Overview

Learn about the Canadian law that governs commercial electronic messages (such as email and SMS), which is the Canadian Anti-Spam Legislation (CASL).

When sending marketing messages, it’s important that you know about this law if you have Canadian recipients.

About CASL

CASL is a Canadian federal law that is designed to protect consumers from spam, electronic threats, and other misuses of digital technology.

CASL covers all commercial electronic messages (CEMs), which are messages that:

• Are in an electronic format (e.g., emails, SMS/MMS messages, social media messages, and instant messages)
• Are sent to an electronic address (e.g., an email account, a telephone account, an instant messaging account, and any other similar account)
• Encourage participation in a commercial activity (e.g., offers to purchase or sell products, goods, and services or promoting products, goods, services, people, or businesses).

The 3 main CASL requirements that you need to comply with when sending CEMs are:

1. Obtain consent
2. Provide identification information
3. Provide a way to unsubscribe/opt out of messaging

Fines for violating CASL can be up to $1 million per violation for individuals and up to $10 million per violation for businesses. Both individuals and businesses (including their directors, officers, and other agents) can be liable for violations of CASL.

Under CASL, you must obtain proper consent from recipients of CEMs. In the next section, we go over what it means to have this consent.

Consent: explicit vs. implicit

There are 2 types of consent under CASL:

• Explicit (also known as express)
• Implicit (also known as implied)

CASL primarily relies on explicit consent, meaning that anyone you message must opt into that channel, with a few exceptions. You must also keep a record of all consents obtained under CASL (i.e., when and how consent was obtained).

Explicit consent

Explicit consent means someone has told you explicitly that it’s okay to send them a message. They can do so either verbally, in writing, or by subscribing via a form, but must take a positive action to indicate their consent. If you request consent via a checkbox, the box must be unchecked by default.

Requests for consent must include:

• A clear and concise explanation of why you are obtaining consent
• A description of the types of messages you’ll be sending
• Your name (or business name) and contact information (valid mailing address and either anemail address, phone number, or web address)

A statement that the recipient can withdraw their consent at any time
When someone gives consent for one type of CEM, this does not mean you can message them via another channel. For instance, if someone agrees to receive emails from your brand, this does not count as agreeing to receive SMS, social media, or instant messages.

Explicit consent does not expire, but recipients can withdraw their consent at any time.

Some types of CEMs (such as SMS) always require explicit consent. However, others (such as email) allow implicit consent in certain conditions. 

Implicit consent

Implicit consent is only allowed in certain situations under CASL.

The first and most notable situation is when you have an existing business relationship with the recipient. Examples of this are if they purchased a product, good, or service from you; accepted a business deal or investment with you; or entered into a written contract with you — all within the past two years — or if they inquired about a product, good, or service from you in the past six months.

A similar case is when someone has an existing non-business relationship with the recipient. For example, they will have implicit consent if they donated or volunteered with your registered charity or political organization within the past two years.

Another scenario where implicit consent may apply is if a person makes their email address publicly available by publishing it on a website, and does not include a statement that they do not want to receive CEMs at that address.

Unlike explicit consent, implicit consent can expire. When there is a time period associated with implicit consent, if the recipient has not “renewed” their implicit consent during that time period (e.g., by purchasing from you again), the implicit consent expires and you are no longer allowed to send CEMs to that recipient.

Because of the complexity involved with implicit consent, we recommend that you obtain explicit consent from all recipients you plan to send CEMs to. Explicit consent is required in order to send SMS and MMS messages using MoEngage SMS.

Additional requirements under CASL

In addition to obtaining consent, CASL requires the following information to be included within every message:

• Your business name, if different from your name (if not, identify your name) and the name of anyone else on whose behalf you are sending the message.
• Contact information, which must include:
  • A valid mailing address (which must be valid for at least 60 days after your message was sent)
  • At least one of the following
    • Email address
    • Web address
    • Phone number to reach an agent or voice messaging system
• An unsubscribe mechanism (e.g., an unsubscribe link, “text STOP to opt out,” etc.)

You must include this information, or a way to quickly get this information, in every CEM. In emails, the typical approach is to add these details to the footer. For SMS and MMS messages (and other CEMs where it’s not practicable to include this info in the body of the message), the typical method is adding “Info:” followed by a link to a webpage that contains this information to the end of each CEM.

Best practices

While not explicitly required by CASL, there are a few best practices you can follow when sending CEMs:

• Include at least one link to your website
• Send between 9 a.m. and 8 p.m. in the recipients’ local time (for SMS and direct messages); use Do Not Disturb for flows to automatically prevent sending SMS outside of these times
• Do not use spammy phrases in your messages or email subject lines; e.g., “free money”
  Provide value, every CEM should be helpful to the recipient; if not, subscribers will likely opt out
• Avoid sending a lot of emojis and using acronyms unless you know your audience understands or responds positively to them
• Do not overload recipients with too many messages; for instance, use Frequency Capping to limit how often someone can receive messages via a certain channel

CASL exemptions

Certain types of CEMs are exempt from CASL and not subject to the requirements described above. The following types of CEMs are exempt from CASL:

• Messages sent in response to a recipient’s complaint, question, or request, or messages that are otherwise solicited by the recipient (i.e., the “email reply” exemption)
• Sending certain transactional messages
  • Providing information about a warranty, a recall, safety, or security for a product or service that the recipient bought
  • Notifying or giving factual information about an account; membership; purchase, subscription; or other ongoing relationship, including delivery of product updates or upgrades
  • Giving a quote or estimate for a service, product, or good
  • Confirming, facilitating, or completing a commercial transaction that the recipient agreed to enter
• Messages sent to an employee or consultant of your business or of another organization that your business has a preexisting relationship with if the message concerns the activities of the organization receiving the message
• Messages sent by registered charities or political parties or organizations to raise funds or solicit contributions
• Messages sent to fulfill a legal obligation; provide notice of a pending or existing right, judicial or legal obligation, or court order; or to enforce a judicial order, court order, or legal right
• Messages sent by a person who reasonably believes the message will be accessed in a foreign country, as long as the message(s) complies with the anti-spam laws of that country
• Messages sent by an individual to an individual recipient with whom the sender has a personal or family relationship

It’s also important to note that purely transactional messages (e.g., messages confirming a purchase, subscription, delivery, etc.) that don’t include any advertising or promotional content are exempt from CASL’s consent requirement, but not the identification information and unsubscribe mechanism requirements described above.

Additional resources

Read more about CASL:

• CASL full text
• Frequently asked questions about CASL