[co-author: Jennifer Kutsunai, 2014 Summer Associate]

Canada’s Anti-Spam Legislation (CASL), considered the most restrictive in the world, became effective on July 1, 2014. The law, which applies to American businesses, requires businesses to obtain consent before sending commercial electronic messages to Canada and requires that businesses provide certain identification information and give recipients the ability to unsubscribe from future messages.

Unlike the “opt-out” approach taken by the US CAN-SPAM Act, CASL requires that recipients “opt-in” to receiving commercial electronic messages. This means that American businesses will need to obtain consent before sending commercial electronic messages to recipients in Canada. Similar provisions requiring consent to install computer programs will take effect on January 15, 2015.

Think CASL Doesn’t Apply to You? Think Again.

CASL extends its reach beyond Canada’s borders to businesses and nonprofit organizations operating outside Canada. Any commercial message sent or accessed by a computer server in Canada must meet the requirements set by CASL. For example, American businesses sending promotional e-mails to customers in Canada must comply with CASL. Penalties for failure to comply with the legislation include financial penalties of up to $10 million CAD per violation and director and officer liability for failing to comply with CASL.

Besides its geographical reach, CASL applies broadly to electronic messages not traditionally seen as spam. CASL defines “commercial electronic messages” to encompass any electronic message that promotes or offers to sell a product, good or service. This applies whether or not the organization operates for profit, so even nonprofit organizations sending promotional e-mails may be seen as sending commercial electronic messages. Other than e-mails, new forms of electronic messages, including SMS text messages and messages sent through social media sites, including Facebook and LinkedIn, also must comply with CASL. To determine whether an electronic message is a “commercial electronic message,” some of the factors that need to be considered include the content of the message, the hyperlinks in the message to content on a Web site, and the contact information contained in the message.

CASL contains some exemptions from the consent requirements. These include: commercial electronic messages sent in response to a request, inquiry or complaint; commercial electronic messages where the sender and recipient have a “family” or “personal” relationship (these terms have a specific meaning in CASL); commercial electronic messages sent internally within an organization, or between organizations that have an ongoing relationship, where the message concerns the activities of the organization; and commercial electronic messages that the sender reasonably believes will be accessed in a foreign country identified in the CASL regulations and that comply with that foreign country’s anti-spam legislation.

Three Requirements of CASL

Commencing July 1, 2014, commercial electronic messages sent or received in Canada must meet the following requirements:

• Consent. Organizations must obtain consent before sending commercial electronic messages to a recipient in Canada.
• Identification. Commercial electronic messages must identify the sender and must contain the sender’s mailing address and contact information.
• Unsubscribe. Commercial electronic messages must have a mechanism that allows recipients to readily unsubscribe from future messages.

How Do You Get Consent?

CASL allows for either implied or express consent, and the Canadian Radio-Television and Telecommunications Commission (CRTC) has issued non-binding guidelines on how to obtain consent, as follows:

Express Consent

Businesses can obtain express consent orally or in writing. Express consent received before CASL went into effect will still be valid after CASL went into effect on July 1, 2014. People can also give consent electronically through opt-in mechanisms. For example, CRTC guidelines state a Web page where a person types in an e-mail address or checks a box to indicate consent to receive messages would be acceptable.

Implied Consent

If the sender and recipient have an existing business or non-business relationship, consent will be implied, and express consent will not be required. For example, if a recipient previously purchased a product, good, or service from the sender, then there is an existing business relationship.

However, implied consent only lasts for three years, meaning businesses will also need to obtain express consent for those recipients by July 1, 2017. Additionally, the activity that forms the basis of the relationship (for example, the sale of the products) must have occurred within the two years immediately preceding the commercial electronic message sent.

Whether consent is express or implied, businesses have the burden of proving consent. American businesses should keep records of when a recipient consents and unsubscribe requests.

Pepper Point

American businesses and nonprofit organizations that send commercial electronic messages to Canadian residents would be advised, where necessary, to commence seeking consent for sending such messages and to maintain records of whether they have received the requisite consent before sending commercial electronic messages. This may require a reorganization of the client records management by location and type of consent (existing relationship or explicit consent). Businesses also should ensure any future commercial electronic messages contain the necessary identification information and unsubscribe mechanisms required by CASL.