Legal Definitions - Canadian Anti-Spam Law of 2010: Opt-in Framework (Prior Consent)

The Canadian Anti-Spam Law of 2010: Opt-in Framework (Prior Consent), often referred to as CASL, is a significant piece of legislation designed to protect Canadians from unwanted commercial electronic messages. At its core, the "opt-in framework" means that businesses and organizations generally need to obtain a person's explicit permission before sending them commercial electronic messages (CEMs), such as emails, text messages, or messages sent through social media.

This law establishes a default requirement for prior consent, meaning the recipient must have agreed to receive messages from the sender before any commercial electronic message is sent. However, CASL also recognizes situations where consent can be implied or where certain types of messages are entirely exempt from the consent requirement.

• Express Consent: This is the strongest form of consent and is generally required. It means the recipient has taken a clear, affirmative action to indicate their permission. For example, they might check an un-ticked box on a website, sign up for a newsletter, or verbally agree to receive messages. The request for express consent must clearly state the purpose for which consent is being sought and identify the sender.
• Implied Consent: In certain circumstances, consent to send commercial electronic messages can be implied based on an existing relationship or actions taken by the recipient. This includes:
  • An existing business relationship (e.g., a customer who has purchased a product or service from you within the last two years).
  • An existing non-business relationship (e.g., a member of a club or a donor to a charity within the last two years).
  • When a person has conspicuously published their electronic contact information (e.g., on a company website) without stating they don't want unsolicited commercial messages, and the message is relevant to their business or official role.
  • When a person has disclosed their electronic contact information directly to the sender without stating they don't want unsolicited commercial messages, and the message is relevant to their business or official role.

  Important Note: Even with implied consent, any commercial electronic message sent must still include an "unsubscribe" or "opt-out" mechanism, allowing the recipient to easily withdraw their consent at any time.

• Exempt Messages: Some types of electronic messages are entirely exempt from the consent requirements because they are considered transactional, informational, or necessary for an ongoing service. These include messages that:
  • Provide a requested quote or estimate.
  • Facilitate, complete, or confirm a transaction the recipient has entered into.
  • Provide warranty, product recall, or product safety information for a product the recipient has purchased or is using.
  • Provide factual information about an ongoing service relationship (like a membership or subscription).
  • Relate directly to an employment relationship or employee benefit plan.
  • Deliver a product or service, including updates or upgrades, that the recipient is entitled to receive based on a previous transaction.

Examples:

• Example 1 (Express Consent): A new online yoga studio wants to send weekly emails about class schedules, promotions, and wellness tips. When a potential student visits their website, they see a pop-up asking, "Want to stay updated on our latest classes and special offers? Enter your email here!" Below the email field, there's an unchecked box that says, "Yes, I agree to receive promotional emails from [Yoga Studio Name]." Only individuals who actively check this box and submit their email address will receive marketing communications. This demonstrates the requirement for express consent before sending commercial electronic messages.

• Example 2 (Implied Consent - Existing Business Relationship): A local appliance store sends an email to customers who purchased a refrigerator from them six months ago. The email announces a new line of energy-efficient washing machines and offers a discount code. Since these customers have an "existing business relationship" (they made a purchase within the last two years), the store has implied consent to send them relevant commercial electronic messages. However, the email must clearly include an "unsubscribe" link, allowing recipients to easily opt out of future promotional emails if they wish.

• Example 3 (Exempt Message): A company that sells smart home security systems sends an email to all its customers informing them about a mandatory firmware update for their installed cameras. This update addresses a newly discovered vulnerability that could compromise their system's security. This message is exempt from the consent requirements because it provides critical product safety information and an update for a product the recipient has purchased, making it a necessary service communication rather than a commercial solicitation.