Cold email in Canada: CASL

Consent comes first

A commercial electronic message (CEM) needs the recipient’s express or implied consent. The person who claims consent has to prove it (CRTC).

• Express consent is a clear opt-in, written or oral, such as a sign-up form. It doesn’t expire, but lasts until the person unsubscribes. An email asking for consent is itself a CEM, so it isn’t a valid way to get consent.
• Implied consent arises in specific situations set out in the Act. The CRTC’s guidance describes the main ones below.

Implied consent

Existing business relationship

Consent is implied if the person bought or leased something from you in the past two years, or made an inquiry or application in the past six months (among other cases such as a written contract still in force).

Conspicuous publication

If someone has conspicuously published their email address, for example on a company website, consent can be implied only if the publication isn’t accompanied by a statement that they don’t want CEMs, and your message relates to their business role, functions or duties. The CRTC’s example: a course on social media marketing sent to a marketing officer is relevant; an administrative assistant course sent to a chief operating officer is not. You must be able to show both conditions were met.

Disclosure, such as a business card

The CRTC’s guidance also gives the example of a person disclosing their email address to you verbally or in writing, such as on a business card. It recommends keeping a record, for example a follow-up email that refers to the conversation; that email is itself a CEM, so it needs identification and an unsubscribe.

What every message must contain

Every CEM must identify the sender (and anyone it is sent on behalf of) and include an unsubscribe mechanism. The regulations require the name, a mailing address and either a phone number, an email address or a web address; this information and the unsubscribe mechanism must be set out clearly and prominently, and the unsubscribe must be readily performed (SOR/2012-36). Unsubscribe requests must be given effect within 10 business days, whatever type of consent you relied on.

What every email needs

• The name of the sender, and of anyone you send on behalf of
• A mailing address, plus a phone number, email address or web address
• An unsubscribe mechanism that is easy to use, shown clearly and prominently

What Inboxed does automatically

• Adds your company name and postal address to the footer of every campaign email, and blocks a campaign from launching until they’re set (Settings → Compliance, or per campaign).
• Adds a visible unsubscribe line and one-click unsubscribe headers (RFC 8058) to every campaign email. A click takes effect straight away, for everything your workspace sends, with no login or extra details asked.
• Treats replies such as “unsubscribe”, “remove me” or “stop emailing” as an unsubscribe.
• Keeps a suppression list that every campaign checks before each send. Unsubscribes and spam complaints can’t be removed by your team; you can also block whole companies by domain.
• Verifies every lead before sending and never charges for addresses that fail.

What you must do

Inboxed can’t decide who you may lawfully email. These parts are your responsibility:

• Have express or implied consent for every Canadian recipient before the first email, and keep evidence of it (for example, the page where the address was published and the date, stored in a custom field on the lead).
• For conspicuous publication, check the address wasn’t published with a “no unsolicited messages” statement and that your message fits the person’s role.
• Make sure your signature includes a phone number, email address or website in addition to the footer’s mailing address.
• Not email to ask for consent: that email is itself a CEM.

Penalties

The maximum administrative monetary penalty per violation is $1,000,000 for an individual and $10,000,000 for any other person (CASL section 20(4)) (Justice Laws).

Common questions