What is CASL and Does It Impact Companies in the United States?

Canada’s anti-spam legislation (CASL) protects consumers and businesses from the misuse of digital technology, including spam and other electronic threats. It also aims to help businesses stay competitive in a global, digital marketplace.

Does CASL apply in the US?

CASL requires all businesses to obtain and document consent to send commercial emails to Canadians. This means that if you have Canadian email addresses in your email marketing database, the law is applicable to you even if your business is based in the U.S. or any other country outside of Canada.

There are three general requirements under CASL for sending CEMs. They are:

Identification
Unsubscribe mechanism
Consent

For identification, the message must clearly indicate who is sending the message, plus mailing address and either a contact phone number, email address, or website URL. If the contact information cannot fit in the message itself (as in an SMS message), a link to a website containing the information is acceptable.

For the unsubscribe mechanism, the message must have a straightforward electronic means of allowing customers to opt-out of receiving future messages, such as the ability to text “STOP” in a text message or through an unsubscribe link in an email.

For consent, CASL requires organizations receive prior consent from recipients before sending CEMs. There are two types of consent under CASL:

Express consent is when the message recipient has explicitly agreed to receive CEMs from the message sender.
Implied consent is when the message recipient is a current customer of the sender.

Both types of consent are described in more detail below, including what defines someone as a current customer.

Not complying with CASL can result in serious penalties, including criminal charges, civil charges, personal liability for company officers and directors, and penalties up to $10 million. It’s important to understand the law and what it means for your business.

Express Consent

To give express consent, customers or prospects must explicitly say something to the effect of “yes, please send me marketing emails” when they provide their email address before a company can send any marketing materials to them. These individuals must take some type of action to indicate their explicit consent. For example, clicking a check box would be acceptable but acceptance of a pre-filled check box would not be sufficient.

There are two main benefits to collecting express consent: First, express consent can be used for both existing customers and prospects. Second, express consent does not expire – it is valid until the customer chooses to opt-out of further communications.

Outside of CASL, the CWTA (Canadian Wireless Communications Association) additionally requires explicit consent for any SMS messages sent from a short code, which includes SMS messages that we send on your behalf.

Implied Consent

Consent to send a commercial electronic message (CEM) is implied where there is an existing business relationship. An “existing business relationship” is defined in CASL as cases in which:

Your company and the individual have done some business together within the last two years;

The individual has made an inquiry within the last six months.

With this existing business relationship, you can market to individuals who have not opted-out from receiving messages. However, you are limited to how long you can email individuals with whom you have not done business recently.

Implied consent has a limited shelf life. It is only permissible to communicate with those individuals while they continue to meet one of the two criteria above. For example, if a customer makes a purchase from your business, then you have two years from that point during which you can send that person messages. As another example, if a customer calls your business to ask a question but doesn’t end up doing business with you, you would only have six months from that point to send messages. For implied consent to be valid, it is always your responsibility as a business to be able to prove the business relationship is ongoing.

Because of the limited life of implied consent, it is always advisable to collect express consent from customers where possible.