Canada’s Anti-Spam Legislation (CASL, formerly Bill C-28) came into force on July 1, 2014. Its goal is to prohibit unsolicited commercial electronic messages. To help you better understand the law and find out how to bring your business into compliance, here are the 10 questions we’re asked most often, with our answers.
Frequently asked questions
- How does this law change the way I communicate?
- What’s the difference between express consent and implied consent?
- Can we send an express consent request to people for whom we already have implied consent?
- What about subscribers who have been receiving my newsletters for a long time without proof of consent? Should we stop emailing them?
- Can express consent be verbal?
- What information must a paper consent request include to be valid as express consent?
- Do I need to keep proof of my consents?
- Apart from member consent, what are the other main requirements of Bill C-28?
- Is buying email lists allowed?
- What should I do to prepare for Bill C-28?
- In conclusion
How does this law change the way I communicate?
Bill C-28 governs every type of electronic message of a commercial nature sent to an electronic address, whether it’s an email, a text message or a social media message. The law defines a commercial message as any electronic message from which it would be reasonable to conclude that its purpose is to promote a product, a person, a service or a business opportunity, whether or not there is an expectation of profit. For example: an offer to purchase, the sale or rental of a product, service or land, or a business or investment opportunity.
From now on, you must have the express or implied consent of the person to whom you send a commercial message. If you don’t, you’re breaking the law, and the remedies and penalties can be very costly.
Many people think they’ll no longer be able to promote by email. That’s not the case at all; quite the opposite. You’ll still be able to do email marketing, and it will remain the most cost-effective and efficient way to promote your products and services. The law simply encourages good practices and penalizes those who clog up inboxes.
What’s the difference between express consent and implied consent?
When a person has given you consent to receive your communications (e.g. by subscribing to your newsletter on your website), that’s express consent.
When you can show that you have a business relationship with a person who hasn’t given you consent to receive your communications, that’s implied consent. Here are the cases of implied consent accepted under the law.
For email addresses that are publicly posted without a statement that the person doesn’t want to receive commercial messages (e.g. a chamber of commerce list or an association directory), print the web page so you have tangible proof. However, your message must relate to the person’s business or role.
When the implied consent period ends, you must stop communicating with that person unless you’ve obtained electronic, verbal or written express consent before the deadline.
Can we send an express consent request to people for whom we already have implied consent?
Yes.
It’s the best practice to adopt. Normally, a business has 2 years from a customer’s purchase or rental of a good or service to send them commercial emails. With the law coming into force, however, there is a transitional provision that allows up to 3 years.
For an inquiry or a quote request, the period is 6 months instead. So take advantage of that window to send them an express consent request.
What about subscribers who have been receiving my newsletters for a long time without proof of consent? Should we stop emailing them?
No, not necessarily.
When the law comes into force, you’ll need to check whether the recipient qualifies for an implied consent exception. If so, make sure you obtain their express consent before the implied consent period expires. If you don’t have this information readily available (e.g. the date of the inquiry), the best approach is to contact the people on that list before July 1, 2014 to ask for their express consent.
To do this, use a solution like Cyberimpact, which includes all the tools to make your life easier (consent templates, consent blocks) and keeps the data you need to prove express consent.
Can express consent be verbal?
Verbal consent is allowed, but it’s up to you to prove it. The law favours two forms of proof: verification by an independent third party, or a complete, unedited audio recording of the consent given.
To avoid the hassle, though, direct the person to the subscription form on your website instead. They can enter their own address and expressly confirm their consent.
What information must a paper consent request include to be valid as express consent?
It must include:
- information identifying the sender;
- the purposes for which consent is being sought, in clear and easy-to-read terms (newsletter, promotions, contests, etc.);
- a statement that the person can unsubscribe at any time.
Sample wording (with a checkbox):
I consent to receive the Company Inc. newsletter, which includes news, updates and promotions about Company Inc. products. Consent may be withdrawn at any time.
It will be very important to keep and archive these paper consents as proof.
Do I need to keep proof of my consents?
Yes, and it’s very important!
We suggest keeping a register of the consents you’ve obtained, because if there’s a complaint, it’s the email sender who bears the burden of proving they were authorized to contact the complainant.
So carefully keep all your paper and electronic consents, as well as your voice recordings, and organize them so they’re easy to find when needed.
For electronic consent, you must have a database that records the date, time, purpose of the consent and how it was obtained. Some email marketing solutions, like Cyberimpact, record this information for you automatically.
Apart from member consent, what are the other main requirements of Bill C-28?
Sender identification
The message must identify the sender (business name) and, where applicable, the person on whose behalf the message is sent (including affiliates).
It must also include information that makes it easy to contact either of them:
- a mailing address, and either:
- a phone number reaching an agent or voicemail
- the email address or website of the sender (or of the person on whose behalf consent is sought)
- or a reference to this information posted on a web page (e.g. for a mobile phone screen)
Unsubscribe mechanism
Bill C-28 requires you to offer your members an easy, working unsubscribe mechanism. The key thing to remember is that your unsubscribe mechanism must remain functional for 60 days after your email is sent. Once an unsubscribe request is sent, you have a maximum of 10 business days to process it, though it’s best to process it as quickly as possible. You must then keep an up-to-date record showing when you processed the request.
Most email marketing solutions like Cyberimpact handle both of these features automatically. A footer containing the sender’s information and an unsubscribe link is automatically added to every email sent. The beauty of these systems is that they prevent you from re-importing people who have unsubscribed from your lists, which saves you from making costly mistakes.
Is buying email lists allowed?
Technically, yes.
However, we advise against it: besides harming your reputation, buying email lists very rarely produces good results. If you decide to go ahead, we recommend getting a guarantee from the list seller that the list complies with the anti-spam law, so they’re responsible if there’s a problem.
What should I do to prepare for Bill C-28?
Your mission between now and the law’s coming into force on July 1 is to obtain as many express consents as possible from the people in your database.
Here’s the fastest way to do it:
Step 1: Build a centralized database of all your contacts and import your file into Cyberimpact
It’s important to gather your contact lists and centralize them all in one place. Then import your Excel file into Cyberimpact. Find out how.
Step 2: Customize your consent template
Select the consent template of your choice and customize the text.
Example of a consent template
Step 3: Send a mailing to your list
People who know your business and appreciate the communications you send them should confirm their consent. For the others, it will probably take more than one mailing.
Step 4: Repeat steps 2 and 3 with a modified consent template
To encourage people who haven’t yet given you their express consent, hold a draw, offer a discount coupon, and so on.
Example of a mailing with a promotional coupon
Step 5: After a few mailings, export the members who haven’t yet given express consent
After a few mailings, once you notice that few people are still giving their consent, export the list of people who haven’t given you express consent so you can clean it up manually.
Step 6: For each of these contacts, determine whether you have verifiable proof of implied consent.
This step can be quite tedious. The easiest approach is to track down the business card or print the website or online directory where the recipient’s email address appears. Update your Excel file by adding the following columns:
- Type of implied consent (e.g. private relationship)
- Date of implied consent
- Proof (e.g. business card)
Example of the Excel file to update
Step 7: Import your file into Cyberimpact again
This will update the information about the type and date of consent.
Step 8: On July 1, remove all contacts for whom you have no proof of implied consent
That way, you’ll avoid potential lawsuits and legal action.
One last tip: add a sign-up form to your website
In addition to updating your database, add a sign-up form for your mailing list directly on your website. With Cyberimpact, it takes just a few clicks and no technical knowledge (see how). Everyone who signs up through this form will automatically give their express consent.
In conclusion
Bill C-28 is a major reform of commercial communication practices for every business or organization that sends commercial electronic messages. Boiled down to its simplest form, it’s the law of common sense: only send emails to people who want to receive them.
This law is an opportunity for everyone to show their good business practices, and it’s now or never to clean up your database and keep only the contacts who want to receive your communications. As we often say at our conferences, it’s not the size of your list that counts, but its quality. With the law coming into force, that will be truer than ever.
You can also visit the Government of Canada’s official website on Bill C-28.
Don’t hesitate to ask us your questions about this law or about email marketing. We’ll be happy to answer them.
Feel free to share this post with your contacts. The more people know about the law, the more they’ll realize it doesn’t stop them from sending emails; quite the opposite.