Texting your customers in Canada: what CASL allows

Yes, you can text past customers in most cases

Canada's anti-spam legislation, usually called CASL, does not ban texting or emailing your own customers. It sets conditions. The law came out of a push against bulk spam, but it is broad enough that a one-line text from a plumber falls under the same rules as a mass email blast.

There are only two questions to answer before you hit send. Do you have consent, and is it still good? Does the message itself contain the parts the law requires?

This is a plain reading of the law for small business owners. It is not legal advice, and if a lot of money or a big list is riding on it, pay a lawyer for an hour.

A text to a past customer is a commercial message

The test in the Act is whether it would be reasonable to conclude the message has as its purpose, or one of its purposes, to encourage participation in a commercial activity ¹. That is a low bar. A text saying furnace tune-ups are booking up clears it easily.

The format does not matter. The CRTC describes the messages it regulates as emails, text messages or messages over social media ². A Facebook message, an Instagram DM and an SMS are all treated the same way as email.

So the friendly check-in that happens to mention your fall special is a commercial message. If any part of the message is chasing more work, assume the rules apply.

Express consent does not run out

Express consent is where someone actually agreed to hear from you. The government's own CASL guidance says there is no time limit unless the recipient withdraws his or her consent ³.

That makes express consent the thing worth collecting. The cheapest place to get it is at the job, when they are already saying yes to you. Use a tick box on your booking form or invoice, in plain words, saying you will text them about service reminders and offers.

Keep the record. The CRTC says the sender must prove that consent was obtained ², so you want the date, what the wording said, and how they agreed. A tick box with no stored date is close to useless when someone complains.

Implied consent runs out: two years, or six months

If you never asked, you may still have implied consent, but it expires. For a customer who bought from you, the window covers the purchase or lease of a product, goods, a service, land, or an interest or right in land that happened within the two-year period immediately before the day on which the message was sent ⁴. The clock runs from the sale, not from the last chat.

For someone who only enquired, the window is an inquiry or application within the six-month period immediately before the day on which the message was sent ⁵. That is the one that catches trades and clinics out. The pile of quote requests that never turned into jobs goes stale fast.

The practical fix is a dated list. Every contact needs the date of their last purchase and the date of their last enquiry, and your system needs to stop messaging them when the window closes. Better still, use the window you do have to ask for express consent, which then does not expire ³.

A quote they asked for is not marketing

Replying to a quote request is not the same as marketing to them. The Act carves out a message that only provides a quote or estimate, if the quote or estimate was requested by the person to whom the message is sent ⁶.

So answering the form on your website with a price is fine. What breaks the carve-out is adding anything else. Put a line about your seasonal special at the bottom of the quote and you are no longer only providing a quote.

Send the price on its own. If you want to market to that person as well, that is what the six-month enquiry window and an express consent tick box are for ⁵.

Every message needs your name and a way out

Consent is only half of it. The message has to say who sent it and give contact details the person can use, and those details have to stay valid for a minimum of 60 days after the message has been sent ⁷. A number you are about to change, or a reply-to address nobody reads, does not meet that.

You also need an unsubscribe that works. It has to be free to use, and once someone uses it you must act on it no later than 10 business days after the indication has been sent ⁸. Ten business days is the outside limit, not a target.

In a text, that is a short line with your business name and a stop instruction. Do not hide it behind a link that expires or a login. Two of the three settlements below came down to the unsubscribe, not the consent.

What getting it wrong has cost

The ceilings are large. In Canadian dollars, the Act says the maximum penalty for a violation is $1,000,000 in the case of an individual, and $10,000,000 in the case of any other person ⁹. Those are ceilings, and they are per violation.

What the CRTC has actually collected from named companies is a lot smaller. Plentyoffish Media paid $48,000 over an unsubscribe mechanism that was not clearly and prominently set out ¹⁰. That was an unsubscribe design problem, not a consent problem.

514-BILLETS, a ticket resale business, settled for $100,000 after allegedly sending text messages without consent, without identifying who sent them and without a way for people to reply ¹¹. Gap Inc. paid $200,000 where messages allegedly did not consistently include an unsubscribe mechanism, or included one that was hard to use ¹². None of these are corner shops, and a small Alberta trade is not the CRTC's priority. But the behaviour that got them in trouble is the ordinary behaviour of a business that never set its list up properly.

Most small businesses can get compliant with what they already pay for. Your booking or invoicing software probably has a consent tick box, a date field and an unsubscribe line, and turning those on is an afternoon of work. Custom work only earns its keep when consent dates live in one system, your texting lives in another, and nobody is keeping the two in step.