On July 1, 2014, Canada’s Anti-Spam Legislation (CASL) goes into effect. The law is intended to protect citizens from commercial electronic messages (CEMs) that include spam, malicious software, phishing, data harvesting, false or misleading promotions, and “any other current and future Internet and wireless telecommunication threats prohibited by Canada’s anti-spam legislation.” CASL is viewed primarily as a way to stop email abuses, but it also applies to certain types of social media messaging (Tweets, Facebook posts, etc.), text messaging and instant messaging.
CASL requires businesses to obtain express and informed consent before sending CEMs. Instead of simply offering an opt-out option as was previously required, email marketers can send messages only to recipients who have opted-in by providing an email address or checking a box that can’t be pre-checked. Requests for consent can’t be bundled with other requests or terms and conditions of a sale.
Other CASL regulations require the sender to be clearly identified and provide a clear opt-out or unsubscribe mechanism that is honored within 10 days. CASL also introduces new rules for how contact lists may be shared or sold.
Businesses have three years after July 1, 2014, to get consent to send CEMs, and prior express consents are recognized as CASL-compliant. However, once this grace period expires, requests of consent will be considered a CEM and violate CASL.
Consequences for violating CASL are severe – up to $1 million for individuals and up to $10 million for businesses. False or misleading claims about the subject matter or the sender can result in criminal charges, and individuals within a company can be held personally liable for knowingly violating CASL.
If your company’s email list includes people in Canada, you need to understand how these new rules differ from existing laws and take steps to become compliant. CASL clearly has tougher regulations than the United State's CAN-SPAM (Controlling the Assault of Non-Solicited Pornography and Marketing) Act of 2003.
CAN-SPAM allows email marketers to send unsolicited commercial email as long as it meets compliance standards for unsubscribe, content and sending behavior. For example, senders must provide a valid physical mailing address, an opt-out mechanism, and accurate information in the “From,” “To” and “Reply to” fields. Unsubscribing should be easy and honored within 10 days, and subject lines should not be deceptive or misleading. Violations of CAN-SPAM incur fines of up to $16,000 per email.
Keys to CASL Compliance
- Create an implementation strategy. Preparing for CASL is not something that can be accomplished in a few hours. All electronic communication with clients or prospects must comply with CASL or qualify as an implied consent exception. Develop a plan for managing and verifying consent requests.
- Close compliance gaps. Assemble an internal team to assess existing consents, opt-out mechanisms, CEM processes, and cross-marketing programs with partner companies.
- Convert implied consents to express consents. Implied consent exceptions expire in six months if a recipient doesn’t become a customer and in two years if a customer doesn’t make a purchase or renew their subscription. Express consent, which never expires unless someone unsubscribes, carries significantly less risk.
- Train employees. Employees contact customers and prospects in a variety of ways, so they need to understand the regulations and the consequences of a violation.
