASL’S
DOCUMENTING CONSENT REQUIREMENTS
One of the most common CASL compliance errors we see are issues relating to relying on old and often aggregated (i.e., combined) marketing lists. In this regard, it is not uncommon for clients to tell us that they are using an old (sometimes pre-CASL) distribution list and that they are not sure whether or how any consents were obtained. Commonly, such lists are not regularly reviewed or scrubbed of names where consents have been withdrawn or a type of CASL implied consent or exemption no longer applies.
In general, there is potential CASL-related risk in relying on old distribution lists where it is unknown whether any valid CASL consents have been obtained or any type of implied consent or exemption under CASL exists.
While CASL does allow for either express consent and a number of types of implied consent, for both express consent and the various types of implied consents under the legislation there are specific requirements that must be complied with. For example, express consent requests must include prescribed sender identification information set out under CASL and its regulations.
Similarly, for each type of implied consent and exemption under CASL, including the existing business relationship types of implied consent, the so-called “business card” category of implied consent, “conspicuous publication” implied consent and the business-to-business exemption, there are specific multi-part tests that must be met for each.
For example, for the “conspicuous publication” category of implied consent, (i.e., for published e-mail or other electronic addresses) it is not sufficient that an e-mail address was merely posted on the web. A three-part test must be met for each e-mail address collected as follows: (i) the e-mail address was posted on the web or otherwise published; (ii) there is no statement that the recipient does not wish to receive unsolicited electronic messages; and (iii) the message is relevant to the recipient’s “business, role, functions or duties in a business or official capacity.”
Electronic marketing lists should be divided into the type(s) of express or implied consent (or relevant CASL exemption) and addresses removed when recipients have unsubscribed or the relevant type of implied consent or exemption no longer applies.
In the case of old distribution lists where it is unknown if any type of express or implied consent was obtained and are not structured as discussed above and regularly reviewed and scrubbed to remove recipients’ names where neither consent nor an exemption still applies there is clear risk for marketers.
CASL Compliance Checklists and Precedents: For information about the CASL compliance checklists and precedents we offer, including a template CASL corporate compliance program, see: CASL Compliance Checklists and Precedents.
“PASSIVE” CONSENT REQUESTS
In general, CASL allows electronic marketers to rely on express consent (e.g., an opt-in electronic form) or a number of types of implied consent (e.g., existing business relationships) to send commercial electronic messages (CEMs).
We commonly see, however, marketing materials where there is an attempt to gather consent by “passive means”, such as by merely participating in a contest or other promotion. Sometimes such passive consent language is merely included in web page footers, contest rules or privacy policies, without any active step being required by a recipient or consent requests that fail to include the prescribed information under CASL.
Electronic marketers need to be aware that if they can’t rely on a category of implied consent or CASL exception, then they need to obtain positive, express opt-in consent in the manner set out by CASL (e.g., via a paper or electronic form that includes all prescribed identification and other information required by CASL).
CASL Compliance Checklists and Precedents: For information about the CASL compliance checklists and precedents we offer, including express and implied consent requirements, see: CASL Compliance Checklists and Precedents.
INCOMPLETE EXPRESS CONSENT REQUESTS
CASL is highly prescriptive and sets out specific identification information that must be included in both consent requests and in CEMs themselves that are sent.
We commonly see initial drafts of client marketing materials that include some, but often not all of, the identification information required by CASL. In addition, the information that must be included (e.g., in a consent request) can vary, according to, among other things, if consent is being requested on behalf of a single or multiple senders, on behalf of a third party (e.g., a related company or affiliate marketer) or on behalf of an unidentified third party (i.e., consent is requested for potential future marketing partnerships).
Other nuances for express consent requests include the requirement to include the names of all persons on whose behalf consent is sought and the type of name of the person requesting consent, depending on which name they do business under (i.e., corporate name or doing-business-as or “DBA” name).
In addition, it is possible to request consent to send CEMs for three types of senders: (i) the person requesting consent on their own behalf, (ii) an identified third party (or multiple third parties), such as a related company or affiliate marketer or (iii) an unidentified third party (or multiple unidentified third parties), such as gathering consents for potential future marketing partners.
We commonly see, however, requests to gather consents for a broad range of persons without complying with CASL’s requirements, such as failing to adequately identify third party senders where their identities are known or including the required contact information depending on who consent is being requested on behalf of.
There are also very specific and complex rules where consent is being requested for as yet unidentified third parties, which should be reviewed carefully before relying on this type of consent.
CASL Compliance Checklists and Precedents: For information about the CASL compliance checklists and precedents we offer, including express consent requirements, see: CASL Compliance Checklists and Precedents.
NON-COMPLIANT CONSENT REQUESTS
FOR UNIDENTIFIED THIRD PARTIES
Another common CASL compliance error that we see are requests for consent for unidentified third parties without meeting the specific rules under CASL.
Some examples include an express consent request that includes a request for consent for “marketing affiliates”, “marketing partners” or “partners” and similar language attempting to gather blanket type consents for any and all entities the person requesting consent may share electronic addresses with in the future but who are not yet known.
Under CASL, it is possible to request consent to send CEMs for three categories of persons: (i) the person requesting consent themselves on their own behalf, (ii) an identified third party (or multiple identified third parties), such as a related company or affiliate marketer or (iii) an unidentified third party (or multiple unidentified third parties) who are as yet unknown when the express consent request is made, such as future marketing partners.
The rules for these types of consent requests are set out in section 10(2) of CASL and section 5(1) of the Governor in Council Regulations under CASL (GIC Regulations).
The requirements for express consent requests for as yet unidentified third parties require, among other things, that CEMs identify the person that obtained consent (as required by CASL), any person with whom electronic addresses are shared also comply with CASL’s unsubscribe requirements and that recipients may choose to unsubscribe from either the person that obtained consent or any other person authorized to send CEMs.
There are also obligations on third parties with whom electronic distribution lists have been shared to notify the original person that obtained consent as to the scope of an unsubscribe request by a recipient (i.e., who the recipient is requesting to be unsubscribed from).
Given the complexity of the CASL rules for express consent requests for as yet unidentified third parties, many marketers opt not to make such consent requests and limit consent requests to the actual sender and in some cases also identified third parties (e.g., identified related companies or identified affiliate marketers).
Marketers that want to request and obtain express consent for as yet unidentified third parties should carefully review the applicable rules under CASL and the GIC Regulations.
It is also prudent to implement list sharing agreements with third parties with whom electronic addresses are shared that include the obligations set out under CASL for those requesting consent for unidentified third parties and the third parties that include, among other things, representations by the third party (or parties) to comply with CASL, CASL required notification requirements for unsubscribe requests and indemnities in favour of the person that obtained consent in the event that the third party fails to comply with CASL.
CASL Compliance Checklists and Precedents: For information about the CASL compliance checklists and precedents we offer, including obtaining express consents to send CEMs, see: CASL Compliance Checklists and Precedents.
NON-CASL COMPLIANT THIRD PARTY
(LIST BROKER/PROVIDER) E-MAIL LISTS
Another common CASL compliance error we see is clients that use bulk e-mail distribution lists from list brokers/providers.
While there is no issue in general using list brokers/providers or third party lists per se, such lists must have been compiled to comply with CASL. In some cases, such lists are assembled by non-Canadian entities, where it is not clear whether, for example, express consent was obtained to use the e-mail addresses or any type of implied consent or exemption under CASL was complied with.
While electronic marketers can use e-mail addresses obtained from list brokers/providers, they should satisfy themselves that the e-mail lists obtained comply with CASL’s consent requirements.
For example, if using e-mail lists obtained from the web for B2B marketing, marketers should ensure that not only were such e-mails conspicuously posted with no message against solicitation, but also that any marketing sent is likely to be relevant to the recipient’s business.
Electronic marketers relying on third party supplied e-mail distribution lists are also well advised to implement list sharing agreements with the list suppliers. However, if a list broker/provider has failed to comply with CASL in compiling an electronic distribution list, a list sharing agreement would need to be enforced against the supplier, which may not be an ideal remedy for the party acquiring the distribution list.
CASL Compliance Checklists and Precedents: For information about the CASL compliance checklists and precedents we offer, including obtaining consents on behalf of third parties, see: CASL Compliance Checklists and Precedents.
For more information about list sharing agreements, see: here.
BULK COLLECTION OF ONLINE E-MAIL ADDRESSES
WITHOUT MEETING CONSPICUOUS PUBLICATION
IMPLIED CONSENT
CASL includes a number of potentially helpful types of implied consent and exemptions in addition to the ability to obtain express consents to send CEMs.
For example, CASL includes two B2B categories of implied consent, including one for the collection of e-mail addresses that are conspicuously posted online or elsewhere.
However, the test for this type of implied consent, like others types of CASL implied consents and exceptions, is very specific and requires that a 3-part test be met for every e-mail gathered.
Among other things, this so-called “conspicuous publication” type of implied consent requires that any marketing sent to a person whose e-mail was posted online is “relevant to [their] business, role, functions or duties in a business or official capacity.”
CASL Compliance Checklists and Precedents: For information about the CASL compliance checklists and precedents we offer, including type of implied consents and exemptions, see: CASL Compliance Checklists and Precedents.
FAILING TO UPDATE ELECTRONIC
DISTRIBUTION LISTS
While much of the compliance discussion for CASL tends to relate to its three core requirements – i.e., consent, sender identification information and the un-subscribe mechanism – back-end compliance is also very important for electronic marketers.
In this regard, CASL requires, among other things, that recipients that request to be unsubscribed be removed from a distribution list within 10 days.
It is also important for marketers to ensure that, unless they have refreshed consent, that existing customers be removed from marketing lists after two years of purchasing a product/service or six months after an inquiry about a product or service (i.e., the existing business relationship category of implied consent is time-limited and, as such, lists must be regularly scrubbed on a rolling basis).
In all cases, the onus is on senders to prove that they have consent, whether express or implied, to send CEMs, which should be documented on a rolling basis.
CASL Compliance Checklists and Precedents: For information about the CASL compliance checklists and precedents we offer, including a template CASL corporate compliance program, see: CASL Compliance Checklists and Precedents.
SHARING DISTRIBUTION LISTS WITH THIRD PARTIES
WITHOUT CASL CONSENTS
Some electronic marketers want to share consents for electronic marketing with other parties, whether they are related entities such as affiliates or third party or affiliate marketers.
While this is certainly possible under CASL, marketers need to know that there are specific requirements that must be met depending on who a list will be shared with (e.g., to expressly identify a third party with whom consent is being gathered on behalf, including their contact information and other requirements if the identity of a third party with whom a list will be shared is not known at the time consent is requested).
Electronic marketers should also be aware that there is also potential risk not only if they violate CASL, but also if they assist a third party violate the legislation based on an “aiding and abetting” type provision in section 9 of CASL.
As such, it is often prudent for marketers that want to share electronic marketing lists to ensure that they have list sharing or other agreements in place with third parties with whom they intend to share e-mails that includes, among other things, a covenant by the third party to comply with CASL and an indemnification in favour of the marketer sharing the list in the event the third party violates CASL.
CASL Compliance Checklists and Precedents: For information about the CASL compliance checklists and precedents we offer, including consents gathered for third parties, see: CASL Compliance Checklists and Precedents.
COMBINING ELECTRONIC MARKETING WITHOUT CONSENTS
WITH A CONTEST OR OTHER PROMOTION
We commonly see marketing where clients want to not only reply to an inquiry, but to also engage in additional (i.e., wider) marketing than merely a follow up to a particular inquiry.
A good practical example is promotional contests, where after an entrant enters the contest and provides their e-mail address a sponsor will want to send other advertising/marketing unrelated to the contest either during or after the contest closes.
However, sending CEMs is risky unless a sender either has consent (whether express or implied) or can rely on one of the exceptions under CASL.
Helpfully, there is an exception from the unsolicited CEMs section of CASL (section 6) for replying to requests or inquiries. However, this exception is narrow.
As such, for marketers that want to build distribution lists in connection with a contest or other type of promotion, it is often prudent to ensure that the participants in the contest/promotion also provide express consent to receive other types of marketing (i.e., which is unrelated to the administration of the promotion).
Express consents to send CEMs during or after a contest or other promotion are often requested and gathered on the contest/promotion entry page.
CASL Compliance Checklists and Precedents: For information about the CASL compliance checklists and precedents we offer, including express and implied consents, see: CASL Compliance Checklists and Precedents.
NON-COMPLIANT
“FRIENDS AND FAMILY”
MARKETING CAMPAIGNS
Some marketers run “friends and family” promotions – for example, offering additional contest entries to entrants that share the details of the contest with friends or family.
Marketers should be aware, however, that while there is an exception to the unsolicited CEM section of CASL for messages sent to a person with whom they have a personal or family relationship, these terms are very specifically defined. For example, “family relationship” is limited to spouses, common-law partners and parent-child relationships. “Personal relationship” is, unfortunately, defined in a multi-factor and case-by-case fashion, such that it is often impractical to rely on this exception for any broad “friends and family” type promotion.
In sum, marketers need to be aware that there is potential risk for both themselves and their clients in running friends and family type promotions, if they cannot satisfy themselves that the specific definitions of “family relationship” and/or “personal relationship” under CASL can be met.
To put it another way, marketers could, depending on the type of promotion, essentially be assisting participants in a promotion violate CASL by encouraging electronic marketing for the promotion to third parties from whom consent has not been obtained and no exception applies.
CASL Compliance Checklists and Precedents: For information about the CASL compliance checklists and precedents we offer, including types of implied consent and exceptions, see: CASL Compliance Checklists and Precedents.
********************
SERVICES AND CONTACT
We are a Toronto based Canadian competition and advertising law firm that helps clients in Toronto, Canada and the United States practically navigate Canada’s advertising and marketing laws and offers Canadian advertising/marketing law services in relation to print, online, new media, social media and e-mail marketing.
Our Canadian advertising/marketing law services include advice in relation to anti-spam legislation (CASL), Competition Bureau complaints, the general misleading advertising provisions of the federal Competition Act, Internet, new media and social media advertising and marketing, promotional contests (sweepstakes) and sales and promotions. We also provide advice relating to specific types of advertising issues, including performance claims, testimonials, disclaimers, drip pricing, astroturfing and native advertising.
For more information about our services, see: services
To contact us about a potential legal matter, see: contact
For more information about our firm, visit our website: Competitionlawyer.ca
