CentriWebCASL compliance means that before you send a marketing email or text to anyone in Canada, you have their consent, the message says clearly who sent it and how to reach you, and it carries an unsubscribe that you act on within 10 business days. Canada’s Anti-Spam Legislation (CASL) took effect in 2014 and applies to commercial electronic messages whatever the size of the sender.
What follows is a summary for business owners, taken from the Government of Canada’s own pages and the text of the Act. It is general information, not legal advice. If Canada is a large part of your market, have a Canadian lawyer check your forms and templates.
What CASL covers
CASL deals with commercial electronic messages: emails, texts and other electronic messages that encourage someone to buy, book or take part in something commercial. Section 6(1) of the Act says you must not send one to an electronic address unless the person has consented, expressly or by implication, and the message meets the content rules in section 6(2).
A few points owners often miss:
- It applies to texts as well as email. The Government of Canada’s guidance on business texting says you need consent for commercial texts and should include your business name in them.
- It applies to small senders. One promotional text to one customer is covered, which matters for professional services firms and clinics as much as for retailers.
- It applies when someone else sends for you. The same texting guidance asks businesses to make sure third parties messaging customers on their behalf follow the same practices.
Consent, the core of CASL compliance
CASL recognises two kinds of consent, and the difference matters because one lasts and the other runs out.
Express consent
According to the Government of Canada’s page on getting consent to send email, express consent means the person has agreed, verbally or in writing, to receive commercial messages from you, and it has no time limit unless they withdraw it. Consent to one type of message, such as a newsletter, covers only that type.
When you ask for express consent, section 10(1) requires the request to set out, clearly and simply, why you are asking and who is asking. In practice that means a sign-up box the person ticks themselves, with wording such as “Send me offers and news from [business name] by email and text. You can unsubscribe at any time.”
Implied consent
Implied consent applies only in the situations the Act lists. The common one is an existing business relationship. Under section 10(10):
- a purchase or lease counts for two years before the day the message is sent
- an inquiry counts for six months before the day the message is sent
So a customer who bought from you 18 months ago can still receive marketing on implied consent, but someone who asked a question eight months ago and never bought cannot. The consent page also describes implied consent where a person has conspicuously published their address, without saying they do not want messages, and your message relates to their business role.
Because implied consent expires, the safer habit is to ask for express consent whenever you collect an email address or mobile number. Once someone has said yes, the two-year and six-month clocks stop mattering.
What every commercial message must contain
Consent is only half of it. The Government of Canada’s consent page lists what each commercial message has to include:
- your business name, and the name of anyone you are sending on behalf of
- a current mailing address, plus a phone number, email address or website
- contact details that stay valid for at least 60 days after you send
- an unsubscribe mechanism that is clear and easy to use
- nothing false or misleading anywhere in the message
A text is short, which makes the mailing address awkward. Many businesses put the business name and a short link in the text, and keep the full contact details on the linked page. Check with your adviser that your format meets the identification rules for the way you send.
Unsubscribe rules under CASL
The unsubscribe is where most complaints start, so it is worth building properly. From the Act and the consent page:
- The unsubscribe address or web page must stay valid for at least 60 days after the message is sent (section 11(2)).
- You must act on an unsubscribe without delay, and no later than 10 business days after it is sent (section 11(3)).
- Unsubscribing must cost the person nothing.
For texts, the Government’s texting guidance makes a point worth repeating: offering a “STOP” reply is not enough on its own. When someone uses it, their wishes have to be respected. If your SMS tool records the STOP but your CRM keeps the person in an email campaign, you have a problem.
Set up one opt-out list that every campaign tool reads from, and test it by unsubscribing yourself from each channel.
Messages that do not need consent
Not everything a business sends is caught by the consent rule. The Act has two sets of exceptions.
Section 6(5) takes some messages out of section 6 entirely, including messages between people with a personal or family relationship, and a message to a business that consists solely of an inquiry or application related to that business’s activity.
Section 6(6) removes the need for consent, but not the identification and unsubscribe rules, where the message solely:
- provides a quote or estimate the person asked for
- facilitates, completes or confirms a transaction they agreed to
- gives warranty, recall, safety or security information about something they bought or use
- gives factual information about their ongoing subscription, membership, account or loan
- relates to their employment or a benefit plan they are in
- delivers a product or service, including updates, they are entitled to
The word “solely” carries the weight. A booking confirmation is fine. A booking confirmation that adds “and 20% off your next visit” is a commercial message and needs consent. Keep service messages and promotions in separate templates.
Keeping proof of consent
Under section 13, a person who says they had consent has the onus of proving it. In other words, if a complaint arrives, it is up to you to show the consent, not up to the customer to show they never gave it. The consent page also asks you to keep complete records of implied consent and respect its time limits.
For each contact, record:
- the date and time consent was given
- how it was given (web form, in person, text reply)
- the exact wording they agreed to, or the form version
- which channels they agreed to
- for implied consent, the purchase or inquiry date, so the system knows when it expires
- any unsubscribe, with its date
A CRM can do most of this automatically if it is set up to. CentriWeb sets up CRM systems that store consent with each contact and filter every campaign by it, so nobody has to remember.
Penalties and who enforces CASL
The Government’s page on common business concerns says enforcement is shared by the CRTC (the Canadian Radio-television and Telecommunications Commission), the Competition Bureau and the Office of the Privacy Commissioner of Canada. The same page notes that businesses must also follow PIPEDA, Canada’s federal private-sector privacy law, when they collect and use personal information.
The maximum administrative monetary penalty, under section 20(4) of the Act, is $1,000,000 for an individual and $10,000,000 for any other person, such as a company, for each violation. Those are ceilings, not typical amounts, but they explain why larger senders take CASL seriously.
Sending to Canada from another country
CASL turns on where the recipient is. If you are in the United States, Australia, New Zealand or the United Kingdom and you email or text people in Canada, plan on following CASL for those contacts. The reverse applies too: the Government of Canada’s concerns page reminds Canadian businesses that messages to people in other countries must meet those countries’ anti-spam laws.
If you market in several countries, the simplest approach is to build to the strictest common standard: express consent recorded with each contact, full identification in every message, and an unsubscribe that works across every channel within a few days. Our guides to SMS marketing laws in the United States and email and text rules in New Zealand cover the differences, and the rest of our marketing guides cover campaigns themselves.
A CASL compliance checklist
- Add an unticked consent box to every form that collects an email or mobile number, naming your business and the channels.
- Record the date, method and wording of each consent in your CRM.
- For contacts on implied consent, store the purchase or inquiry date and stop marketing when two years or six months have passed, unless they give express consent.
- Put your business name, contact details and an unsubscribe in every commercial message.
- Process unsubscribes across every tool well inside 10 business days.
- Keep service messages free of promotions.
- Check that anyone sending for you follows the same rules.
The Act itself and the Government of Canada’s CASL pages are the place to confirm any of this for your situation.