CASL: Protecting the ‘Right to Privacy’ Around the Globe

The Canadian Anti-Spam Law (CASL), effective since July 1, 2014, is a robust privacy regulation designed to protect consumers and businesses from spam and digital threats.
CASL is part of a global effort to prioritize data privacy and address the misuse of technology. Compliance with CASL is mandatory if you send commercial electronic messages (CEMs) to Canadian residents or operate in Canada.

“Privacy is not an option, and it shouldn’t be the price we accept for just getting on the internet,” said Gary Kovacs in his TED speech ‘Tracking Our Online Trackers’. This highlights the essential role of privacy in safeguarding individual freedom and identity. Author Maritza Pick echoes this, describing privacy as “the freedom to be ourselves.”
Global awareness of data privacy increased dramatically after Edward Snowden exposed NSA surveillance programs. High-profile scandals like the Facebook–Cambridge Analytica case vividly demonstrated how political and commercial entities could misuse personal data.
These events spurred stricter privacy laws worldwide, including the EU’s General Data Protection Regulation (GDPR) and Canada’s CASL. While laws like the Privacy and Electronic Communications Regulations (PECR) and ePrivacy Regulation (ePR) have faded, GDPR and CASL now lead the charge, imposing heavy penalties for violations.

CASL stands out among global privacy laws for its stringent measures against spam and digital threats. Unlike GDPR, which harmonizes European privacy laws, CASL targets unsolicited electronic communications and malicious digital activities.

CASL at a Glance

CASL imposes significant penalties for non-compliance, including hefty fines and potential legal action, to ensure adherence to its regulations on electronic communications. These penalties apply to individuals and organizations that fail to follow the requirements for obtaining consent and managing unsolicited messages.

• Individuals: Fines up to $1 million per violation
• Companies: Fines up to $10 million per violation

Scope of CASL

CASL applies to any CEM sent from or to Canada. Certain CEMs are exempt, including:

• Messages between individuals with personal or family relationships
• Responses to recipient inquiries or requests
• Fundraising messages from charities or political organizations
• Messages sent in compliance with foreign privacy laws

Consent Requirements

CASL mandates that consent is required to send CEMs. It can be granted in the context of ongoing business or non-business relationships or expressed, and it requires clear, affirmative agreement from recipients, explicit information on the purpose and the sender’s contact details.

• Implied Consent: Granted in the context of ongoing business or non-business relationships
• Express Consent: Requires clear, affirmative agreement from recipients, along with explicit information on the purpose and the sender’s contact details

CASL’s Influence Beyond Canada

The implementation of CASL aligns with international trends to enhance privacy protections:

• GDPR (EU): Designed to harmonize European data privacy laws, GDPR has redefined global data-handling practices. Non-compliance can result in fines of up to €20 million or 4% of annual global turnover.
• Notable Cases: For example, in 2019, Google was fined $57 million under GDPR for failing to disclose how user data was collected across its platforms.

CASL and GDPR emphasize transparency, accountability, and respecting individual privacy rights.

Many recognize CASL as a robust framework that protects Canadians from spam and digital threats. The American Bar Association (ABA) has even described CASL as “the toughest anti-spam law in the world.” However, it’s important to note that CASL does not prohibit marketers from sending commercial messages. Instead, it establishes precise requirements for sending CEMs to an electronic address, ensuring a fair balance between marketing needs and consumer privacy.
Compliance with CASL is not optional for marketers—protecting privacy laws and maintaining trust is essential. At the same time, individuals play a crucial role in upholding these protections by respecting the principles behind such legislation and empowering them to take control of their digital privacy.
Aligning with privacy laws like CASL and GDPR is about more than avoiding penalties; it reflects a commitment to respecting the fundamental right to privacy while fostering accountability and transparency in digital communication.

Want to learn more about CASL? Explore these FAQs for additional facts and answers:

What is a Commercial Electronic Message (CEM)?

CEM is an electronic message promoting commercial activity, such as emails with promotions, sales, or coupons. Purely informational messages (e.g., order confirmations or updates) that lack promotional intent do not qualify as CEMs.

What are the unsubscribe rules under CASL?

Unsubscribe requests must be honored immediately or within 10 days. Organizations must provide a clear and accessible mechanism for recipients to opt-out, valid for at least 60 days after sending a message.

How does CASL affect marketing strategies?

Marketers must ensure:

• Obtain consent (express or implied) before sending CEMs.
• All CEMs contain the sender’s identification and an unsubscribe mechanism.
• Compliance records, such as consent logs and unsubscribe actions, are maintained.

What exemptions exist for CASL compliance?

CASL exempts messages:

• Shared between family or friends
• Shared internally within organizations or between organizations with an existing relationship
• In response to specific inquiries, complaints, or requests
• For fundraising by charities or political entities

What guidelines are available to help businesses comply with CASL?

The CRTC has issued several resources, such as:

• Guidelines for interpreting CASL regulations
• Tips for obtaining express consent
• Compliance program development templates

What are the steps to prepare for CASL compliance?

Preparation involves:

• Review communication practices and ensure compliance with consent requirements
• Auditing your CEM processes, policies, and systems
• Training staff on CASL compliance
• Keeping an audit trail as a defense against potential violations

What are the roles of enforcement agencies?

CASL is enforced by:

• The Canadian Radio-television and Telecommunications Commission (CRTC)
• The Competition Bureau
• The Office of the Privacy Commissioner

Are there specific provisions for businesses relying on referrals?

Under CASL, a business may send one initial message following a referral without prior consent if:

• There is an existing relationship between the referrer and the recipient.
• The message identifies the referrer and the sender and includes an unsubscribe mechanism.