Canada’s federal anti-spam legislation (CASL), which is one of the strictest spam law regimes in the world, applies to commercial electronic messages (CEMs) that encourage participation in a commercial activity. CEMs are defined broadly as electronic messages with a purpose to encourage participation in a commercial activity, including offering or advertising to purchase or sell products, goods, services or land.
The purported purpose of CASL is to promote the efficiency and adaptability of the Canadian economy by regulating commercial conduct that discourages spam, notably electronic messages sent without express or implied consent of a recipient (or that falls into one of the exemptions under CASL). In reality, it is not clear that CASL has in fact deterred the vast bulk of spam delivered to Canadian consumers’ inboxes, particularly from offshore senders.
Also, more than seven years after CASL was enacted, there still remain a number of common misperceptions relating to the requirements for express consent, implied consent (or more accurately the different categories of implied consent under the legislation) and CASL exemptions.
While implied consent or an exemption can be very useful where a sender does not have express consent, it is important that all of the requirements of the particular type of implied consent or exemption be met (and documented). This, however, is frequently not the case with many of the files we work on, even with very sophisticated companies and brands.
Below is a discussion of the basic requirements for consent under CASL and some of the common errors we see made by senders that wish to rely on one or more categories of implied consent or a CASL exemption.
Express Consent
In general, section 6 of CASL prohibits sending CEMs unless the sender has consent (express or implied) and the CEM includes prescribed sender identification information and an unsubscribe mechanism.
As such, unless a sender can rely on one of the exemptions under CASL (discussed below), the sender must either have express consent (section 10(1)) or implied consent (section 10(9)) to send a CEM, the onus of which is on the sender to document in the event of an investigation (section 13).
To satisfy the requirements for express consent under CASL, the sender must state the purpose (or purposes) for which the consent is being sought, include prescribed sender identification in the consent request and all of the following specific information set out in the Regulations (SOR/2012-36, section 4): (i) the name by which the person seeking consent carries on business, if different from their name (if not, the name of the person seeking consent); (ii) if the consent is sought on behalf of another person, the name by which the person on whose behalf consent is sought carries on business, if different from their name (if not, the name of the person on whose behalf consent is sought); (iii) if consent is sought on behalf of another person, a statement indicating which person is seeking consent and which person on whose behalf consent is sought; (iv) the mailing address, and either a telephone number providing access to an agent or a voice messaging system, an email address or a web address of the person seeking consent or, if different, the person on whose behalf consent is sought; and (v) a statement indicating that the person whose consent is sought can withdraw their consent.
One of the most common consent request mistakes by many companies and other organizations we advise is failing to include all of the above information in consent requests (for more information, see Anti-Spam Law (CASL) Compliance Errors).
We often counsel clients in relation to consent requests by providing a checklist of consent request requirements and recommending that they review all express consent requests against the checklist. To put it another way, every express consent request must include all of the prescribed elements in CASL and the Regulations. It is also worth noting that in the past several years, the CRTC has pointed to defective consent requests as the top issue in relation to its enforcement of CASL.
Also, to satisfy the express consent requirements of sections 6 and 10(1) of CASL, the request form for express consent (whether paper or electronic) must request a positive opt-in (i.e., as opposed to a pre-checked box or opt-out). In this regard, the CRTC’s position is that express consent cannot be obtained through toggling – i.e., where a consent checkbox or other mechanism is pre-checked or pre-populated to agree to consent (CRTC Compliance and Enforcement Information Bulletin CRTC 2012-549, section 4).
As with failing to include all of the prescribed information for express consent requests, we still routinely see draft client consent requests with pre-checked boxes or no positive opt-in mechanism whatsoever (or passive consent requests in general terms and conditions).
Implied Consent
In addition to express consent, CASL sets out a number of categories of implied consent that rely on different types of specific relationships between senders and recipients. In this regard, section 10(9) of CASL sets out a number of categories of implied consent, including the following:
- Existing business relationship category of implied consent: where the sender and the recipient have an existing business relationship (as defined in section 10(10) of CASL) or non-business relationship (as defined in section 10(13)).
- “Conspicuous publication” category of implied consent: where a person has conspicuously published their electronic address, there is no statement that they do not want to receive CEMs and the message is relevant to their business, role, functions or duties in a business or official capacity.
- “Business card” category of implied consent: where a person has disclosed to the sender their electronic address without indicating that they do not want to receive CEMs and the message is relevant to their business, role, functions or duties in a business or official capacity.
“Existing business relationships” are defined under section 10(10) of CASL and include the purchase or lease of a product, goods or service within the past two years before a CEM is sent and an inquiry about a product or service within the past six-months before a CEM is sent.
While CEMs sent under the categories of implied consent set out in section 10(10) of CASL are time-limited, express consent can be requested from recipients during these periods (which does not expire unless a recipient unsubscribes).
Regardless of whether consent is express or implied, however, senders must still include prescribed contact information and an unsubscribe mechanism in CEMs (and, if requested, must unsubscribe recipients who request within ten business days). In this respect, the various categories of implied consent under CASL are not exemptions from the legislation altogether and the other core requirements (i.e., sender identification and unsubscribe mechanism) must still be met.
A few of the most common implied consent related errors we see include where the time period for a category of implied consent has expired (e.g., CEMs sent more than two years from the last sale), marketing lists gathered from the web or social media without reviewing whether CEMs are likely relevant to the recipients’ business duties and where addresses for implied consent recipients are mixed into general distribution lists with no indication of what category of implied consent is being relied upon (or any documentation for the implied consent).
CASL Exemptions
In addition to express and implied consent, there are several exempt classes of CEMs to which section 6 of CASL (the unsolicited CEMs section, which is most relevant to marketers) does not apply (i.e., none of the three core requirements of CASL – consent, sender identification and an unsubscribe mechanism – are required).
Some exempt categories of CEMs include:
- CEMs sent by an employee, representative, consultant or franchisee of an organization to another employee, representative, consultant or franchisee of the organization or to an employee, representative, consultant or franchisee of another organization if the organizations have an existing relationship and the message sent relates to the activities of the recipient organization (SOR/2013-221, section 3(a)).
- CEMs sent in response to a request, inquiry or complaint (or is otherwise solicited by the recipient) (SOR/2013-221, section 3(b)).
- CEMs sent to satisfy a legal or juridical obligation and other legal obligations and rights set out in SOR/2013-221, section 3(c).
Like implied consent, the exemptions from CASL do not require express consent (or any consent). Like express consent, CASL exemptions are not time limited provided that the requirements of each exemption are met.
As with the various categories of implied consent under CASL, however, all of the requirements for each particular exemption must be met. If one requirement is not met, that will mean that the exemption does not apply and raise enforcement risk.
For example, for the business-to-business exemption under section 3(a) of the Regulations (SOR/2013-221), a sender must send CEMs to an “employee, representative, consultant or franchisee” of another organization, the two organizations must have a relationship and the message must relate to the activities of the recipient organization. If any one of these requirements is not met, then the exemption cannot be relied upon.
Also, like the various categories of implied consent under CASL, whether or not an exemption is met is factual and evaluated on a case-by-case basis by the CRTC. As such, there always remains a risk that in a particular situation an exemption has not been met. In this respect, for the business-to-business exemption, both the CRTC and Federal Court have issued decisions discussing the meaning of key terms for this particular exemption, in proceedings involving Compu.Finder including the meaning of “relationship” between organizations and whether a CEM “concerns the activities” of an organization.
Given the case-by-case nature of both the various categories of implied consent and exemptions under CASL, express consent still remains the strongest (and in many cases most advisable) basis on which to send CEMs.
For more information on express and implied consent and exemptions under CASL, see: Anti-Spam (CASL), Anti-Spam Compliance Errors and Anti-Spam (CASL) FAQs.
***********
CANADIAN CASL (ANTI-SPAM LAW) PRECEDENTS
Do you need a precedent or checklist
to comply with CASL (Canadian anti-spam law)?
We offer Canadian anti-spam law (CASL) precedents and checklists to help electronic marketers comply with CASL. These include checklists and precedents for express consent requests (including on behalf of third parties), sender identification information, unsubscribe mechanisms, business related exemptions and types of implied consent and documenting consent and scrubbing distribution lists. We also offer a CASL corporate compliance program. For more information or to order, see: Anti-Spam (CASL) Precedents/Forms. If you would like to discuss CASL legal advice or for other advertising or marketing in Canada, including contests/sweepstakes, contact us: contact.
**********
SERVICES AND CONTACT
I am a Toronto competition/antitrust lawyer and advertising/marketing lawyer who helps clients in Toronto, Canada and the US practically navigate Canada’s advertising and marketing laws and offers Canadian advertising/marketing law services in relation to print, online, new media, social media and e-mail marketing.
My Canadian advertising/marketing law services include advice in relation to: anti-spam legislation (CASL); Competition Bureau complaints; the general misleading advertising provisions of the federal Competition Act; Internet, new media and social media advertising and marketing; promotional contests (sweepstakes); and sales and promotions. I also provide advice relating to specific types of advertising issues, including performance claims, testimonials, disclaimers, drip pricing, astroturfing and native advertising.
For more information about my services, see: services
To contact me about a potential legal matter, see: contact
For more regulatory law updates follow me on Twitter: @CanadaAttorney
