Back to All Stories

During our recent webinar on CASL, we got a number of questions that we were unable to answer. Today, I will try to answer some of those questions which centered around the concept of consent.

As we begin, let me start by reminding people that I'm not an attorney. You shouldn't accept this as legal advice. And, you should certainly consult your own counsel to answer your specific questions concerning how CASL applies to what you're doing.

Implied consent

  1. Will implied consent continue to exist (i.e., we have done business together therefore I can email you) or does that disappear under CASL?
    • Under CASL, implied consent exists in the following circumstances:
      • Where the recipient and the sender have an "existing business relationship" or an "existing non-business relationship."
      • An existing business relationship exists where the sender and recipient have engaged in certain specified types of business together in the two years preceding the date on which the CEM is sent (for example, a purchase or lease of a product, or entering into or continuing a written contract) or where the recipient of the CEM has made an inquiry to the sender in the previous six months.
      • An existing non-business relationship exists where an individual has made a donation or gift in the last two years, or performed volunteer work in the last two years, to or for a registered charity or political party, organization or candidate or where the individual is a member of certain clubs, associations or voluntary organizations.
      • Where a recipient has "conspicuously published" his or her electronic address, the publication is not accompanied by a statement that the recipient does not wish to receive unsolicited CEMs, and the CEM is relevant to the person's business, role, functions or duties in a business or official capacity.
      • Where a recipient has disclosed his or her electronic address to the sender without indicating that the recipient does not wish to receive unsolicited CEMs and the CEM is relevant to the person's business, role, functions or duties in a business or official capacity. This is sometimes dubbed the "business card" exemption.
    • However, remember that ExactTarget's marketingcloudmarketingcloudAnti-Spam Policy still applies. The first two sentences are: "Our clients certify that they will use our software only to send emails to customers and prospects that have directly consented (opted-in) to receive email. They are forbidden to transmit unsolicited commercial email (spam) via our system." So ExactTarget's expectation is direct, or express, consent.
    • Generally speaking, you should assume that implied consent does not comply with our Anti-Spam Policy. While many people who give email addresses in the context of a business relationship expect to be added to your email list, many more do not. It is always best (not to mention expected) for you to ask for consent in order to maximize your ability to successfully send mail.
  2. Can you market to contacts that you got business cards from at a tradeshow?
    • Yes, this is implied consent under CASL. Where a recipient has disclosed his or her electronic address to the sender without indicating that the recipient does not wish to receive unsolicited CEMs and the CEM is relevant to the person's business, role, functions or duties in a business or official capacity. This is sometimes dubbed the "business card" exemption. We will generally allow clients to do this unless the practice ends up generating complaints.
    • You should also be aware, though, that many blocklists may require the removal of this kind of data in order to remediate deliverability issues.
  3. If an individual at an organization (using a business email address) makes a purchase, do we have implied consent for the entire organization?
  4. ­Does implied consent need to be at the individual level or at the company level?
    • It appears that implied consent follows the purchaser. So, you would only have implied consent for the individual who makes the purchase, rather than the entire organization.
  5. ­In "implied consent" based on a purchase within the last 2 years, if you periodically communicate with them, but they never respond, do they cease to be implied consent after they pass the 2-year mark?
  6. What about opens and click throughs is this a continuation of consent?­
    • I'm grouping questions 5 and 6 together because they seem to be in the same ballpark. In instances where you are relying upon subscriber-initiated contact (say, after a purchase) to establish implied consent, it would seem to me to be that the clock would roll until another qualified transaction takes place instead of restarting the clock with an open or a click. Additionally, opens and click-throughs are usually obtained by the use of tracking pixels and other tracking mechanisms in the email. This is not proof that you have obtained consent or that the recipient wishes to continue to receive CEMs from you.

List purchases, list rentals, and list appends

  1. How about if the list is from a directory that you pay for such as HIMSS Analytics?
  2. How does this law apply to purchase of 3rd party lists where the consumer may not have expressed consent to the company sending the message?
  3. How does CASL apply to purchased lists?
    • In all of these questions, it is my opinion that addresses obtained via list purchase, list rental or list append fail to meet the standard of either implied or express consent.
    • Further, ExactTarget's marketingcloudmarketingcloudAnti-Spam Policy applies in these circumstances as well. List purchase, list rental, and list append are all specificially prohibited by our published policy. Clients who are discovered using these methods to build their lists will be required to remove this data or face account suspension or termination, regardless of if the mail is being sent to Canada.
  4. Is the list provider liable or the list purchaser?
    • CASL provides for a "follow the money" scheme. That means that the party ultimately responsible is going to be the one who benefits from the mail which is sent. So, my opinion is that the purchaser will be liable for damages that come about under CASL as a result of sending mail to rented or purchased lists.

Establishing consent

  1. Is sending an email series with the message "If you want to continue receiving emails, do not click on this link" considered valid express consent?
    • No. Express consent under CASL means that the recipient must take an action to tell you that they want to receive messages. Express consent in this context would mean that the subscriber would need to click on the link in order to remain on the list.
  2. Could it be considered express consent if in during the online sale of your product, you say "by signing up for our product, you'll get onboarding emails"?
    • In October 2012, the Canadian Radio-television and Telecommunications Commission (CRTC) released Compliance and Enforcement Information Bulletin CRTC 2012-548. The purpose of this bulletin was to provide additional guidance on how the CRTC thinks that CASL should be enforced. Included in this bulleting is a section on obtaining consent. There, the CRTC said, "The Commission considers that requests for consent contemplated above must not be subsumed in, or bundled with, requests for consent to the general terms and conditions of use or sale. The underlying objective is that the specific requests for consent in question must be clearly identified to the persons from whom the consent is being sought." Thus, it appears that attempting to establish consent by tying it to other parts of the purchase process is prohibited.
  3. If on purchase, the purchaser selects a radio button to add to a list, then that pushes implied to express consent, correct?
    • If the radio button has the negative option preselected, then this would be an excellent example of obtaining express consent.
  4. ­What if a box is pre-checked to subscribe, but a double opt-in process is in place (i.e., they are sent an email to confirm their opt-in, and they click the link and confirm)? Does this count as express consent?
    • I would think that this would count as express consent as long as no one is added to the list unless they actually click the link. However, you might want to consider how confusing that this might prove both for subscribers and potentially for regulators.
  5. Can you obtain express consent over the phone, and what proof is necessary?
    • ​CASL allows consent to be obtained orally but the person requesting consent bears the burden of proving that consent was properly obtained. According to Compliance and Enforcement Information Bulletin CRTC 2012-548, the CRTC considers the following as evidence of oral consent:
      • where oral consent can be verified by an independent third party (most sources I've heard from indicate that this is sort of like what is required to document someone switching phone services, but we're really not sure what this will end up meaning); or
      • where a complete and unedited audio recording of the consent is retained by the person seeking consent or a client of the person seeking consent.
    • Conclusion - keep a recording of the consent given.
That will do it for our first set of questions. Stay tuned, though -- we still have lots more.