What is CASL, and what does it mean for a website contact form?

Express versus implied consent

Express consent is somebody actively agreeing, and it does not expire until it is withdrawn. Implied consent comes from an existing relationship, and it does expire: two years after a purchase or the end of a contract, six months after an enquiry. A contact form submission is an enquiry. Answering it needs no consent, because a reply to a request is exempt. The six months that follow allow other commercial email too, but a quarterly newsletter for the next four years needs the person to opt in.

Why the pre-checked box fails

Express consent has to be opt-in. A newsletter checkbox that is ticked by default, or consent bundled into terms the visitor has to accept to send the form at all, is not consent under the law. An unticked box is, as long as the wording next to it says what the emails are for, who is sending them, and that the person can withdraw at any time. It costs almost nothing in submissions.

What every commercial message has to carry

The sender's name, a mailing address, and one other contact method such as a phone number, email address, or web address. A P.O. box counts as a mailing address, and nothing requires it to be Canadian. Plus an unsubscribe mechanism that is easy to use and stays functional for at least sixty days after the message goes out. Requests have to be honoured within ten business days.

The scale of the penalties

Up to one million dollars per violation for an individual and ten million for a business. The CRTC's published enforcement actions include individuals as well as large companies, and the rules apply the same way at any size. Buying a list of addresses is the fastest route into trouble.