Will Your Marketing Campaign Be the Target of a Class Action Lawsuit or Regulatory Investigation for Failing to Comply with Canada's Anti-Spam Legislation?

What is Canada's Anti-Spam Legislation ("CASL")?

CASL1 was passed into law on December 15, 2010, and is widely regarded as the strictest anti-spam legislation in the world. The Canadian Radio-Television and Telecommunications Commission, the Canadian Competition Bureau and the Office of the Privacy Commissioner of Canada are all empowered to enforce and issue administrative monetary penalties for violations of CASL.

How is CASL Different than CAN-SPAM?

CASL is far broader and more restrictive in its application than the U.S. Controlling the Assault of Non-Solicited Pornography and Marketing Act of 2003 ("CAN-SPAM").  For instance, while CAN-SPAM regulates the content and form of e-mail messages and establishes an "opt-out" regime, CASL prohibits all commercial electronic messages that are sent without proper consumer consent, including e-mail, text, social media, sound and image messages. Additionally, CASL places restrictions on the use of spyware and malware, which are not addressed by CAN-SPAM.  Most importantly: 1) the monetary penalties that may be levied under CASL are exponentially higher than those of CAN-SPAM; and 2) CASL will allow individuals to file private and class action lawsuits to collect statutory damages.2

What is a Commercial Electronic Message?

CASL defines a "Commercial Electronic Message" or "CEM" as a business-related message sent by any means of telecommunication, including e-mail, text, sound or image messages.

What Entities are Subject to CASL?

Any individual or business entity that sends, or assists in sending, a CEM to a consumer in Canada is subject to CASL.  Moreover, any CEM that is sent from, routed to or accessed from a device in Canada is subject to CASL regulations.3

What are the Exceptions to CASL?

Most business-to-business CEMs and those that are purely informational in nature are not subject to CASL regulations. Additionally, marketing companies and individuals will not be liable under CASL if the CEMs are:

  • not intended to be accessed in or routed through Canada, and conform to the laws of the target country;
  • sent within six (6) months of receiving a consumer's request, inquiry or complaint;
  • sent from a charitable organization or solely consist of political content;
  • sent to consumers with whom the sender has an existing business relationship;
  • sent to consumers with whom the sender has a familial, personal or other non-business relationship;
  • sent on a one-time basis to consumers referred by a person that has an existing relationship with the sender;
  • sent to consumers based on the authorization of a third party that has already secured the consumers' consent; 4 or
  • sent to a person engaged in commercial activities, and solely address issues relating to those activities.

What are the CASL Consent Rules?

CASL permits the sending of CEMs to a consumer if the consumer expressly or implicitly consents to receive the CEMs.5  Every CEM, even those sent with consent, must include a simple, clear and cost-free mechanism that allows consumers to revoke their consent and unsubscribe from the receipt of future CEMs.

1) Express Consent

Express consent may be properly obtained either orally or in writing, provided that the sender clearly discloses the purpose and manner of consent and the consumer affirmatively provides his/her consent. Electronic or digital forms of consent are acceptable forms of consent under CASL (i.e., consent obtained via email, website form, text message, or voice recording).6

If a dispute concerning consent arises, the sender bears the burden of proof to demonstrate that the consumer consented to receive CEMs in the manner provided. Evidence of Internet-provided written consent includes, but is not limited to, website pages that contain consumer consent language and fields, associated screenshot of the consent webpage as seen by the consumer, complete data record submitted by the consumer (with time and date stamp), together with the applicable consumer's computer IP address.  For any type of oral consent, the sender must be able to verify the consent with a complete and unedited recording of the consumer providing consent. It is a best practice for advertisers to maintain a record of each consumer's consent for at least three (3) years, which is the statute of limitations to bring an action under CASL.7

Sample Website

Consent Language

 I hereby consent to receive electronic messages relating to [PURPOSE] that are sent by or on behalf of [ADVERTISER'S AND AFFILIATES' CORPORATE NAME(S)] to the social media profile, e-mail address and/or cell phone number provided above.8

2) Implied Consent

There are three (3) main ways in which consent to receive CEMs is implied under CASL:

  • If there is an existing business or non-business relationship with the sender formed within the last two (2) years;
  • If the consumer publicly publishes his/her electronic address(es) without limiting the right to receive CEMs; or
  • If the consumer discloses his/her electronic address(es) to the sender without limiting the right to receive CEMs.

Sample Unsubscribe Language that Must Appear in all CEMs9

 This electronic message was sent to you by [SENDER FULL NAME] on behalf of [ADVERTISER AND AFFILIATES CORPORATE NAME(S)], located at [ADDRESS]. For more information or to unsubscribe from receiving further communications, please contact us at [WEBSITE, PHONE NUMBER or E-MAIL ADDRESS].10

What are the Penalties for Failing to Comply with CASL?

CASL provides for either actual damages or statutory damages of $200.00 per each violation, up to a maximum of C$1 million/day for individuals and C$10 million/day for corporate entities.  More importantly, corporate officers, directors and agents may be held personally liable if they directed, authorized, acquiesced or participated in the commission of a CASL violation. 11  In determining the final amount of statutory damages to award, courts analyze the personal/corporate history of the violator(s), the financial benefit obtained and the nature and scope of the violation(s).  Considering that marketing campaigns may involve millions of CEMs, potential damages under CASL may escalate very quickly.

Footnotes

1 CASL S.C. 2010, ch. 23.

2 The CASL provision authorizing private rights of action is scheduled to go into effect on July 1, 2017.

3 If the sender presents evidence that it has made a good faith effort to comply with CASL requirements, the sender will not face liability under CASL. See CASL § 33.

4 Must include the name of the referring party to whom the consent was provided and include an unsubscribe mechanism that reaches both the sending and referring parties.

5 CASL Regulations 81000-2-175.

6 It should be noted that after July 1, 2014, any message requesting consent will likely be construed as a CASL violation.  Therefore, any attempt to secure consent via e-mail, text or instant message should be sent to consumers prior to July 1, 2014.

7 CASL § 23(1).

8 The checkbox and the consumer's personal information must not be pre-populated in order to obtain valid consent under CASL.

9 A hyperlink within the CEM containing the requisite language is also acceptable.

10 The contact information provided must be valid for at least  60 days after the message is sent and any unsubscribe request must be honored within 10 business days of receipt.

11 CASL §§ 20, 31, 51.

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.