Marketing law in Canada: CASL, the Competition Act and privacy

Three federal laws touch almost everything an event business does to market itself: CASL for emails and texts, the Competition Act for claims, prices and reviews, and PIPEDA for client data. Learn what each one requires in plain language and build a one-page compliance checklist.

Read the transcript

Marketing law in Canada: CASL, the Competition Act and privacy.

Every email you send, every price you publish and every inquiry sitting in your inbox is regulated.

That sounds heavy for a two-person studio or a solo DJ, but the rules are not designed to stop you marketing.

Three laws, three questions.

Canadian marketing law for a small service business comes down to three federal frameworks.

Each one answers a different question about what you are doing.

CASL: consent, identification, unsubscribe.

CASL applies to commercial electronic messages.

The CRTC's test is simple: is one of the purposes of the message to encourage the recipient to take part in a commercial activity?

The Competition Act: true claims and real prices.

The Competition Act makes it reviewable conduct to make a representation to the public that is false or misleading in a material respect.

Courts and the Bureau look at the general impression, so a technically accurate sentence can still mislead.

Worked example: one email, checked line by line.

Marco at Lantern and Lane met 40 couples at a fall wedding show.

Twenty-six signed the studio's tablet form and ticked “Send me planning tips and open dates”.

pipeda: the inbox is a database.

pipeda applies to private-sector organizations that collect, use or disclose personal information in the course of commercial activity.

Personal information is any information about an identifiable individual, in any form.

That is the lesson. The worksheet and the quiz are just below this video.

What you will be able to do

• Identify which of your everyday marketing activities fall under CASL, the Competition Act and PIPEDA
• Apply the CASL tests for consent, identification and unsubscribe to a real follow-up email
• Check your published prices, reviews and claims against the Competition Act's rules on misleading representations and drip pricing

Every email you send, every price you publish and every inquiry sitting in your inbox is regulated. That sounds heavy for a two-person studio or a solo DJ, but the rules are not designed to stop you marketing. They are designed to stop you lying, pestering or being careless with people’s information. Market honestly, ask before you email and look after your client list, and you are most of the way there.

Three laws, three questions

Canadian marketing law for a small service business comes down to three federal frameworks. Each one answers a different question about what you are doing.

None of these laws cares how small you are. They apply to a sole proprietor exactly as they apply to a hotel chain.

CASL: consent, identification, unsubscribe

CASL applies to commercial electronic messages. The CRTC’s test is simple: is one of the purposes of the message to encourage the recipient to take part in a commercial activity? An email offering your holiday party packages is commercial. So is a text announcing open dates for next June.

Every commercial message needs three things.

1. Consent. Express consent means the person agreed, verbally or in writing, to receive your messages. It does not expire unless they withdraw it. Implied consent exists only in specific situations and is usually time-limited. The two you will use most: someone who bought from you in the last two years, and someone who made an inquiry in the last six months.
2. Identification. Your business name, a current mailing address, and a phone number, email address or website. A P.O. Box can serve as the mailing address. The contact details must stay valid for at least 60 days after you send.
3. An unsubscribe mechanism. It must be free, simple and quick. Forcing someone to log in to an account to unsubscribe does not qualify. You must act on an unsubscribe request without delay, and no later than 10 business days after you receive it.

The six-month inquiry window matters more than most vendors realize. A couple who asked about your rates in January and never booked is a fair contact through June. After that, unless they gave you express consent, your seasonal promotion becomes spam. The fix is to ask for express consent at the moment of inquiry, with an unticked checkbox on your form that says exactly what they will receive.

The Competition Act: true claims and real prices

The Competition Act makes it reviewable conduct to make a representation to the public that is false or misleading in a material respect. Courts and the Bureau look at the general impression, so a technically accurate sentence can still mislead. Four areas matter most for event businesses.

• Drip pricing. Since the 2022 amendments, advertising a price that cannot actually be paid because of fixed mandatory fees is treated as misleading. If every booking carries a $150 travel fee or a 15 percent service charge, that fee belongs inside the price you advertise. Only charges imposed by law, such as HST, may be added on top.
• Regular price and sale claims. If you say “regularly $2,400, now $1,900”, you need to have sold a substantial volume at $2,400 or offered it in good faith at that price for a substantial period.
• Reviews and endorsements. Anyone who writes or permits reviews that give a false or misleading impression could be liable. Employees reviewing their own employer must disclose the connection. Paying for reviews, or posting your friends’ glowing reviews without disclosing the relationship, is a problem even if every word is honest.
• Performance and environmental claims. Claims about how something performs must rest on an adequate and proper test. Claims that your rentals or your catering are better for the environment must be backed by adequate and proper substantiation, and you carry the burden of proving them.

Worked example: one email, checked line by line

Marco at Lantern & Lane met 40 couples at a fall wedding show. Twenty-six signed the studio’s tablet form and ticked “Send me planning tips and open dates”. Eleven handed over business cards or wrote an email address on a paper sheet. Three asked for a quote at the booth. Here is how he sorted them.

• 26 with ticked consent: express consent. They can receive the newsletter until they unsubscribe.
• 3 who asked for a quote: an inquiry, so implied consent for six months from the show date. Marco sends the quotes, then invites each couple to opt in to the newsletter.
• 11 with only an address: no clear consent to marketing. Marco sends one personal note recalling the conversation and the date, which itself includes identification and an unsubscribe link, and asks whether they would like to hear from the studio. Only those who say yes go on the list.

His follow-up email to the 26 opened with “Your June dates are filling”. Priya checked it against a short list before it went out:

• Does the subject line match the content? Yes, two June Saturdays remain.
• Is the advertised day-of package price the price a couple actually pays, apart from HST? Yes, $1,900 plus HST, no admin fee.
• Does the footer show the business name, mailing address and website?
• Does the unsubscribe link work in one click, and will it still work in 60 days?
• Does the testimonial quote a real client, with permission, in words they actually wrote?

PIPEDA: the inbox is a database

PIPEDA applies to private-sector organizations that collect, use or disclose personal information in the course of commercial activity. Personal information is any information about an identifiable individual, in any form. An inquiry with a name, a date, a budget and a cultural detail about the ceremony is personal information. So is a photo where a guest can be recognized.

PIPEDA rests on ten fair information principles. For marketing, four do most of the work: identify why you are collecting information, get meaningful consent, collect only what you need, and protect what you keep. In practice, say on your form what you will do with the details, keep your CRM behind a strong password, and delete stale inquiries on a schedule. Sharing a client’s details with another vendor for their own marketing is outside what most clients would expect, so it needs their express consent.

A compliance checklist you can copy

• Every form that collects an email has an unticked consent box describing what people will receive.
• Each contact in your list has a recorded consent type and date: express, purchase (two years) or inquiry (six months).
• Every marketing email and text identifies you and includes a working unsubscribe.
• Unsubscribes are processed within 10 business days, ideally the same day.
• Advertised prices include every mandatory fee. Only HST is added.
• Any “regular price” claim is backed by your sales records.
• No paid, incentivized or undisclosed employee or family reviews.
• Your privacy policy names a contact person and says how people can see or correct their information.
• Client data has a retention period and a password.

In Canada and the GTA

The penalties are real, even if enforcement is rare. Under CASL, the maximum administrative monetary penalty per violation is $1,000,000 for an individual and $10,000,000 for a business. Under the Competition Act’s civil deceptive marketing provisions, the maximum for an individual is the greater of $750,000 (or $1,000,000 for a subsequent order) and three times the value of the benefit derived. For a corporation it is the greater of $10,000,000 (or $15,000,000 for a subsequent order) and three times the benefit, or 3 percent of annual worldwide gross revenues if the benefit cannot be reasonably determined. Knowingly or recklessly making a false or misleading representation is also a criminal offence. Small businesses rarely see the maximums, but these numbers explain why corporate clients and their procurement teams ask vendors about compliance.

Nobody can sue you under CASL directly. The private right of action in sections 47 to 51 was repealed before it came into force, so enforcement is by regulators. That is no reason to relax: regulators act on complaints, and one irritated corporate recipient is all it takes.

The business-to-business exemption is narrower than it sounds. CASL does not apply to a message sent by an employee or representative of one organization to their counterpart at another organization, if the organizations have a relationship and the message concerns the receiving organization’s activities. Two people swapping cards at a networking breakfast is not, by itself, a relationship between their organizations. A DJ cold-emailing every office manager in a Mississauga business park is not covered. Where you rely on a publicly posted address instead, CASL’s conspicuous publication rule says the posting must not say the person does not want messages, and your message must relate to their business role. A corporate event pitch to an events manager whose address is on the company site can qualify. The same pitch to the company’s IT lead would not. The CRTC sets out the details in its CASL FAQ.

Ontario layers on top

Privacy. Ontario has no general private-sector privacy law of its own, so PIPEDA generally applies to businesses here. Only Alberta, British Columbia and Quebec have substantially similar provincial laws. If you take on a client or a corporate event in Quebec, check that province’s rules separately. The OPC’s PIPEDA overview is the place to start. If a breach of your client data creates a real risk of significant harm, you must report it to the OPC and notify the people affected as soon as feasible, and you must keep a record of every breach for 24 months.

Consumer protection. When you sell to individuals, Ontario’s Consumer Protection Act, 2002 applies until the newer 2023 Act is proclaimed in force, so check ontario.ca for the current position. Under the 2002 Act, making a false, misleading or deceptive representation is an unfair practice, and a consumer has one year to withdraw from an agreement because of one. Estimates matter too: you cannot bill a consumer more than 10 percent above an estimated price unless they agree in writing to the extra charges. A quote that says “approximately $3,000” is a marketing promise with legal weight.

Industry codes. Ad Standards administers the Canadian Code of Advertising Standards, an industry self-regulatory code. Its clauses on accuracy, disguised advertising and testimonials line up with the Competition Act, and its Influencer Marketing Disclosure Guidelines treat #ad as the clearest label when a creator receives money, free services or another material connection. If you trade a free photo booth for a creator’s post, both of you share responsibility for the disclosure.

Alcohol. Bars, caterers with liquor licences and anyone holding a Special Occasion Permit face the AGCO’s advertising standards on top of everything above. A private event under a Special Occasion Permit may not be publicly advertised, for example on social media. The food and drink track covers the details.

The Competition Bureau’s guidance on drip pricing is the clearest summary of the price rules. This is general information, not legal advice. Check the official sources named here, or ask a lawyer, for your own situation.

Worksheet

Download the worksheet and complete it for your own business, using Lantern & Lane as the model where it helps. Keep it with your marketing plan. It takes about 12 minutes.

Download the worksheet (PDF)