Canada’s federal anti-spam legislation (CASL), which is one of the strictest anti-spam law regimes in the world, applies to commercial electronic messages (CEMs) that encourage participation in a commercial activity.
While CASL was enacted more than seven years ago, there remain several common misperceptions relating to consent under CASL, including the distinction between express consent, implied consent and what kind of consent is needed to share electronic addresses with third parties.
Below is a discussion of the basic requirements under CASL relating to consent and some of the most common consent-related misconceptions we see in our practice (see also Anti-spam Compliance Errors).
EXPRESS CONSENT, IMPLIED CONSENT AND EXEMPTIONS
In general, one of the most common CASL consent request mistakes by many companies and other organizations that we advise is the distinction between express consent, implied consent and exemptions.
Express Consent
To satisfy the requirements for express consent under CASL, the sender must state the purpose (or purposes) for which the consent is being sought, include prescribed sender identification in the consent request and include all of the following specific information set out in section 4 of the Regulations (SOR/2012-36). Moreover, the request form for express consent (whether on paper, online or another type of electronic form) must require a positive opt-in and not a pre-checked box or opt-out (e.g., see CRTC Compliance and Enforcement Information Bulletin CRTC 2012-549).
Draft consent requests from clients are commonly missing one or more of the above required information (e.g., some of the prescribed contact information or a statement that recipients may unsubscribe at any time).
In other cases, there is no mechanism for positive opt-in consent (e.g., there is no opt-in box, an opt-in box is pre-checked or there is merely a statement in general terms and conditions that recipients consent to receiving electronic messages).
It is important for marketers sending CEMs to include all of the information required under CASL and the Regulations in all express consent requests. If even one element is missing, that will mean that the consent request was defective and all CEMs relying on the consent request will be non-compliant.
In this regard, it is useful to use a checklist for all consent requests to ensure that no express consent request requirements are missed.
Implied Consent
Unlike express consent, which will apply to any recipient provided that the identification and other requirements for express consent under CASL have been met, implied consent is limited to certain situations listed under subsection 10(9) of CASL.
Categories of implied consent include where: (i) there is an “existing business relationship”; (ii) there is an “existing non-business relationship”; (iii) a person has published their electronic address without a statement that they do not want to receive unsolicited CEMs and the message is relevant to their business; and (iv) a recipient has disclosed their electronic address to a sender without indicating that they do not want to receive unsolicited CEMs and the message is relevant to their business.
To put it another way, there is no general “implied consent” under CASL, but rather a variety of different categories of implied consent, that each has its own requirements (in addition to any requirements added by cases decided by the CRTC or Federal Court) in order to apply.
A sender that wants to rely on any of the above categories of implied consent must ensure that they meet all of the specific requirements of the particular type of implied consent.
For example, two of these categories of implied consent (the existing business relationship categories) are time limited (two years from the last purchase in the case of a sale and six months from the last inquiry in the case of an inquiry about a product or service).
Another category of implied consent (the so-called “conspicuous publication” category) requires not only that a person has conspicuously published their electronic address with no statement that they do not wish to receive electronic messages, but also that any CEM sent to them is relevant to their “business, role, functions or duties in a business or official capacity”. If any of these requirements is not met, this category of implied consent will not apply.
As with express consent, we commonly see clients who have not satisfied all of the requirements of the relevant category (or categories) of implied consent that they wish to rely on or have not divided their distribution list recipients according to the type of consent being relied on.
In other cases, clients that have purchased or acquired e-mail lists (e.g., from international list sellers or other sources) are unsure whether the list provider has obtained any express consents or met the requirements of any of the categories of implied consent under CASL. This can be particularly problematic for lists acquired from U.S. list sellers or other entities, considering the U.S. anti-spam regime is, in general, an opt-out regime not an opt-in regime like Canada.
We also see some clients confuse or equate various categories of implied consent with blanket exemptions from CASL. In this regard, marketers should be mindful that even if they can rely on one or more categories of implied consent under CASL, they still must also include the CASL prescribed sender contact information and an unsubscribe mechanism in CEMs (and, if requested, must action unsubscribe requests within ten business days). In other words, the other two core CASL requirements (prescribed sender identification information and an easy unsubscribe mechanism) are still required for all categories of implied consent under CASL.
CASL Exemptions
There are a number of exemptions to section 6 of CASL (the unsolicited CEMs section), which, if met, mean that section 6 does not apply at all (i.e., none of the three core requirements of CASL – consent, sender identification information and an unsubscribe mechanism – are required).
Some exempt categories of CEMs under section 3 of the Regulations (SOR/2013-221) include CEMs sent: (i) by an employee, representative, consultant or franchisee of an organization to another employee, representative, consultant or franchisee of the organization (and the message concerns the activities of the recipient organization); (ii) by an employee, representative, consultant or franchisee of an organization to an employee, representative, consultant or franchisee of another organization if the two organizations have a relationship and the message concerns the activities of the recipient organization; (iii) in response to a request, inquiry or complaint (or is otherwise solicited by the recipient); and (iv) to satisfy a legal or juridical obligation and other specified legal obligations and rights set out in the Regulations.
As with express and implied consent, senders that wish to rely on a CASL exemption must meet all the specific requirements of the particular exemption.
Also, in addition to the specific elements for each exemption, some exemptions (e.g., the “business-to-business” exemption under section 3(a)(ii) of the Regulations) have been further developed in CRTC or Federal Court decisions, thereby requiring senders to understand any additional requirements of an exemption arising from related case law. In some cases, therefore, relying on an exemption can provide significantly less comfort to electronic marketers than had they obtained express consent.
Some common CASL exemption-related errors we see include where a client is under the misunderstanding that a category of implied consent is a blanket CASL exemption (and, as such, does not fulfill the identification and unsubscribe requirements that still apply to the various categories of implied consent), where one or more elements of an exemption have not been met or where a distribution list is not divided by the type (or types) of exemptions being relied upon.
Requesting Consent on Behalf of Third Parties
A final, but important, CASL consent related issue is how to request consent for third parties to send CEMs. In this regard, our clients commonly either ask how to request consent for third parties or ask us to review draft consent requests that seek to request such consent.
Under CASL, express consent can be obtained: (i) on behalf of a person requesting consent for itself; (ii) on behalf of identified third parties; or (iii) on behalf of unidentified third parties (i.e., companies or individuals not known at the time the consent request is made, such as future (but currently unidentified) marketing partners or affiliates).
With respect to collecting express consent on behalf of an identified third party (or parties), in relation to we are frequently asked to provide advice, all of the general express consent request requirements set out in section 6 of CASL and the Regulations must still be met (discussed above).
However, in addition, an express consent request for identified third parties must also state the third party’s name (or doing business name if different), which person is seeking consent and the person on whose behalf consent is sought and the mailing address and at least one of the following for the third party: telephone number, e-mail address or web address (or a link to this information).
Some common errors we see relating to consent requests for identified third parties include merely listing third party company or affiliate names in a consent request (i.e., without any indication that consent for those third parties is being requested or why they are being listed), not including the specific consent request information set out in the Regulations relating to third parties or including any contact information for the third parties that want consent to send CEMs.
For more information on express and implied consent, CASL exemptions, and requesting consent for third parties under CASL, see: Anti-Spam (CASL), Anti-Spam Compliance Errors and Anti-Spam (CASL) FAQs.
**********
CANADIAN CASL (ANTI-SPAM LAW) PRECEDENTS
Do you need a precedent or checklist
to comply with CASL (Canadian anti-spam law)?
We offer Canadian anti-spam law (CASL) precedents and checklists to help electronic marketers comply with CASL. These include checklists and precedents for express consent requests (including on behalf of third parties), sender identification information, unsubscribe mechanisms, business related exemptions and types of implied consent and documenting consent and scrubbing distribution lists. We also offer a CASL corporate compliance program. For more information or to order, see: Anti-Spam (CASL) Precedents/Forms. If you would like to discuss CASL legal advice or for other advertising or marketing in Canada, including contests/sweepstakes, contact us: contact.
**********
SERVICES AND CONTACT
I am a Toronto competition/antitrust lawyer and advertising/marketing lawyer who helps clients in Toronto, Canada and the US practically navigate Canada’s advertising and marketing laws and offers Canadian advertising/marketing law services in relation to print, online, new media, social media and e-mail marketing.
My Canadian advertising/marketing law services include advice in relation to: anti-spam legislation (CASL); Competition Bureau complaints; the general misleading advertising provisions of the federal Competition Act; Internet, new media and social media advertising and marketing; promotional contests (sweepstakes); and sales and promotions. I also provide advice relating to specific types of advertising issues, including performance claims, testimonials, disclaimers, drip pricing, astroturfing and native advertising.
For more information about my services, see: services
To contact me about a potential legal matter, see: contact
For more regulatory law updates follow me on Twitter: @CanadaAttorney
