CASL for restaurants: consent for text messages, loyalty sign-ups and birthday offers

A restaurant's list of regulars is one of its most valuable assets, and one of the easiest to misuse. Canada's Anti-Spam Legislation, known as CASL, governs commercial electronic messages across the country, including email, text messages and some messages sent through apps and social media. It applies to every province, including Quebec. This guide summarizes the CRTC's published guidance, and is not legal advice. The statute and the CRTC's guidance are the authority.

What does CASL cover?

A commercial electronic message is one that, at least in part, encourages participation in commercial activity: a promotion, an offer, an invitation to book or a notice of a new menu. It covers email, SMS, direct messages on social platforms and some app notifications. It generally does not cover a phone call or a letter, which have separate rules.

Some messages are exempt or treated differently. A message that confirms a booking, delivers an order receipt or answers a customer's question is generally transactional, and does not need the same consent. A mixed message that also contains a promotion is a commercial message.

What consent do you need?

Two kinds.

• Express consent. A person agrees, in a clear way, to receive messages. The request must say who is asking, what the purpose is, how to reach you and that the person can unsubscribe. Pre-ticked boxes do not count. The person must take an action, such as ticking a box or typing a phone number after reading the notice.
• Implied consent. In limited circumstances, such as an existing business relationship, you may send messages without express consent. The CRTC's guidance says a purchase or lease within the two years before you send the message supports implied consent, and an inquiry or application supports it for the six months before. An abandoned online shopping cart is not a purchase. The periods are specific, so check the CRTC's guidance before you rely on them.

Implied consent is useful, but easy to get wrong. Express consent is safer, and easier to prove.

How do you get consent at the counter?

1. At the till or by QR code. Ask the customer to enter their email or mobile number on a form. The form states your business name, what messages they will receive, how often and how to unsubscribe, and has an unticked box they must tick.
2. At a booking. Add a separate, unticked box to the booking form. Do not tie it to the booking itself.
3. For a loyalty program. Explain what members receive, and ask separately for permission to send offers. Joining a loyalty program and agreeing to marketing are different decisions.
4. For a birthday offer. Ask for the date of birth, and for consent to message. Say that you will use the date only for the offer.

Do not buy lists. Consent given to someone else does not transfer to you.

What must every message include?

• Who you are, with your business name
• Your contact information
• A working unsubscribe method that is easy to use and free

The CRTC says you must give effect to an unsubscribe request within 10 business days, and the unsubscribe mechanism must keep working for at least 60 days after you send the message. In practice, do it at once. For texts, accept a reply such as STOP.

How do you keep records?

You carry the burden of proof. Keep:

• the date and time of consent
• the way it was obtained, with the wording shown
• who collected it
• the contact details
• the date of any unsubscribe

If a complaint arrives, those records are your defence. A spreadsheet is a start. A system that stores consent against each contact is better.

What can go wrong?

Penalties are serious. The CRTC says administrative penalties reach up to 10 million dollars per violation for a corporation and up to 1 million dollars for an individual. The CRTC enforces CASL, and actual penalties have often been far below the maximum, but a complaint can still lead to an investigation. CASL also contains a private right of action that would let individuals sue. The federal government suspended it before it took effect, so check its current status with the CRTC or a lawyer.

What about customers who stopped visiting?

Implied consent expires. Someone who bought from you three years ago and has not been back may no longer be a person you can message without express consent. Check your list each quarter. For people whose consent has lapsed, a single compliant request for permission is allowed in some situations, but check the rules before you send it.

What about staff and suppliers?

Messages to your own employees about work are generally not commercial. Messages to other businesses can be covered, so apply the same care.

A short checklist

1. Use unticked boxes and clear wording.
2. Keep separate consent for marketing.
3. Include your identity, contact and an unsubscribe in every message.
4. Honour unsubscribes quickly.
5. Keep records of every consent.
6. Review your list each quarter.

More guides for your business:

• Interac debit and credit card costs for restaurants: reading your statement and choosing a processor
• Credit card surcharges for Canadian restaurants: the network rules, the cap and when to skip it
• Food truck licences in Toronto and Vancouver: city permits, health approval and insurance

More in the Canadian guides for food businesses.