CASL and review requests: texting and emailing customers in Canada

What is CASL and why does it matter for review requests?

CASL is Canada's anti-spam law, formally titled An Act to promote the efficiency and adaptability of the Canadian economy by regulating certain activities that discourage reliance on electronic means of carrying out commercial activities (S.C. 2010, c. 23). The government's CASL site says it focuses on commercial electronic messages, meaning messages that encourage participation in a commercial activity whether or not there is an expectation of profit, and that it asks businesses to obtain consent before sending them.

The rule itself is in section 6 of the Act. It says it is prohibited to send a commercial electronic message to an electronic address unless the recipient has consented, whether the consent is express or implied. The Act defines an electronic address as an address used for an email account, an instant messaging account, a telephone account or a similar account, and the government's compliance page tells businesses to make sure their commercial text messages comply with CASL.

This guide is general information and not legal advice. The law has exceptions and details this page cannot cover, so ask a lawyer about your situation.

Is a review request a commercial message?

The Act defines a commercial electronic message in section 1(2) by its purpose. A message counts if, having regard to its content, the links in it and the contact information in it, it would be reasonable to conclude that one of its purposes is to encourage participation in a commercial activity.

Whether your request meets that test is a question for a lawyer. As a precaution, treat every review request as a commercial message and follow the consent, identification and opt-out rules below.

What counts as consent to text or email a customer?

Consent comes in two kinds. Express consent means the person said yes, for example by ticking a box or telling you at the counter. When you ask for it, section 10(1) of the Act says you must set out clearly and simply the purpose for which consent is sought and prescribed information that identifies you.

Implied consent applies in listed situations, and an existing business relationship is one. Under section 10(10), an existing business relationship can arise from a purchase or lease within the two-year period immediately before the day the message was sent. A customer who paid you last month is inside that period, and a purchase from three years ago is outside it.

Do not skip the paperwork. Under section 13, a person who alleges they have consent has the onus of proving it. Keep a record of when and how each customer agreed, or of the purchase date that created the relationship.

What must each message include?

Section 6(2) of the Act asks for three things in every commercial electronic message.

• Who sent it. The message must set out prescribed information that identifies the person who sent it, and the person on whose behalf it was sent.
• How to reach you. The message must set out information that lets the recipient readily contact the sender.
• A way to opt out. The message must set out an unsubscribe mechanism that follows section 11(1).

The exact "prescribed information" is not spelled out in the Act, so check the regulations or ask a lawyer. The government's page on protecting your business and complying has more on texts.

How fast do I have to honor an unsubscribe?

Under section 11, the unsubscribe mechanism has to let the person say, at no cost to them, that they no longer want commercial messages from you, using the same electronic means the message was sent by or, if that is not practicable, another electronic means. It must give an electronic address or web page for the request, and that address or page must stay valid for at least 60 days after the message is sent.

You then have to give effect to the request without delay, and in any event no later than 10 business days after it was sent (section 11(3)).

What are the penalties?

Section 20 of the Act sets the maximum penalty at $1,000,000 for an individual and $10,000,000 for other persons, such as a company. These are the maximums; how a penalty is set in a given case is for the regulator and the courts.

What should my CASL checklist for review requests look like?

Use this before you send any request to a customer in Canada. It is our own practical checklist, not a legal opinion.

1. Decide who can be messaged. Customers who agreed in writing or out loud, and customers who bought from you in the last two years, are the starting point.
2. Record the proof. Store the date, the way they agreed or the purchase date, and who captured it.
3. Name your business in the first line, and give contact details a customer can reach.
4. Add a free opt-out to every message, and test it.
5. Act on opt-outs fast, well inside the 10 business day limit, and remove those people from every future list.
6. Do not message a purchased or scraped list.
7. Send the same request to every customer who qualifies. Google's content policy says businesses may not selectively solicit positive reviews.

The wording below is example text only. It is not legal wording, and using it does not show that a message meets CASL. Have a lawyer approve what you send.

Do other rules apply to review requests?

Yes. Rewards for reviews are a separate matter, which our guide to review incentive rules explains. The wording and timing of the ask is in our review request templates.

US texting rules are separate and not covered here. For the full routine, see our guide on how to get more Google reviews.