CASL in practice: consent, identification and unsubscribe

What you will be able to do

• Decide whether a message is a commercial electronic message and which CASL requirements apply
• Sort your contacts by type of consent and the date it expires
• Write compliant consent wording, an identification footer and an unsubscribe process

Canada’s Anti-Spam Legislation, known as CASL, has a reputation for being complicated. For a small event business, it comes down to three habits: have permission before you send a commercial message, say clearly who you are, and make it easy to stop hearing from you. Build those habits into your forms and templates once, and compliance becomes routine.

Read the transcript

CASL in practice: consent, identification and unsubscribe.

Canada's Anti-Spam Legislation, known as CASL, has a reputation for being complicated.

For a small event business, it comes down to three habits: have permission before you send a commercial message, say clearly who you are, and make it easy to stop hearing from you.

Is it a commercial message?.

CASL applies to commercial electronic messages, or CEMs: emails, texts and some direct messages.

The CRTC's test is simple.

Express and implied consent.

CASL recognizes two kinds of consent, and the difference is time.

Implied consent is useful but temporary.

Asking for express consent.

Ask in plain language, separately from anything else the person must agree to.

A box the person ticks themselves, beside a clear sentence, gives you the cleanest record.

What every commercial message must contain.

Every CEM you send under consent must identify you and offer a way to unsubscribe.

Put both in a standard footer and never send without it.

Keep records that prove it.

If anyone questions your messages, the onus is on the sender to prove consent.

The CRTC suggests keeping evidence of express and implied consent, such as signed forms, completed electronic forms and audio recordings, and documenting how consent was collected.

That is the lesson. The worksheet and the quiz are just below this video.

Is it a commercial message?

CASL applies to commercial electronic messages, or CEMs: emails, texts and some direct messages. The CRTC’s test is simple. Is one of the purposes of the message to encourage the recipient to take part in a commercial activity? If the message offers to sell, buy or lease a service or product, or promotes a business opportunity, it is a CEM. A message does not become a CEM just because your email signature contains your logo, a link or your contact details.

The first row matters more than any other for event businesses. The Electronic Commerce Protection Regulations exempt a message sent in response to a request, inquiry or complaint, or otherwise solicited by the recipient. Answering the person who asked is not spam. What follows the conversation, once it ends, is where consent becomes the question.

Express and implied consent

CASL recognizes two kinds of consent, and the difference is time.

Implied consent is useful but temporary. Your goal is to turn it into express consent before it runs out. Every inquiry gives you six months to earn a yes; every booking gives you two years.

Asking for express consent

Ask in plain language, separately from anything else the person must agree to. A box the person ticks themselves, beside a clear sentence, gives you the cleanest record. Copy this wording for your inquiry form and adapt it.

Consent wording. “Yes, Lantern & Lane may email me planning tips, seasonal availability and offers. I can unsubscribe at any time. Lantern & Lane, [mailing address], hello@[domain].”

Do not bundle the marketing consent with the terms of a quote or contract. A client should be able to book you and say no to your newsletter.

What every commercial message must contain

Every CEM you send under consent must identify you and offer a way to unsubscribe. Put both in a standard footer and never send without it. Here is a template.

Footer template. “You are receiving this because you inquired about or booked an event with Lantern & Lane, or signed up on our website. Lantern & Lane, [street address or P.O. Box], Toronto, ON [postal code]. hello@[domain] | [phone] | [website]. Unsubscribe from these emails: [link].”

• Identification. Your business name, and the name of anyone you are sending on behalf of; a current mailing address; and a phone number, email address or website.
• Valid for 60 days. The contact information and the unsubscribe link must keep working for at least 60 days after you send.
• Easy unsubscribe. It must be readily performed and free. Asking people to log in to an account first is described as non-compliant. For texts, replying STOP is an acceptable example.
• Fast processing. Act on an unsubscribe without delay, and no later than 10 business days after you receive it.

Keep records that prove it

If anyone questions your messages, the onus is on the sender to prove consent. The CRTC suggests keeping evidence of express and implied consent, such as signed forms, completed electronic forms and audio recordings, and documenting how consent was collected. In practice, store four facts for every contact: the type of consent, the date, the source and the wording they saw. Most email platforms record sign-up dates and forms automatically. Add a CRM field for consent given by phone or in person.

Worked example: Lantern & Lane’s contact audit

Marco exports 1,150 contacts and sorts them into consent buckets.

• 390 gave express consent through the website or the inquiry form. They stay on the newsletter.
• 280 booked within the last two years but never gave express consent. They are under implied consent. Marco sends each a personal note asking whether they would like the newsletter, and sets a reminder for two years after each event date.
• 120 inquired within the last six months without booking. Implied consent runs out six months from each inquiry, so they get one invitation to subscribe, timed well before that date.
• 210 inquired or booked more than two years ago, with no express consent. Marco does not email them commercially.
• 150 are partners and corporate contacts. He checks each against the business-to-business rules in the next section and leaves out anyone he cannot place.

The result: 390 contacts he can email freely now, 400 he can invite to subscribe, and 360 he sets aside. A smaller list sent with confidence beats a larger one that puts the business at risk. The figures are an example.

In Canada and the GTA

Who enforces CASL. The private right of action that would have let individuals sue under CASL was repealed before it came into force, so enforcement is by regulators. That does not make compliance optional. The maximum administrative monetary penalty per violation is $1,000,000 for an individual and $10,000,000 for any other person, such as a business. The CRTC’s CASL frequently asked questions page is the best plain-language reference.

Business-to-business messages. CASL does not apply to a commercial message sent by an employee, representative, consultant or franchisee of one organization to their counterpart at another organization, if the two organizations have a relationship and the message concerns the activities of the receiving organization. When this exemption applies, the consent, identification and unsubscribe requirements do not. The CRTC notes that contact between two individuals alone does not create a relationship. A venue emailing a caterer it has worked with about a new kitchen at the venue likely fits. A planner cold-emailing a company it has never dealt with does not.

Publicly posted addresses. You can rely on an address published on a company website or a LinkedIn profile only if there is no statement saying the person does not want commercial messages, and your message relates to the person’s business role. The CRTC’s own example: a social media marketing course sent to a marketing officer qualifies; an administrative assistant skills course sent to a chief operating officer does not. A holiday party package sent to the person listed as events and office manager fits the logic. The same package sent to the head of finance does not.

Business cards and wedding shows. A card handed to you at a networking event or wedding show can be a basis for implied consent, unless it says not to contact the person. The CRTC suggests recording it with a follow-up email that mentions the conversation and the date. That email may itself be a CEM, so include identification and an unsubscribe link, and use it to ask for express consent.

Subject lines and sender names. The Competition Act separately makes false or misleading sender information or subject lines in electronic messages reviewable. “Re: your booking” on a newsletter to people who have no booking is the kind of subject line to avoid.

Platform rules on top of the law

Your email platform and the inbox providers your clients use add requirements of their own. Google’s sender guidelines for personal Gmail accounts define a bulk sender as one that sends close to 5,000 messages or more in 24 hours. Bulk senders must authenticate with SPF and DKIM, publish a DMARC record, offer one-click unsubscribe on marketing messages and honour unsubscribes within 48 hours, which is much faster than CASL’s 10 business days, and keep their spam rate low. Most small event businesses send far fewer, but Google says all senders must meet its requirements, and setting up authentication through your email platform is worth doing at any size. See Google’s email sender guidelines.

Texts. CASL applies to text messages too. If space is limited, the identification details can sit on a webpage reached by a clear link in the message, and replying STOP is an acceptable unsubscribe. Text reminders to booked clients about their event are service messages; a text promoting your new winter package is a CEM.

French-language clients. If you send messages to clients in Quebec, consent wording and footers in French are good practice, and Quebec has its own private-sector privacy law. This is general information, not legal advice; check the CRTC’s guidance or a lawyer for your own situation.

Worksheet

Download the worksheet and complete it for your own business, using Lantern & Lane as the model where it helps. Keep it with your marketing plan. It takes about 10 minutes.

Download the worksheet (PDF)