UPDATE: This post was originally published in 2012 and has been updated for 2017.
If you send emails to Canada, you should already be familiar with Canada’s Anti-Spam Legislation (CASL) that went into effect in 2014. What you may not realize is that the built-in grace period for businesses is about to end and the full law enforced. With fines of up to $10 million CAD in place for non-compliance, it’s a very costly law to get on the wrong side of.
According to Litmus, more than a quarter of email marketers say that CASL has had a dramatic or significant impact on their email program. And there are a few more changes yet to come.
Now is a good time for a refresher on what CASL currently covers and the parts of the law that are about to change.
CASL as of July 2014
CASL has been in effect for a few years now. Here’s a run-down of what your emails should already contain to be in compliance:
- Consent – First, you must ensure you have consent, either express or implied, to send a marketing email to a potential email recipient. The CASL requirements focus on how senders gain permission to email subscribers in the first place, and best practice dictates that the sender should retain some record that proves the sender has received this permission.Express consent means that the potential email recipient has clearly agreed, and indicated such agreement through a proactive action or explicit indication (such as opting in via a sender’s website), to receive marketing emails. Under the law, when obtaining express consent, a sender must state:
◦ The purpose, or purposes for which consent/permission is being sought (e.g., to send marketing messages via email);
◦ Identity of the person seeking consent and, if the person is seeking consent on behalf of another person: 1) the identity of the person on whose behalf consent is sought; 2) that consent is being sought by the seeker on behalf of such other person, and, if applicable, 3) the names by which such other person carries on business;
◦ contact information as prescribed by the statute;
◦ A statement that the person whose consent is sought can withdraw consent by contacting the contact information; and any other prescribed information that may be required.
Implied consent means that the potential email recipient has impliedly agreed to receive marketing emails because of an existing business relationship with the sender (for example the recipient is the sender’s customer). If you’re a Campaign Monitor customer, you’re also required to already have express consent to email your contacts as per our anti-spam policies, in most instances. The exception being paying customers who have purchased services or goods from you, in which case you will need to ensure you confirm with them you have their consent to continue emailing them, as per CASL requirements.
Note that the definition of ‘existing business relationship’ is itself quite nuanced under CASL and you should review it carefully before assuming that a relationship qualifies as an ‘existing business relationship’ for the purpose of implied consent. A solid record-keeping mechanism will be especially important for senders relying on implied consent as a basis for sending marketing emails.
The Canadian government has created this handy infographic to help understand how consent works with CASL.
- Identification – The second major requirement is that marketing email campaigns include information that personally identifies the sender. This information must be correct for at least 60 days after the message is sent. Contact information should include a name or company name, postal address, an email address or phone number that you can be contacted on. Also, the ‘From’ address on your email should be real and regularly monitored.
- Unsubscribe – Your marketing emails are required to have an easy-to-find unsubscribe link that is active for 60 days after the email has been sent. Also, all unsubscribe requests must be fulfilled no longer than ten business days after the request, with no further action on the part of the email recipient or cost to the recipient.
- Content – In addition to the prescribed contents set out above, the content of each marketing email, including the subject line, sender information, any URLs, any metadata must true, accurate, and not misleading.
CASL Changes as of July 2017
With the expiration of the transitional period for businesses to make sure their subscriber lists are CASL compliant, companies will now have to ensure that any individuals on their subscriber lists who impliedly consented to receive marketing emails are removed upon expiration of their two-year implied consent validity period. If someone has made a purchase, for example, and you are relying on implied consent to send them marketing emails, then you can email them only for two years after the purchase date. If they haven’t given you express consent by then, they must be removed from the list. Express consent is valid until the email recipient requests to unsubscribe or revokes consent in some way.
There’s one more piece of the law that was set to go into effect on the same date, called Private Right of Action. This would have allowed people to sue senders if they break the CASL laws. As of June 2, 2017, this portion of the law has been temporarily suspended and likely won’t be implemented any time soon– but make sure to visit the Government of Canada’s site on the topic to stay on top of current developments on CASL.
This Canadian law may have been dubbed ‘the toughest anti-spam law the world has ever seen,’ but in reality, it’s fairly easy for legitimate senders to comply with. Many major email service providers, including Campaign Monitor, have sending policies that typically meet or exceed CASL requirements.
It’s worth taking the opportunity to review your subscribe forms and other channels by which you allow subscribers to opt-in to your lists, to make sure they follow CASL’s requirements.
For more information, check out the Government of Canada Justice Laws website.