A G U I D E T O C A N A D A ’ S A N T I - S P A M L A W C A K E M A I L 2 0 1 4

TABLE OF CONTENTSI N T r O D U C T I O N : W h A T E v E r y M A r K E T E r N E E D S T O K N O W 3

D O E S C A S L A P P L y T O M E ? 4

W h A T I S A “ C E M ” ? 5

W h E N W I L L C A S L C O M E I N T O f O r C E ?

W h A T A r E T h E r E q U I r E M E N T S O f C A S L ?

C A S L A N D C A N - S P A M

C O N S E N T 6

W h A T I S “ E x P r E S S ” C O N S E N T ?

W h A T I S “ I M P L I E D ” C O N S E N T ?

h O W C A N I P r O v E C O N S E N T ? 7

W h A T S h O U L D I D O T O P r E P A r E ? 8

P E N A L T I E S & E N f O r C E M E N T 9

C O N C L U S I O N

h O W C A N I r E P O r T S P A M ?

D I S C L A I M E r 1 0

r E S O U r C E S

L E G A L

A b O U T C A K E M A I L

“C A N A di A N S w iL L N O w BE A BL E T O EN jOy A N ONL iNE EC O S yS T Em p rO T EC T Ed By C A SL”

— N E I L S C h W A r T z M A N , E x E C U T I v E D I r E C T O r O f C A U C E

I N T r O D U C T I O N : W h A T E v E r y M A r K E T E r N E E D S T O K N O W

If you are confused by Canada’s new Anti-Spam law - you are not alone.

CASL has taken close to a decade to come to where it is today and was never meant to stifle legitimate businesses in Canada. This new legislation touches on all aspects of digital communication, including social media, cellphone and email in a “technologically neutral” approach. At its core, CASL is simply a way for Canadians (and those marketing to Canada) to promote e-commerce while reducing the amount of spam, spyware/mal-ware, phishing and identity theft.

This guide will focus on the application of CASL in relation to email mar-keting, and provides an easy way to understand what changes (if any) you need to implement to your email marketing efforts in to order comply with this new legislation.

— 3 —

D O E S C A S L A P P L y T O M E ?

This is the first question you must ask yourself and the short answer is :

C A S L w i L L A p p L y T O A N y C O m m E r C i A L E L E C T r O N i C m E S S A G E S ( C E m S ) w H E r E

A C O m p U T E r S y S T E m L O C A T E d i N C A N A d A i S U S E d T O S E N d O r A C C E S S

T H E E L E C T r O N i C m E S S A G E .

If you own or operate a business in Canada, or if you have emails on your list ending in “.ca” - chances are pretty good that CASL applies to you. If you are sending from outside of Canada, and the recipients are not accessing your message in Canada, CASL does not apply. However, you must still adhere to the rules and regulations of the foreign state in which you live. For a complete list of foreign states that currently have Anti-spam legislation, see here : http://kb.cakemail.com/en/deliverability/what.spam.laws.should.i.follow/

i F y O U A r E N O T C E r T A i N T H E r E C i p i E N T S O N y O U r L i S T A r E A C C E S S i N G

T H E i r E m A i L S F r O m C A N A d A , i T i S U p T O y O U T O F i N d O U T .

The country in which your recipients are accessing the emails you send them is valuable information, and now it could help you make sure you comply with this new law. If you don’t have it, make sure you send a campaign to get it. IP address Geolocation is another useful tool, but don’t rely on this method alone as people may be travelling to Canada.

— 4 —

W h A T I S A “ C E M ” ?

As defined by the law, a CEM is any electronic message that “encourages participation in a commercial activity” regardless of whether there is an expectation of profit.

W h E N W I L L C A S L C O M E I N T O f O r C E ?

The date of enforcement for Canada’s Anti-Spam Law (CASL) is july 1st

2014, but there will will be a 3-year transitional period in which you will be permitted to continue sending CEMs to existing customers. This means you have until july 1st, 2017 to acquire “Express” consent for customers that are on your list through an existing business relationship.

W h A T A r E T h E r E q U I r E M E N T S O f C A S L ?

ConsentIf you are sending CEMs to anyone accessing their emails in Canada, you need to make sure you have consent to do so (either "Express or "Implied").

identification

The sender must be clearly identified and include a valid Postal Address, and either a telephone number, email address, or website, which must be valid for a minimum of 60 days after the message has been sent.

Unsubscribe

You must include a functional and visible unsubscribe mechanism. It must be valid for a minimum of 60 days after the message has been sent. The unsubscribe request must be processed without delay and must be processed within 10 business days. The recipient must not be asked to provide any information other than their email address.

C A S L A N D C A N - S P A M

The biggest difference between CASL and the CAN-SPAM Act in the US is that Canada requires consent. In other words, while sending to purchased or rented lists is not a violation of CAN-SPAM, it is a direct violation of CASL and will not be permitted. For this reason, the remainder of this guide will focus on making sure you have proper consent.

— 5 —

C O N S E N T

W h A T I S “ E x P r E S S ” C O N S E N T ?

In order for it to be deemed “Express” consent, the individual must take affirmative action to “opt-in” to your list willingly.

You must ask yourself : did the recipient say “yes” to receive my CEm?

C O N S E N T = P E r M I S S I O N

W h A T I S “ I M P L I E D ” C O N S E N T ?

“Implied” consent is when a relationship exists, but the recipient is added to your list without any affirmative action. Situations in which consent is implied are specifically set out in section 6 of CASL and its regulations.

Note : A message sent seeking consent (such as a Confirmation email) is also considered a CEM and must therefore comply with all the requirements of CASL. Most senders will need to acquire “Implied” consent (for example by making a purchase, or acquiring a business card at a trade show) prior to sending the confirmation email.

Note : Express and implied permission can be removed at all times by the recipient through the unsubscribe mechanism.

— 6 —

h O W C A N I P r O v E C O N S E N T ? If required, you need to be able to provide proof of opt-in for every address on your list. If you are not keeping track of this data, it’s time to start - the law has made it clear that it’s the sender’s responsibility to provide proof.

C O N S E N T U N D E r C A S L

E x A M P L E 1

Someone fills out a form on your website with the intent of being placed on your list. A confirmation email is sent which requires the recipient to click a link in order to confirm that they wish to be placed on the list. When they click the link, the date/time and IP stamp would be recorded as follows :

Name : Kevin Huxham

Email : kevin@mydummyaccount.com

SignupDateTime : 2013-04-21 21:16:58.090 EST

IP : 67.123.234.123

Host : mx3.mydummyaccount.com

The form could also be set up to request the following :

Address : 4020, St. Ambroise, #301

City : Montreal

Prov/State : Quebec

Country : Canada

Postal : H4C 2C7

Phone : 555-555-5555

E x A M P L E 2

A person gives you their business card at a trade show with the intent of being placed on your list. The problem with this is you need to be able to prove you didn’t pick it up off the floor of the men’s room. Ideally, a con-firmation email would be sent at (or shortly after) the event requesting confirmation (where the above information could be recorded). “Express” consent could be proven if you had the recipient provide his consent to be placed on your list on the back of the card. It would then be necessary for you to keep the card as proof.

E x A M P L E 3

A person gives you their email address over the phone with the intent of being placed on your list. The same process of sending a confirmation email applies, but “Express” consent could be proven IF you recorded the conversation for each recipient.

E x A M P L E 4

The recipient provides their email address to the sender at checkout after making an online purchase. IF this is accompanied by a clear statement that requires affirmative action (such as by having the recipient check an empty box that states “Yes, please sign me up to receive your newsletter”) it would be deemed “Express” consent under CASL. IF NOT, it would fall under the category of “Implied” consent and would give the sender a period of 24 months to send CEMs and/or acquire “Express” consent so long as they keep the record of purchase and can prove a business relationship exists.

Note : “Express” consent never expires, unless recipient requests to be removed.

— 7 —

E x A M P L E 5

If someone expresses interest in your business as part of the sales process or enters their email address on your website to download educational material (like this whitepaper), they are to be considered “prospects” and “Implied” consent is given to send CEMs for a period of 6 months only.

E x A M P L E 6

The recipient is added automatically or is required to uncheck a box to opt-out during the checkout process. This method is not considered “Express” consent under CASL and will typically generate a large volume of emails flagged as spam which negatively affects your reputation as a sender and, in turn, your delivery.

E x A M P L E 7

Affiliate lists are the result of one company sharing an email address (or a list of addresses) with another. If a person signs up to receive emails from Company A, they should receive emails from Company A only (unless stipulated separately during the opt-in process). If they also receive email from Company B, C, and D, they will be more likely to complain.

Under CASL, Company A must clearly show to the recipient that they are signing up to these “unknown 3rd party list(s)” and all parties are accountable for managing that consent. The person who obtained consent must be clearly identified and if a recipient no longer wishes to receive emails from Company B, it is Company A’s responsibility to inform and withdraw consent from Company C, D within 10 business days.

W h A T S h O U L D I D O T O P r E P A r E ?

D O E S C A S L A P P L y T O y O U ?

Audit of all online communications (Newsletters, Transactional, SMS/MMS, Social Media): are they covered by CASL?

Are the emails you send accessed in Canada?

C r E A T E C O M P L I A N C E & r E A D I N E S S T E A M ( S )

Learn everything you need to know about CASL

Build education and awareness internally (from intern to CEO)

Update required documents (Privacy Policy, Sign-up forms, Terms)

Ensure current/future contracts, processes are compliant

Create roadmap and start update process

E x A M I N E C U r r E N T L E v E L S O f C O N S E N T

Do you have “Express” or “Implied” consent for each contact?

Burden of proof : make sure you can prove consent

Identify input sources (Points of Sale, Call Center, Web, Social, Events, 3rd Party signups...)

— 8 —

Use the 3 year transition period to obtain “Express” consent from all contacts

C O N T E N T A N A L y S I S

Clearly identify yourself with a valid Postal address

Provide an unsubscribe mechanism in every CEM

M A N A G E y O U r C O N T A C T L I S T

Identify gaps in list data: Consent date, consent level, source IP/host, current status

Create a centralized database and keep things clean

Be able to process and act on all unsubscribe requests

L I A b I L I T y

Review 3rd party contracts

Work vicarious liability into all employee contracts, adopt compliance policies and sanctions for employees who do not comply

Should you get insurance?

Obtain legal advice – choose a lawyer that respects and understands CASL

P E N A L T I E S & E N f O r C E M E N T

The enforcement of CASL will be done primarily by the Canadian Radio-television and Telecommunications Commission (CRTC) and the penalties involved are generally as follows :

Violation penalty/Fine/Offenceprivate

right of Action

Sending unsolicited commercial e-messages Maximum per breach :

$ 1,000,000 for individuals

$ 10,000,000 for corporations

$ 200/day per breach, not to exceed $ 1,000,000/day

Altering transmission data Up to $ 1,000,000/day

Unsolicited installation of computer programs

Up to $ 1,000,000/day

Making false and misleading representations in e-messages

Up to 1 year imprisonment and up to $ 200,000 in fines (on summary conviction)

Up to 14 years imprisonment and a fine at the Court’s discretion (on indictment)

$ 200 for each occurrence, not to exceed $ 1,000,000/day

Collecting e-addresses using computer programs

Maximum per breach :

$ 1,000,000 for individuals

$ 10,000,000 for corporations

Maximum of $ 1,000,000/dayCollecting personal information through unauthorized access to a computer system

Note : A Private Right of Action will come into effect July 1st, 2017 that will allow class action lawsuits to be filled by anyone against senders that do not comply with CASL.

— 9 —

C O N C L U S I O N

Canada’s new Anti-Spam Legislation is revolutionary in scope. In order for CASL to target the most egregious offenders, it will require the coopera-tion of foreign governments - something the CRTC has made sure of from the beginning. CASL doesn’t have to be scary, most email marketers are already doing what they need to comply, they just need to make sure each aspect of their marketing efforts comply coherently (not just email).

It is only through education that we can truly fight spam, and laws like this are meant to help business and give them the tools to be able to do so effectively. As an email marketer, I am proud to say I live in a country that has one of the toughest anti-spam laws in the world. If you had to choose between an ESP in a country that required consent versus one that did not - which one do you think would have the best reputation and delivery?

h O W C A N I r E P O r T S P A M ?

As of July 1st, 2014 you will be able to report spam and other violations under CASL at http://fightspam.gc.ca

If you have received an email from a client of CakeMail that you think is spam, we want to know about it. Please contact abuse@cakemail.com

D I S C L A I M E r

please note : The views expressed in this guide are those of CakeMail Inc. and are not intended, nor are they to be relied upon, for the purpose of compliance and enforcement matters. Further, the information provided herein does not constitute legal advice and should not be used as a substitute for seeking such advice.

r E S O U r C E S

CRTC: http://fightspam.gc.ca

Industry Canada: http://www.ic.gc.ca/eic/site/ecic-ceac.nsf/eng/gv00521.html

CAUCE (Coalition Against Unsolicited Commercial Email): http://www.cauce.org

L E G A L

CakeMail uses Blakes as its legal counsel in all matters relating to CASL. Tricia Kuhl is an expert at Blakes. She is an expert in corporate and commercial law and an excellent resource when it comes to getting expert advice on CASL:

Tricia Kuhl Partner, Montréal Office Blake, Cassels & Graydon S.E.N.C.R.L./s.r.l. / LLP 600, boul. de Maisonneuve Ouest Bureau 2200 Montréal (Québec) H3A 3J2 Canada Tél. : 514-982-4000 Téléc. : 514-982-4099

Please visit : http://www.blakes.com/english/resources/pages/blakes-anti-spam.aspx

A U T h O r E D b y

Kevin Huxham Director of Deliverability - CakeMail Inc. kevin@cakemail.com

A b O U T C A K E M A I L

Based in Montreal, CakeMail Inc. helps small businesses grow by simplifying the way they engage customers. CakeMail 4 is a simple web-based email marketing application that allows companies to easily create, send and track email campaigns. CakeMail’s private label version is also offered by 350 brands in over 40 countries. Founded in 2007, CakeMail has delivered billions of emails and has been touted as being champions of anti-spam activism. Visit us at cakemail.com.

CakeMail Inc. 301 - 4020 Saint-Ambroise Montreal, Quebec, Canada H4C 2C7 | Phone : +1-866-924-1420 cakemail.com | hi@cakemail.com

Our Anti-Spam Policy : http://cakemail.com/anti-spam Our Blog : http://cakemail.com/blog Abuse and Complaints : abuse@cakemail.com

— 10 —