Canada’s new “anti-spam” law (“CASL”) goes into effect on July 1, 2014. Those of you who use email or text messages to communicate with customers will need to get consent from the people on your mailing list if you want to keep sending them newsletters, updates, and other messages after July 1. If you use a mailing list, you need to sit down, clear your desk, and take the next 15 minutes to read this.
What is it?
CASL is a new federal law that aims to regulate activities (like spam emails) that discourage Canadians from using electronic means to conduct business. For many small businesses, the key element of the new law is a provision requiring companies to obtain consent from customers and contacts before sending out commercial electronic messages, or “CEMs”. A CEM is any form of electronic message, including an email, a text message, or a voice message sent to an electronic address (i.e. email address or mobile number).
Why do I need to worry about this?
If you maintain a mailing list or use email for marketing/promotional communications (i.e. a newsletter or “email blast”), CASL applies to you and your business. After CASL comes into force, you won’t be able to send email newsletters or promotional materials unless you have expressed or implied consent from the people on your mailing list.
Why wasn’t I told about this?
CASL has been in the works for about three years now. However, the final regulations were only published on December 4, 2013. There has been surprisingly little media coverage about the new law, despite the significant impact CASL will have on many Canadian businesses.
Is there a deadline?
Yes! There are three key deadlines:
July 1, 2014: This is when most of CASL comes into force. After July 1, an email requesting consent will be seen as a CEM, and might put you offside the new anti-spam law.
January 1, 2015: This is when section 8 (dealing with installation of computer programs) goes into effect. I’m not going to discuss this below – it is a provision that is intended to prevent the installation of spyware or malware, and will be important for software companies that install their products by “piggy-backing” on other software downloads.
July 1, 2017: This is when CASL will allow private parties to bring a civil action for non-compliance with the law.
What do I need to do?
Unless you are prepared to stop sending emails to your mailing list (or start afresh with a completely new list), you need to develop a strategy to ensure that future mailings comply with the requirements of CASL. For most businesses, this will mean that you need to:
(a) Determine how many people on your list have given you “expressed consent” in a manner consistent with CASL – i.e. they have clearly told you that they want to receive email from you;
(b) Determine how many people on your list have given you “implied consent”. For most businesses, this is a key step, so I’ll discuss this concept in more detail below.
(c) Obtain expressed consent from the people for whom you only have implied consent (more on this below as well);
(d) ensure that all future communications meet the “unsubscribe” requirements set out in the new law; and
(e) re-design your forms and customer-facing materials (online, paper, and telephone) so that you can obtain expressed consent from all future customers and contacts.
Leveraging your implied consents
CASL allows consent to be implied in certain circumstances, such as where there is an “existing business relationship”. That term is defined in the new law – so it may not include everything you want it to include (or think it should include).
Here’s what you need to know right now about implied consent:
- If you have been emailing your contacts before July 1, 2014, then you probably have an “existing business relationship” with them for the purposes of CASL. That’s important because it allows you take advantage of the three-year transition period – which means you can keep communicating with those contacts until July 1, 2017 (unless they tell you they want to unsubscribe).
- Three years is a long time in the digital marketing world, and this new law might change over the next three years – so it will be important to make the most of your implied consents during the transitional period.
- “existing business relationship” is defined in s. 10(10) of CASL, and includes the purchase or lease of products within the two-year period before the date on which the message was sent. So if there are customers who have used your products or services over the last two years, but who are not currently on your mailing list, you might want to send them an email with some useful information about your business (or at least one of your recent newsletters) before July 1, 2014. Doing that would then bring them into the category of having an existing business relationship with you.
- If your contacts have conspicuously published their email addresses or specifically given you their email addresses and there is no statement accompanying the publication that says that they don’t want to receive unsolicited messages, and the message you are sending is relevant to their business, their role, or their duties, then consent can be implied. What this means is that there may be a segment of your mailing list for whom consent can be implied at any time – even beyond the three-year transition period.
Vote Yes: Getting expressed consent from your customers and contacts
In theory, getting expressed consent from your customers and contacts is easy – you send them an email, get them to click on a link that says “Yes I want to receive email from you”, and then track the date and time that they click on the link (along with their IP address and any other information that your mailing program allows you to track). Simple, right?
In reality, most people who receive newsletters or promotional materials by email don’t click on links in the newsletters. It’s going to be even harder to convince them to click on a link where you’re asking them to consent to getting more email from you. Even if they like your newsletters, they might take it as an opportunity to reduce the size of their inbox – even by one email a month. Unfortunately, CASL forces you to do just that.
I can see that they opened the email. Isn’t that good enough?
Just opening the email is not enough. Nor is a link that takes them to your website. In order to comply with CASL, your customers and contacts need to click on a link that says something like this: “Click the button below to consent to receiving electronic messages from us in the future.” You can use a check-box, but it can’t be checked in advance. The same email would also have a line underneath the button that says “You may unsubscribe or withdraw consent at any time by clicking this link”, and a clear unsubscribe link.
Do I need to conduct a separate campaign?
No – you don’t need to conduct a separate email campaign to obtain consent. While you could start an email campaign aimed at getting expressed consents, there is no requirement for consent to be given in isolation. From a marketing perspective, you might want to embed the request for consent into one of your typical email campaigns or monthly newsletters. That way, the value of the email (i.e. the great stuff in your newsletter) is communicated at the same time as the request for consent. What works for some businesses might not work for others – so this is something you need to sit down and think about.
You won’t get everyone’s consent – and the value of your mailing list may take a serious hit. It may take a long time (and a lot of effort) for you to rebuild your mailing list with new customers and contacts. This is a complaint that the government knows about – which is yet another reason to focus on those implied consents, at least for the next three years. At some point, the government may recognize that CASL does more harm than good for Canadian businesses, and that might result in a change to the legislation.
But the dark cloud of federal regulation may have a silver lining if you’re willing to roll with the punches – with more companies using social media platforms like Twitter and Instagram, rebuilding your mailing list might let you develop a more engaged customer/user base – people who love your products and services and are willing to say so on Twitter, Instagram, Yelp, and Trip Advisor.
Are there exceptions?
Yes. Certain kinds of electronic communications (a request for information, and the response to that request, for example) are exempt from the CASL rules – but in some cases, the messages must still contain the required “unsubscribe” requirements. There are other exemptions for quotes, warranty information, factual information about a previous purchased product or service , membership or account information, and employment information. CASL also has some specific exceptions for registered charities, communications about donations, and communications with volunteer workers.
Keep detailed records
Lawyers (like me) are always asking people to write things down when dealing with legal issues – on paper, in an email, on your iphone, whatever. This situation is no different. When you are taking steps to comply with CASL, keep a detailed record of what you are doing to identify contacts who have given you expressed consent, contacts who have given you implied consent, and what you have done to obtain expressed consent. If you are contacted by the CRTC about a potential CASL violation, it will help to have clear notes and records about what you did, and when you did it.
This sounds like a lot of work. I think I’ll just ignore it and keep doing what I’m currently doing.
They say the law has long arms. I would say CASL’s arms are more like vines. CASL contains a set of “Administrative Monetary Penalties” that can be as high as $1 million for individuals, and up to $10 million for businesses – so failure to comply could have serious consequences for you and your business. In addition, starting in July 2017, CASL will allow a recipient of “spam” to commence a lawsuit against the spammer. You don’t want to be “that guy”.
Where can I learn more?
As we get closer to July 1, there are more “survival guides” popping up on the web. Your mailing program or provider (MailChimp, Constant Contact, Elite Email) might have something that is tailored to the service they provide.
If you are in the digital marketing business, speak to your colleagues – they may have developed strategies that they are willing to share. In return, you might have some great ideas (or a particularly informative blog post) that you are willing to share.
The full text of the new law is available at fightspam.gc.ca.
Finally, it is important to recognize that every business is different. The information above might not apply to your business or your particular situation. If you have questions, you should obtain legal advice that is specific to your circumstances.
