Are you ready for the Canadian Anti-Spam Law’s consent requirements?
With CASL (Canadian Anti-Spam Law) coming into action in less than a week, here are some questions you need to ask yourself about consent to send messages.
CASL is instated starting 1st of July 2014. Are you ready?
My colleague Elsa wrote a previous post on the basic principles of CASL and what it does. I decided to explore some of the details behind the first requirement of the law: consent. Just be aware that this post is meant to inform you, not provide legal advice.
What are the requirements of CASL?
As the homepage simply put it: ‘If you are sending a Commercial Electronic Message to an electronic address, then you need to comply with three requirements. You need to: (1) obtain consent, (2) provide identification information, and (3) provide an unsubscribe mechanism’.
Why should you care?
If your business, whether profit or non-profit, has any receivers in Canada, you should make sure you comply with CASL or risk paying a $10 million fine. This law covers not just emails under the term ‘Commercial Electronic Messages’, but also:
- Social media message
- Instant messages
What are the exceptions?
If you’re a registered charity, political candidate or telecoms provider, you may qualify for an exception under certain rules. It also doesn’t apply if you send messages to someone you have a personal or family relationship with. This needs to be from an individual to an individual, not a business to another individual, which gets a bit complicated on social media. A ‘Friend’ or ‘Follow’ is not sufficient consent to mean a personal relationship.
What type of consent do I need? Implied vs express consent
If you have a business or non-business relationship with the contact, then consent can be implied for up to 3 years. After the 3 years period or if that contact decides to unsubscribe from your messages during the this time, you are no longer allowed to send them emails unless you obtain express consent.
Express consent, on the other hand, doesn’t come with an expiration date but similarly, it will stop if they unsubscribe. This means you will need to get their consent again if you want to keep sending them messages.
How do I know if I have consent?
You can obtain consent orally or in writing but you must remember it is up to you to prove the consent has been given. Keep in mind you need to prove how, when and why it was obtained. You cannot presume consent is given by not taking an action, i.e. pre-checked boxes won’t work. Don’t make the same mistake as John Lewis.
If a contact gives consent to my messages, do my partners automatically get consent as well?
It depends. If certain conditions are met, you can refer a partner to that contact. The third party can only send one message to them and they must have a clear identification and unsubscribe mechanism.
If your partner is not referred by you, they can still send a message to the contact but you must provide an opportunity for the contact to withdraw consent from all future third party messages.
Do business cards count as consent?
It depends. Business cards can be used as a premise for implied consent if:
- the message you send refers to the contact’s role or duty in their business
- the contact hasn’t specified that he/she doesn’t want promotional messages when he/she handed you the card.
What if I’m sending an SMS and I don’t have enough characters to include everything I need?
If it’s impractical for technical reasons to include information like the referral details, then CASL allows you to include a link to the webpage containing the information. This link must be clear and stand out in your message.
CASL has a lot of details that you need to consider but it’s better to be safe than sorry. For anyone interested, you can find the full text of the law here.