Everything You Need to Know About Canada's New Anti-Spam Legislation

You may have noticed lately that the Interwebs is freaking the #!$% out due to Canada’s Anti-Spam Legislation (CASL) that goes into effect today. The legislation was actually passed back in 2010 but, of course, no one paid attention because 2014 seemed to be in a land far, far away.
Well July 1, 2014 is officially here and so are the new regulations which affect:

any business or organization (yes, nonprofits are included)
that sends electronic messages (of all varieties)
to promote or market their organizations, products or services
in or from Canada or to individuals located in Canada.

So basically all of us.
It is understandable that the CASL has small businesses up in arms. It is being called the “toughest anti-spam law in the world” to date and will affect how we small businesses communicate with our communities, being that electronic messaging (including email, social media messages, text messages, etc.) is, for many of us, the main way we communicate with our customers and potential customers.
But never fear! We have taken the time to read the actual legislation (fancy that!) and accompanying government documentation to give you the deets below so you’ll be in compliance with the CASL faster than you can say, “Happy Canada Day!”
So here’s the 411 on the new Canadian Anti-Spam Legislation (CASL):
If you email customers or subscribers in Canada, you are already required by current Canadian law to have their consent, have a way for them to unsubscribe, and provide a way for them to contact you. You probably do this for your non-Canadian customers too being that this is also US law (the CAN-SPAM Act) and also the European Union Opt-In Directive and probably every other country’s law, too.
What is different as of July 1st (ie, TODAY!) is that the new Canadian law requires you to jump through flaming hoops over a pit of hungry alligators, erm…um, I mean…. “obtain express consent” (as opposed to implied consent) from nearly everyone to whom you send commercial electronic messages.
Express consent requires that you:

Clearly tell customers why you want to send them messages, for example, to tell them about special offers or to send them your weekly newsletter,
Describe the messages you want to send,
Provide a statement letting recipients know they can unsubscribe and how they would do so, and
Provide your physical address and other contact information in the email.

What the hell is the difference between express and implied consent?
Express consent can be written or oral (but we don’t recommend getting oral consent because that would be tough to prove).
However…BEWARE! Hidden booby traps abound!
Under the new law starting July 1, 2014, express consent requires that the intended recipient actively check a box or fill-out a form where you are requesting permission to contact them electronically. None of that sneaky adding in a pre-checked box and hoping they just forget to uncheck it when they purchase from you. Recipients have to take an affirmative action, ie, they have to actually do something (like check a box, enter their initials, fill out a form, etc.); passive consent will not do.
So what is implied consent? There are 4 types of implied consent the CASL recognizes.
You have implied consent if:

A potential customer has contacted you with an inquiry; this gives you implied consent that is good for 6 months. After that 6 month period, you need express consent to continue to email them.
A customer has purchased from you; this gives you implied consent for 2 years following the purchase (for subscriptions or memberships, the 2 year period begins when the subscription or membership terminates). You would need to obtain express consent to email them after that.
Where the email address of the subscriber is posted publicly (ie, on the person’s website), and
Where the person sent an email to your business (at one point or another).

Simple and straightforward, right? Like juggling monkeys while riding a unicycle on a high wire!
So basically express consent is QUEEN; implied consent is a lowly court jester who will make you hysterical (and not in a good way) trying to keep track of when it expires for each of your Canadian subscribers.
What kinds of “commercial messages” are covered by the CASL?
The law applies to emails, text messages, social media messaging, and instant messaging. Does this apply when a person likes your business page on Facebook or follows you on Twitter? Well, no one is quite sure yet, but probably not.
Keep in mind, that the law addresses commercial messages, ie, messages meant to promote or sell a product, service, or brand. Sending out blog posts and other free content to your subscribers is still a commercial message even though it doesn’t generate revenue because the purpose is to eventually create a customer relationship with that person.
There are many kinds of messages that are exempt. The law doesn’t apply:

To personal messages to friends, family, or even business contacts with whom you have a relationship,
If you are contacting a customer about their subscription, account, membership, order, service, or upgrades,
To fundraising for charity or political organizations,
To one (and only one!) unsolicited message to a recipient based on a referral, but you have to specifically say who referred you;
To unsolicited information about warranties or safety recalls, and
You don’t need consent to send messages to enforce your legal rights (such as DMCA take-down notices.)

So how the hell do I comply with the quickness? And what happens if I don’t?
Step 1 – Recordkeeping Saves Asses
Non-compliance can be expensive, fines up to $10 million Canadian dollars can be assessed. However, such hefty fines are reserved for egregious cases. There are no automatic penalties but a range of enforcement tools will be used from warnings to actual monetary penalties. The burden of proving consent is on the sender, so the first thing you need to do is set up your systems so that you have accurate records of consent from your Canadian recipients.
Let us repeat, keeping immaculate records here is abso-essensh (that’s absolutely-essential; we just made that up)!
Consider segmenting your list so that you can get express consent from your Canadian subscribers who never opted-in to your list. Many email marketing applications include the ability to identify where your subscribers are accessing your emails from and that can be a big help but may not be 100% reliable.
Step 2 – Review Your Current Ass-Saving Records
Next, you should review what consent you have from Canadian recipients. If you have express consent of some kind (remember, that’s back when you were all “Hey, I want to send you messages about my business, products, services, and otherwise commercial awesomeness, so you’ll know when I have a special offer for you and so you’ll know the haps of what’s going on with my business on a weekly basis. You can unsubscribe whenever you want and oh, here’s my address, phone number and email” and your Canadian subscriber was all, “Hey, I’d like that! Yeah, go ahead and send me some messages, eh”), you may continue to rely on that, even if it doesn’t have all of the elements required in the new law.
Express consent received before July 1, 2014, remains valid and does not expire until the recipient withdraws it, (ie, unsubscribes). That means there is no need to get your Canadian subscribers to opt-in again, if they’ve already opted in to your list in the past.
If you have only implied consent, then you will need to request express consent, carefully using every element that express consent requires under the CASL.
If you do not have express or implied consent from a recipient on your list, you must stop emailing that recipient immediately. As in this instant! However, the good news is that if you have been complying with the CAN-SPAM Act (the U.S. anti-spam law that has been in effect since 2003) you likely have implied consent from everyone on your list. If you’ve been auto-generating email addresses or otherwise using shady methods to build your email list, then you may not have implied consent and should stop emailing people who have not opted-in post haste (and also just stop doing this because its illegal and rather unpleasant as well).
Hell, even though you likely do have implied consent for everyone on your mailing list, you should still seek their express consent so you don’t have to worry about the clock running out on your ability to send them electronic messages, PLUS express consent is easier to prove.
Remember that YOU are responsible for showing that you have consent, so keep detailed records.
Step 3 – Cover Your Ass by Getting Express Consent from All Your Canadian Subscribers
The best way to comply with this law is to ask your Canadian subscribers, who have not already expressly opted-in to receive messages from you, for permission to continue to email them. A new request must comply with the CASL express consent requirements listed above. Here’s a sample message that complies with all of the express consent requirements under the CASL:

“Dear [Recipient's Name],
I want to send you messages about my business, products, services, and otherwise commercial awesomeness, so you’ll know when I have a special offer for you and so you’ll know the haps of what’s going on with my business on a weekly basis.
Click here if you’d like to receive these messages: [Link to your subscription form].
Sincerely,
[Insert Your Name]”

And then in the footer add:

“[Business name]
[Business address]
[Business phone number or email]
You can always unsubscribe by clicking here: [Unsubscribe link].”

You can send this to subscribers for whom you have implied consent to email (as discussed above).
Step 4 – Don’t Make People Jump Through Hoops to Unsubscribe
This one is actually simple — the CASL requires that all unsubscribe requests be processed within 10 days, ie, don’t be one of those a-holes that makes people click a link, log in, provide their birth certificate and driver’s license in order to unsubscribe. Just make it automatic and take effect instantly, upon request.
How long do I have to comply?
There is a three-year transition period from July 1, 2014 to July 1, 2017 which will give you time to make the required changes. That means you do not have to send an email to all of your Canadian subscribers today. You’ve got a whole 3 years to comply. During this time, you may continue to email anyone that has given implied consent (but don’t let it expire) or express consent. Various Canadian agencies may investigate non-compliance, and may levy hefty fines, so again … recordkeeping saves asses, friends. After 2017, individuals will have the right to sue organizations that send them unsolicited messages.

Got all that? Here’s the 4 steps again for quick reference:
Step 1 – Set up your email marketing system to ensure that accurate records are kept for all of your Canadian subscribers from now on.
Step 2 – Review your list to see if there are any Canadian subscribers who did not opt-in to your list. If there are, move on to Step 3. If there aren’t, congratulations, move on to Step 4.
Step 3 – Cover your ass by getting express consent from all your Canadian subscribers who have no opted-in before July 1, 2014.
Step 4 – Never make people jump through hoops to unsubscribe from your list and always process unsubscribe requests within 10 days.

While this is the toughest anti-spam law to date we, as small business owners and/or internet marketers, have been complying with these rules anyway because we follow basic laws of human decency and “netiquette” which makes emailing people who don’t want to hear from us a big “no no”. The main issue the CASL presents is that you have to be able to prove you have permission to email the people on your list. And that is the main reason to request express consent from your Canadian subscribers, who did not opt-in to your list before now.
This law is complicated and has other aspects to it that effect social media marketing and will affect mobile and web app developers in the future. If you are concerned about your compliance with CASL, schedule a consultation with an attorney.