Beware: Canada’s New Anti-Spam Law Applies to U.S. Companies

Written by A. Brian Dengler@ABrianDengler10 years ago

Share Tweet

Canada’s tough, new anti-spam law is in force. You can face hefty fines if you do not comply with the law the next time you send any promotions by email, text or social media to Canadian users. The bottom line is that the law requires businesses to obtain consent before sending a commercial electronic message to a Canadian user. This differs from the USA approach of giving users the ability to opt-out of messages. 

Canada’s Tough, New Anti-Spam Law

The new law took effect on July 1, 2014, which is designed to protect individuals and businesses from harmful and misleading online threats when using an electronic device, such as a mobile phone, smartphone, tablet, or computer. “Canada’s anti-spam law will put the interests of consumers first while ensuring that Canadian businesses can continue to thrive in the online marketplace,” said Industry Minister James Moore. Penalties are steep: Up to $10 Million per organization, or $1 Million per individual.

The law applies to any commercial electronic message (CEM), defined as “encouraging participation in a business transaction or activity, regardless of whether there is an expectation of profit.” A CEM includes emails, text messages, and social media messages. The law applies to any CEM sent to Canadian users, even if the message comes from the USA.

The new law prohibits:

• Sending a CEM without the recipient’s express or implied consent. This includes messages to e-mail addresses, and text messages to a cell phone. 

• Sending a CEM without fully identifying the sender.

• Making false or misleading electronic representations in the promotion of products, services or business interests.

• Sending a CEM without a clear way and means for the recipient to unsubscribe.

• The installation of computer programs on another person’s computer system without the express consent of the owner of the computer system or their agent, such as an authorized employee.

• The collection of personal information by accessing a computer system in violation of the Criminal Code of Canada.

• Collection of electronic addresses by the use of computer programs, or the use of such addresses without permission, a practice known as “address harvesting”.

How to Comply with the New Anti-Spam Law

Here is an example provided by the Commission. [Photo Credit: Canadian Radio-television and Telecommunications Commission]

The anti-spam law empowers the Canadian Radio-television and Telecommunications Commission (“Commission”) to regulate
CEMs. The regulations interpret the law as requiring companies to get separate, expressed consent to send a CEM. This is an “opt in” process. The Commission believes that combing consent for CEMs with acceptance for Terms of Service would not comply with the law. Instead, you must have the user (a) agree to the TOS and (b) separately assent to receive CEMs.  

In other words, the user should have the ability, for example, to accept the terms of the TOS but reject giving permission to take CEMs. The Commission recommends that the user be required to check a separate box to provide consent.

For express consent, the request must:

• Identify the request for consent in a “positive or explicit” manner – the person would need to perform an affirmative act such as checking a box – pre-checked boxes or an opt out system are not acceptable;
  
• State the purpose for which the consent is sought;
• Identify and provide the business name of the person seeking consent and, if different, identify and provide the business name for the person on whose behalf consent is sought;
• Provide the mailing address for the sender and one or more of the following: telephone number, website or email address for the person or entity seeking the consent; and
• State that consent may be withdrawn.
• CEMs must have an unsubscribe link.

What Are the Exceptions to the Anti-Spam Law?

The consent requirement does not apply to an inquiry relating to the recipient’s own commercial activity. For example, opt-in consent is not needed for emails that:

• Provide quotes or estimates sent to someone who has requested it;
• Complete commercial transactions; 
• Provide warranty, product recall or safety information;
• Notify the recipient of factual information about an ongoing product, service, subscription, membership, account, etc.; 
• Information directly related to an employment relationship; or
• Deliver a product, good or service (including product upgrades) if the recipient was entitled to receive it. 

Is There a Grace Period?

The law offers a short grace period for relationships that you may have established before July 1, 2014. Where there is an existing business or non-business relationship, consent is implied for the first three years. In other words, as long as the organization has implied consent, it effectively has until 2017 to upgrade to an express consent. However, any user has the right to withdraw consent at any time. Business relationships must be current, that is a relationship that has been active for no more than two years. You should purge stale entries. 

What Steps Should You Take Now?

Here are steps that you can take to comply with the new law:

• Check your marketing lists for Canadian addresses, segregate those addresses from the rest, identify which are current members or have been members within the last two years, and flag non-members within the two year window.

• You must obtain separate, written consent from anyone who signs up for your service after July 1, 2014. For those individuals residing in Canada for which you cannot establish either express or implied consent, such individuals may only be contacted by telephone or mail to obtain their consent to receive CEMs. The sending of a request for consent via email to new users after July 1 would be considered a violation of the law. 

• Be leery on using third party mailing lists, unless the provider can back up that the mailing list contains users who have opted into to receiving CEMs.