Will Your Marketing Campaign Be the Target of a Class Action Lawsuit or Regulatory Investigation for Failing to Comply with Canada’s Anti-Spam Legislation?

What is Canada’s Anti-Spam Legislation (“CASL”)?

CASL[1] was passed into law on December 15, 2010, and is widely regarded as the strictest anti-spam legislation in the world. The Canadian Radio-Television and Telecommunications Commission, the Canadian Competition Bureau and the Office of the Privacy Commissioner of Canada are all empowered to enforce and issue administrative monetary penalties for violations of CASL.

How is CASL Different than CAN-SPAM?

CASL is far broader and more restrictive in its application than the U.S. Controlling the Assault of Non-Solicited Pornography and Marketing Act of 2003 (“CAN-SPAM”).  For instance, while CAN-SPAM regulates the content and form of e-mail messages and establishes an “opt-out” regime, CASL prohibits all commercial electronic messages that are sent without proper consumer consent, including e-mail, text, social media, sound and image messages. Additionally, CASL places restrictions on the use of spyware and malware, which are not addressed by CAN-SPAM.  Most importantly: 1) the monetary penalties that may be levied under CASL are exponentially higher than those of CAN-SPAM; and 2) CASL will allow individuals to file private and class action lawsuits to collect statutory damages.[2]

What is a Commercial Electronic Message?

CASL defines a “Commercial Electronic Message” or “CEM” as a business-related message sent by any means of telecommunication, including e-mail, text, sound or image messages.

What Entities are Subject to CASL?

Any individual or business entity that sends, or assists in sending, a CEM to a consumer in Canada is subject to CASL.  Moreover, any CEM that is sent from, routed to or accessed from a device in Canada is subject to CASL regulations.[3]

What are the Exceptions to CASL?

Most business-to-business CEMs and those that are purely informational in nature are not subject to CASL regulations. Additionally, marketing companies and individuals will not be liable under CASL if the CEMs are:

  • not intended to be accessed in or routed through Canada, and conform to the laws of the target country;
  • sent within six (6) months of receiving a consumer’s request, inquiry or complaint;
  • sent from a charitable organization or solely consist of political content;
  • sent to consumers with whom the sender has an existing business relationship;
  • sent to consumers with whom the sender has a familial, personal or other non-business relationship;
  • sent on a one-time basis to consumers referred by a person that has an existing relationship with the sender;
  • sent to consumers based on the authorization of a third party that has already secured the consumers’ consent; [4] or
  • sent to a person engaged in commercial activities, and solely address issues relating to those activities.

What are the CASL Consent Rules?

CASL permits the sending of CEMs to a consumer if the consumer expressly or implicitly consents to receive the CEMs.[5]  Every CEM, even those sent with consent, must include a simple, clear and cost-free mechanism that allows consumers to revoke their consent and unsubscribe from the receipt of future CEMs.

  1. Express Consent

Express consent may be properly obtained either orally or in writing, provided that the sender clearly discloses the purpose and manner of consent and the consumer affirmatively provides his/her consent. Electronic or digital forms of consent are acceptable forms of consent under CASL (i.e., consent obtained via email, website form, text message, or voice recording).[6]

If a dispute concerning consent arises, the sender bears the burden of proof to demonstrate that the consumer consented to receive CEMs in the manner provided. Evidence of Internet-provided written consent includes, but is not limited to, website pages that contain consumer consent language and fields, associated screenshot of the consent webpage as seen by the consumer, complete data record submitted by the consumer (with time and date stamp), together with the applicable consumer’s computer IP address.  For any type of oral consent, the sender must be able to verify the consent with a complete and unedited recording of the consumer providing consent. It is a best practice for advertisers to maintain a record of each consumer’s consent for at least three (3) years, which is the statute of limitations to bring an action under CASL.[7]

Click here to view table

  1. Implied Consent

There are three (3) main ways in which consent to receive CEMs is implied under CASL:

  • If there is an existing business or non-business relationship with the sender formed within the last two (2) years;
  • If the consumer publicly publishes his/her electronic address(es) without limiting the right to receive CEMs; or
  • If the consumer discloses his/her electronic address(es) to the sender without limiting the right to receive CEMs.

Click here to view table

What are the Penalties for Failing to Comply with CASL?

CASL provides for either actual damages or statutory damages of $200.00 per each violation, up to a maximum of C$1 million/day for individuals and C$10 million/day for corporate entities.  More importantly, corporate officers, directors and agents may be held personally liable if they directed, authorized, acquiesced or participated in the commission of a CASL violation. [11]  In determining the final amount of statutory damages to award, courts analyze the personal/corporate history of the violator(s), the financial benefit obtained and the nature and scope of the violation(s).  Considering that marketing campaigns may involve millions of CEMs, potential damages under CASL may escalate very quickly.