The First CASL Penalty and the Lesson in It

What the CRTC announced

Yesterday the CRTC announced the first penalty under CASL, Canada's anti-spam law, which has applied to commercial email since July last year.

The company involved sold training courses by email. The regulator said its messages went to people who had not consented, and that the unsubscribe in them did not work properly.

Neither failure is exotic. Both turn up in small business newsletters.

This post is general information rather than legal advice. It works as a checklist, because the two problems named this week are the two most worth checking first.

Two failures, both ordinary

Sending without consent sounds like something only spammers do. In practice it usually means a list that grew from several places, with nobody sure which address came from where.

A broken unsubscribe sounds deliberate. In practice it is usually a link that stopped working in a redesign, or a request recorded in one copy of the list and not the others.

From the recipient's side, carelessness and intent look identical: another message they never agreed to receive.

Where the addresses came from

• A sign-up form on the website, ideally recording the date.
• Customers who bought something, with implied consent for two years.
• People who asked a question, with implied consent for six months.
• Business cards and draw slips collected at shows and events.
• A list from a partner or supplier, shared or bought.
• Contacts copied from an inbox when the newsletter began.

The fifth is the one to remove first. People agree to hear from a particular business, and a list passed between companies rarely arrives with any record of what they agreed to.

Cards and draw slips come next. What they allow depends on what people were told when they handed them over, and that is rarely written down.

Consent you can show

Under CASL the burden of proof sits with the sender: if consent is questioned, the business has to show it. The record matters as much as the consent.

For each address it should show how it was obtained, when, and what the person was told. A website form can store that automatically; a paper sheet needs a date and its wording kept on file.

Express consent needs a plain request that names the business, says what it will send, and explains that the person can withdraw. A box already ticked when the form loads is not express consent.

Implied consent runs out. A customer whose last purchase was more than two years ago has dropped off, and an enquiry from last summer has already lapsed.

Relationships from before July 1 last year that already included commercial email keep implied consent through a three-year transition, unless it is withdrawn. That is the window to ask for express consent.

An unsubscribe that works

Every commercial email needs a way to unsubscribe that is easy to use and costs nothing. A link to a page with one button is the usual form.

The unsubscribe has to remain usable for sixty days after each message goes out, and anyone who asks must be off the list within ten business days.

The usual failures are small: a link that leads to a login page, to a page deleted when the website was rebuilt, or to a form that says thank you and records nothing.

Treat a reply asking to be taken off as an unsubscribe too, even if it lands in an inbox nobody reads.

Every copy of the list

Most small businesses have more than one. The mailing service holds a copy, the till or booking system another, and someone keeps a spreadsheet for messages sent from Outlook.

An unsubscribe recorded in one place does nothing for the others. A customer who left the newsletter in January can still get a sale notice in March from a different system.

Choose one list as the master, record every unsubscribe there, and check it before anything commercial goes out from anywhere else.

A worked example

An estate sale company runs sales most weekends, clearing houses for families after a death or a move into care. Every Thursday it emails a list of buyers with photographs of the coming sale.

The list had grown from clipboard sheets at the door of each sale, people who had emailed with questions, families it had worked for, and a list an auctioneer had shared years before.

Its unsubscribe link pointed at a form on the company's website. When the site was rebuilt last autumn, the form disappeared, and clicking the link brought up a page-not-found message. Nobody on staff had ever clicked it.

The auctioneer's addresses came off first. The clipboard sheets had never named the company or said what people would receive, so those addresses were set aside.

Recent buyers, whose implied consent was still running, got one email asking whether they wanted the Thursday notices, and each yes was recorded with its date.

The unsubscribe now runs through the mailing service's own page, and someone tests it from a personal address every month.

Name and address in every message

The third requirement gets less attention. Every commercial message has to name the sender and include a mailing address, along with at least one other way to get in touch: a telephone number, an email address or a website.

Most templates have a footer for this; check that it is current, particularly after a move.

Receipts are not newsletters

Order confirmations, receipts, requested quotes, and warranty or safety information are treated differently. They do not need the consent a newsletter needs.

That holds only while the message stays a receipt. Add this month's specials and a discount code to an order confirmation, and it starts to look like a promotion.

The counter-case

A business that emails customers only about their own orders and bookings has much less to check. So does one whose whole list signed up through a form that records the date.

A large, mixed or bought list is worth showing to a lawyer before anything more goes out to it.

For everyone else, the lesson is two checks: consent you can show for every address, and an unsubscribe that always works.

Before the next newsletter

1. List every source your addresses came from.
2. Remove addresses shared or bought from others.
3. Record how and when each address was added.
4. Unsubscribe yourself using a test address.
5. Check the removal reaches every copy of the list.
6. Fill in the footer with name and address.
7. Repeat the test after any website change.

Step four is the test that would have exposed this week's second failure. Two minutes with a test address shows the unsubscribe exactly as a customer meets it.

The CASL rules that took effect in January, for software rather than email, are covered in CASL rules on installing software start today.

Frequently asked questions

West Coast Media Solutions Inc. provides web design, web development, hosting, digital marketing, and business consulting to organisations across Canada, drawing on more than twenty-five years in the field.