Email Marketing and Canada s Anti-Spam Law

Email Marketing and Canada s Anti-Spam Law Canada s Anti-Spam Law (CASL) is a strict law that applies to all email marketers sending messages to Canadian subscribers. An Act to promote the efficiency and adaptability of the Canadian economy by regulating certain activities that discourage reliance on electronic means of carrying out commercial activities and to amend the Canadian Radio-Television and Telecommunications Commission (CRTC) Act, the Competition Act, the Personal Information Protection and Electronic Documents Act, and the Telecommunications Act http://laws-lois.justice.gc.ca/eng/acts/e-1.6/page-1.html Email Marketing and Canada s Anti-Spam Law 1

Let s just call it CASL, shall we? Detailed regulations and steep fines accompany CASL. However, this new law shouldn t intimidate legitimate email marketers. This report explores CASL s details and how email marketers like you can prepare for compliancy with the new law. While CASL covers more than just email (SMS, IM, etc.), this report will focus on email only. Many questions still remain surrounding CASL. This guide aims to help you understand what s known for certain and what you can expect to see in the coming months. Regardless of the law, explicit permission-based emails produce the best results and deliverability. A CASL snapshot All electronic messages that originates in or goes to a recipient in Canada fall under CASL, regardless of intent. CASL covers all commercial messages, including transactional messages carrying commercial content. CASL requires marketers to obtain permission to send an electronic message to Canadian subscribers. Marketers must process unsubscribes immediately, unlike CAN-SPAM s 10-day grace period. Clear identification of the sender must accompany each message. Steep fines loom for those that don t comply. Regulatory agency enforcement will begin on July 1, 2014. The private right of action will be effective on July 1, 2017. Senders should now review practices and become compliant ahead of any enforcement date. 2 Email Marketing and Canada s Anti-Spam Law

Salesforce ExactTarget Marketing Cloud s best practices point marketers to the SUBSCRIBERS RULE! philosophy, which helps you stay compliant with Canada s new antispam law. ExactTarget Marketing Cloud is dedicated to helping you deliver permissionbased email and other forms of digital communication to your subscribers, customers, and partners. We believe that respect should govern the one-to-one marketing relationship that companies have with their subscribers and that subscribers must be given the means to dictate and control the manner and frequency by which companies can communicate with them. Our subscriber-centric philosophy is build upon three simple tenets: 1 2 3 Serve the individual. Honor each individual s unique preferences with regard to communication, content, frequency, and channel. Deliver subscribers timely, relevant content that improves their lives. Disclaimer We re not lawyers, and this isn t legal advice. When it gets down to very granular details of a specific process or situation, please consult a lawyer. We are not able to affirm specifically that clients are in compliance. We re only able to offer our own general thoughts on how we suspect that CASL will be handled. Final regulations for CASL have yet to be published, making this information subject to change. Email Marketing and Canada s Anti-Spam Law 3

Heads up, email marketers - it s coming! CASL will be implemented in three stages: The majority of the regulations come into force on July 1, 2014, the rules that apply to computer programs come into force on January 15, 2015 and private right of actions come into force on July 1, 2017. But why not get ready NOW? There s no time like the present to ensure that you re fully compliant with CASL. This report is divided into three sections to help you and your organization prepare and make necessary changes to become CASL-compliant: 1. Part One: Getting Familiar with CASL 2. Part Two: The Finer Nuances of CASL Compliancy 3. Part Three: Frequently Asked Question and Additional Resources 1 Getting familiar with CASL This section will give you a little background on the who, what, where, and when of CASL, including: A little CASL history What we know for sure about CASL Who must comply with CASL 4 Email Marketing and Canada s Anti-Spam Law

A little CASL history The evolution of CASL. CASL has been a long time in the making. Different versions and bills have been through Canadian Parliament to finally give way to what we know today as CASL. December: Fighting Internet and Wireless Spam Act Bill C-28: [http://fightspam.gc.ca for full report] March: CRTC publishes clarifying regulations.industry Canada to publish clarifying regulations. December: Industry Canada to publish final regulations. February: CASL regulations on computer programs come into force. 2005 2006 2007 2008 2009 2010 2011 2012 2013 2014 2015 2016 2017 The Canadian Task Force on Spam is convened by the Minister of Industry, calling together multi-stake holders, such as ISPs, law enforcement, regulators, marketers, and consumer advocates. All had their say on this task force, concluding that Canada needed an anti-spam law. May: Email Marketers Best Practices published by Industry Canada. Canadian government announced Bill C-27, also known as the Electronic Consumer Protection Act. The bill died during prorogation of parliament. August: Government Request for Information and Commentary. The government reviewed feedback but wasn t obligated to make changes. Final Regulations provided by Industry Canada and CRTC. October: ExactTarget Marketing Cloud launched a webinar to review CASL details. July: CASL comes into force. July: Private right of action begins. Email Marketing and Canada s Anti-Spam Law 5

What we know for sure about CASL It s here Regulatory agencies charged with enforcing CASL have released their standards and will begin enforcing the law in July, 2014. It will be enforced, especially with much overlap and competition between the three Canadian regulatory agencies: Canadian Radio- Television and Telecommunications Commission (CRTC), Office of the Privacy Commissioner, and Competition Bureau. The CRTC and Competition Bureau have even hired investigators to ensure CASL is enforced. Generally, this is our understanding of jurisdiction by each governing agency: Enforcement and Jurisdiction Regulatory Enforcement Agency Expected Jurisdiction Administer of Monetary Penalties (AMPS) Canadian Radio-Television and Telecommunications Commission (CRTC) Gray mail spam Maximum of $1 million for individual defendants, $10 million for organizations per violation. Office of the Privacy Commissioner Privacy violations, using email addresses without consent, list purchases, scraping lists, etc. No new authority to levy AMPs outside of PIPEDA or the Privacy Act. Competition Bureau Bot nets, elicit and deceptive trading by email The private right of action is capped at $200 per email, up to $1 million per day. 6 Email Marketing and Canada s Anti-Spam Law

Regulatory Enforcement hopes that the steep charges will act as a deterrent from unscrupulous electronic messages. Again, CASL should be no threat to legitimate email marketers sending permission-based messages. The Canadian regulatory agencies can go after organizations and individuals within an organization. Who must comply with CASL? CASL should be no threat to legitimate email marketers sending permission-based messages. CASL covers any message that originates in or goes to a recipient in Canada regardless of intent. This applies to the US, Russia, Vietnam, etc. So, should you ask your audience to self-profile themselves as Canadian? Collecting your subscribers demographic information is always a good idea. However, a subscriber can easily say that they are or are not Canadian. But, if the subscriber is in fact Canadian, they re protected by CASL. More important than profiling your subscriber, your best bet is to get permission to email them in the first place. Any and all domains fall under this new law (not only.ca, but.com as well). Any domain with a Canadian subscriber is covered by CASL Follow the money regime. A marketer sending on behalf of a brand could be responsible. Marketers need to be very clear who is sending the message. ESPs such as ExactTarget Marketing Cloud must comply, too. Canadian recipients of unwanted messages have Private Right of Action. Individuals can sue for $200 per email received. An individual must file a claim in federal court. And, fees are very high to do so. Also, filing in federal court requires a lawyer. It ll cost a pretty Canadian penny to file an individual CASL claim. Due to the high court costs, class action law suits are most likely. Canadian federal court supports a Loser Pay Regime, in which a loser pays 60-70% of opposition s court costs. Significant money up front to cover court costs will hopefully prevent spurious class action law suits that aren t well founded. This is a protection for legitimate marketers from fruitless suits. Email Marketing and Canada s Anti-Spam Law 7

2 The finer nuances of CASL compliancy In this section, we will dig into the finer details of CASL and help you identify what changes you and your organization should put in place, including: Key CASL points for email marketers Implied consent vs. express consent How to prepare for CASL compliancy Key CASL points for email marketers CASL is broad and covers more than email. Thus, no bulk distinction exists in the law even one-to-one marketing messaging must comply. Due Diligence Defense If you can demonstrate that best practices are in place for your email policies, this will likely be a reasonable defense against CASL claims. Identify Sender CASL requires the sender s name and postal address. If the message is sent on behalf of another person, that person must be identified as well, along with a statement indicating which is which. Simple Unsubscribe Process An unsubscribe link or process must stay active for 60 days post-mailing. It s acceptable to offer the option to reply to unsubscribe or click here to unsubscribe either is compliant with CASL. Any web-based unsubscribe mechanism must be able to be readily performed. We strongly recommend that no more than two clicks be required to perform the unsubscribe request. And, you can t block the process with a login firewall similar to CAN-SPAM. Separate the unsubscribe process from profile center a best practice for all marketers. CASL s unsubscribe clause differs from CAN-SPAM s 10-day grace period to handle unsubscribes. CASL s is immediate, without delay. 8 Email Marketing and Canada s Anti-Spam Law

Transactional Messages We re still hoping for better clarification in upcoming regulations on transactional messages. What we do know is that transactional messages must have an unsubscribe link. If you have a reason to send someone a transactional message, you may do so even if they ve unsubscribed previously. For example, if a customer made a purchase from your site, you can send them a receipt for the purchase regardless of whether they unsubscribed from your marketing messages. However, you must be careful to not include additional content that would promote commercial activity. Give clear notice and describe what you re doing. Set proper expectations, and you re likely going to be okay under CASL. Express consent vs. implied consent At ExactTarget Marketing Cloud, we ve always believed in staying true to permission. Our school of thought? If there s not a request for consent, it s not consent. Here, we ll explore our best understanding of CASL s stance on express consent vs. implied consent. CASL hasn t defined express consent clearly. Future CASL litigation will likely shape a clear definition. Give clear notice and describe what you re doing. Set proper expectations, and you re likely going to be CASL-compliant. Express consent doesn t expire. Under CASL, implied consent expires after two years. Questions about implied consent nuances will probably be answered through litigation. Implied consent covers existing business relationships. If you re going to try to make implied consent workable, you ll need to track the rolling window of when the subscriber relationship commenced. Then, you must get express consent moving forward. A practical concern with implied consent is that subscribers will end up on lists without knowing it resulting in the majority of spam complaints. Implied consent isn t compatible with ExactTarget Marketing Cloud s permission requirements. As it was explained to us, in the case of an email address published on a website without a prohibiting statement, it may be legal to send on-topic email marketing messages to that address. However, this is not compatible with ExactTarget Marketing Cloud s rule. This loophole addresses one-to-one, B2B instances, allowing for reasonable contact. It doesn t allow for address harvesting or list building. Burden of proof. Burden falls on the sender to prove consent to email the recipient. In sending a request for consent, it s classified as a commercial message and falls under the law. This is compatible with ExactTarget Marketing Cloud requirements, which contractually require clients to be able to provide proof of consent. Another best practice for CASL lies in maintaining records on how you collect consent origination IP, date and time stamp, and record sign-up pages with disclosure. Marketers with opt-in practices in place will be in compliance with CASL and its consent requirements. Email Marketing and Canada s Anti-Spam Law 9

How to prepare for CASL compliancy If you haven t already, it s time to adopt opt-in email practices and policies. As mentioned earlier, follow the guidelines of Subscribers Rule! Regardless of the law, explicit permission is the best practice and produces the top results and deliverability. Honor subscribers preferences including frequency and content. And, always stay true to permission! In addition, ExactTarget Marketing Cloud s Anti-Spam Policy and the following best practices from Canada s Task Force on Spam outline clear ways to become CASL compliant: 1. Marketing emails should only be sent to recipients who have provided their consent to receive such information. 2. In all marketing emails, recipients must be provided with an obvious, clear, and efficient email or web-based means to opt out of receiving any further business and/or marketing email messages from the organization. 3. The internal process used to obtain consent should be clear and transparent. Organizations should keep records of the type of consent obtained from recipients so that email lists can be scrubbed prior to campaign broadcasts. 4. Every email marketing communication should clearly identify the sender of the email. The subject line and body text in the communication should accurately reflect the content, origin, and purpose of the communication. 5. Every email should provide a link to the sender s privacy policy. The privacy policy should explain the intended use and disclosure of any personal information that might be gathered through clickstream means or other website monitoring techniques. 6. Marketers, list brokers, and list owners should take reasonable steps to ensure that the addresses on their email lists were obtained with the proper consent. 7. Marketers should use a high degree of discretion and sensitivity in sending marketing emails to persons under the age of majority, in order to address the age, knowledge, sophistication, and maturity of this audience. 8. (a) When the content of an email is adult in nature, the sender must verify that the recipient is of age to legally receive and view such content prior to sending the communication. (b) All email containing sexually explicit content should include the prefacing tag SEXUALLY EXPLICIT in the subject line. 9. Organizations should have in place a complaint-handling system that is fair, effective, confidential, and easy to use. 10. Organizations may disclose the email addresses of existing customers to third-party affiliates or within a family of companies if: They have consent to do so They are using the addresses for purposes consistent with their collection (i.e. for marketing related to the original purchase or to provide services related to that purchase) It is transparent to the recipient why they are receiving email communications There is an easy-to-use way to opt out of receiving further email communications These best practices are found at http://www. ic.gc.ca/eic/site/ecic-ceac.nsf/eng/gv00330. html 10 Email Marketing and Canada s Anti-Spam Law

CASL is a good thing - legitimate marketers called for CASL It s important to point out that legitimate marketers favor antispam laws and have influenced the formation of CASL. The 2005 report Stopping Spam: Creating a Stronger, Safer Internet from Canada s Task Force on Spam states: Increasingly, internet service providers (ISPs) and email service providers (ESPs) are looking for ways to stop spam by using filtering and black and white lists. As a result, they are inadvertently blocking legitimate email messages before they reach their intended recipients. Organizations are encouraged to adopt the best practices cited here as a way to ensure that their own legitimate email messages reach their intended recipients. What happens if... Oops. We accidentally sent an unsolicited message to a Canadian subscriber. Relax. Take a deep breath. CRTC and Competition Bureau have a process called an undertaking. Mistakes and errors occur. When this happens, marketers can and should preemptively say, Oops. We made a mistake and won t do this again. Technical errors occur. Flat fines may be applied to such situations. But, if you show good faith to not repeat them, you ll be in good standing. Of course, we should all be careful about errors. Regulations commissions have said that they have no interest in interfering with legitimate marketers. Email Marketing and Canada s Anti-Spam Law 11

CAN-SPAM vs. CASL CAN-SPAM (USA) CASL (Canada) Not an opt-in law; allows for spam Opt-in required (Express Consent) Primary Purpose standard. Transactional messages do not require Unsubscribe. Any commercial content makes a message commercial. If a transactional message has a side note of commercial content, it s commercial. Unsubscribe life: 30 days Unsubscribe life: 60 days Marketer has a 10-day grace period to process unsubscribe. Marketer must immediately process unsubscribe without delay. Very limited almost no Private Right of Action Has Private Right of Action 12 Email Marketing and Canada s Anti-Spam Law

3 Frequently Asked Questions and Additional Resources When will CASL take effect? July 1, 2014. Frequently Asked Questions Should I request users to self profile themselves as Canadian? Ultimately, US-based companies may still have to comply if emailing Canadian subscribers who present a risk of providing false information about their location. However, as long as you stick to true permission (optin) globally, the concern and risk is minimal. How does CASL apply to list purchasing and email append? Right now, these practices appear to be incompatible with CASL s consent requirements. Should I segment by country? It can t hurt, but we ve also heard some warnings that the regulators may take a dim view of someone who s only trying to dodge responsibility for compliance by segmenting. Our recommendation is to stay true to permission, ensuring that your marketing efforts comply regardless of segmentation. How does CASL address forward to a friend and send to my network inducements? Any inducement, no matter how small, would likely be enough to bring liability under CASL. Is there legacy for existing lists? Express consent obtained before CASL comes into force that is compliant with PIPEDA will be considered compliant with CASL. Email Marketing and Canada s Anti-Spam Law 13

What s needed on a registration page? A registration page should include five elements: 1. A request for the name of the person or entity seeking consent. 2. The name which a person or entity carries on business (if the consent is sought on behalf of another person or entity). Note: while this process can be made legally compliant, it may not be compatible with ExactTarget Marketing Cloud policy. 3. A statement indicating which person is seeking consent and which person on whose behalf consent is sought (if consent is sought on behalf of another person or entity). Note: while this process can be made legally compliant, it may not be compatible with ExactTarget Marketing Cloud policy. 4. The mailing address and either a telephone number, email address, or web address of the person or entity seeking consent or the person or entity on whose behalf consent is sought. 5. A statement indicating that the person whose consent is sought can withdraw their consent. Is receiving personal business cards or collecting a list of conference attendees considered consent? Probably not. The consent requirement stipulates that the recipient knows exactly what they re getting into. Are not-for-profits organizations required to comply with CASL? Non-profits are only exempt from CASL s requirements when sending fundraising messages. Do it now! Adjust your practices now so you re not on the Canadian government s radar when this law takes effect. If you re looking to push the line on CASL, ask yourself: Have I built into my budget the litigation costs to answer definitively if a particular practice is allowed? 14 Email Marketing and Canada s Anti-Spam Law

Suggested Resources ExactTarget Marketing Cloud Blogs http://blog./blog/al-iverson http://blog./blog/mickey-chandler Shaun Brown http://www.nnovation.com http://nnovation.com/blog/ Michael Geist s Blog http://www.michaelgeist.ca/ Email Sender and Provider (ESP) Coalition http://www.espcoalition.org/ ExactTarget Deliverability on Twitter @etdeliv Call us at (866) 558-9834 or visit www. ExactTarget.com to learn more today. Email Marketing and Canada s Anti-Spam Law 15

Relevant, Targeted Messages. Create a unified 360-degree view of each customer! 16 Email Marketing and Canada s Anti-Spam Law