From today, a business that installs a program on someone else's computer, phone or tablet needs their express consent, with a clear description. Cookies, HTML and JavaScript on ordinary websites are generally treated as consented.

What starts today

Canada's anti-spam law has applied to commercial email and texts since July 1 last year. From today, Thursday, January 15, its rules on installing computer programs take effect as well.

In the course of commercial activity, a business may not install a program on someone else's computer, phone or tablet, or cause one to be installed, without that person's express consent.

Most small businesses will never notice. A few will need to change how they handle one routine job.

This post is general information about the new rules, not legal advice.

Who it touches

The last is the one people overlook. A shop that installs an app on a customer's phone while setting it up is putting a program on someone else's device, and needs their consent.

What express consent looks like

The request has to say, clearly and simply, who is asking and how to reach them, and what the program does and why, in general terms.

The person then has to agree actively: a box they tick themselves, a signature, a clear yes. A pre-ticked box or silence is not express consent.

Keep a record of what was shown, when, and who agreed. Consent given out loud is hard to prove later; consent on paper or on screen, kept on file, is not.

Programs that do more than they appear to

Some programs do things a person would not expect: collect information stored on the device, change its settings, send data elsewhere, or install other programs.

Where a program does any of these against the person's reasonable expectations, those functions have to be described separately and prominently, not buried in a licence agreement.

For a year after installing such a program, the business must also give an address where people can ask for it to be removed if the description was inaccurate, and help remove it at no cost.

What stays exempt

Cookies, HTML, JavaScript and operating systems are treated as consented to where the person's conduct makes it reasonable to believe they agree. Visiting an ordinary website is the everyday example.

So are programs that only run inside another program the person has already agreed to.

Updates and upgrades are covered by the original consent, if that consent included them.

For most businesses, the website's analytics code, contact form and cookies need no new consent request under these rules today.

Programs already installed

For programs installed before today, consent to updates and upgrades is implied for a transition period of a few years, or until the person says they do not want them.

New installations from today need express consent. That consent can include future updates, if the request says so plainly.

It is worth knowing what your programs install when they update. An update that adds a new function, such as sending data back, may need its own consent.

A worked example

A digital signage company with three staff sets up menu boards for cafes and restaurants, and waiting-room screens for clinics.

Each screen runs from a small media player that the client buys, loaded with the company's player software. A second program goes on the client's office computer, for changing the menus and specials.

The player software does more than show slides. It checks in with the company's server every few minutes, downloads new content, and updates itself.

It also sends back a small picture of whatever is on screen, so the company can spot a frozen display before the client does.

From today each installation needs the client's express consent. The company rewrote its one-page service agreement to describe each program in plain words, with a separate box for the check-ins, the screen pictures and the automatic updates.

The client signs it before anything is installed, and the signed page goes on file. The company's website carries the same description, with an address for questions and removal requests.

Apps and downloads on your website

If your website offers an app or a program to download, ask whoever builds and distributes it how consent is handled. The rules apply to whoever installs a program or causes it to be installed.

Ask what the installer adds besides the program itself. Toolbars and extra components bundled in without a clear description are the kind of thing these rules are aimed at.

Put a plain description of what the program does beside the download, with removal instructions, so the answer is there before anyone asks.

Remote support and IT services

Businesses that support other companies' computers install a lot: remote access tools, antivirus, backup and monitoring software.

The service agreement is the natural place for consent, with a plain list of what will be installed and what each piece does, signed before the work starts.

Keep that list current as tools change, and remove what was installed when a client leaves.

The counter-case

For a business with an ordinary website and no software of its own, nothing changes today. Cookies and scripts on the site need no new consent box under these rules.

Where a situation is unclear, such as a program a customer downloads for themselves, a lawyer is the right person to say whether the rules reach it. Guessing in either direction is a poor substitute.

For anyone who does put programs on other people's devices, the advice is plain: ask first, describe the program honestly, and keep the record.

Before the next installation

  1. List every program you put on other people's devices.
  2. Note what each one does and sends back.
  3. Write a plain description for each.
  4. Get express consent before installing anything.
  5. Keep a record of every consent.
  6. Publish removal instructions on your website.
  7. Ask your developer what any download bundles.

Step two is where the surprises are. Programs that quietly report back, change settings or add other software are the ones that need the separate, prominent description.

Naming who keeps those consent records works the same way as the roles in who decides what goes on the website this year.

Frequently asked questions

What CASL rules start on January 15?

Rules on installing computer programs. In the course of commercial activity, installing a program on someone else's computer, phone or tablet needs their express consent, with a clear description.

Does my website need new consent for cookies?

Not under these rules. Cookies, HTML and JavaScript are treated as consented to where the visitor's conduct makes that reasonable, which covers an ordinary website.

Which small businesses does this affect?

Those that put programs on other people's devices: IT and repair firms, businesses with apps or downloads, remote support providers, and staff who set up customers' phones or tablets.

What does express consent need to include?

Who is asking and how to reach them, what the program does and why, and an active yes. Functions such as sending data back need a separate, prominent description.

What about updates to programs already installed?

For programs installed before January 15, consent to updates is implied for a transition period, until the person objects. New installations need express consent, which can include updates.

How should consent be kept on record?

Keep what the person was shown, when, and how they agreed, on paper or on screen, filed where you can find it. Spoken consent is hard to prove later.

West Coast Media Solutions Inc. provides web design, web development, hosting, digital marketing, and business consulting to organisations across Canada, drawing on more than twenty-five years in the field.

Offering customers an app or a download?

Ask us what it installs. We will review the description and consent your customers see before they agree.

Start a Conversation