A Marketer’s Guide toCanada’s Anti-Spam Law(CASL)DISCLAIMER: Silverpop does not provide legal guidance and presents this information as adiscussion of general legislation issues and not as legal advice. Please consult your attorneyfor legislation compliance guidance.CASL (Canadian Anti-Spam Law) goes into effect on July 1, 2014. With the enforcement datefor sending of CEMs (Commercial Electronic Email) fast approaching, Silverpop has prepared ahigh-level background on the law and some best practices you can take to prepare.Work on CASL began in December 2010. Since then, it’s had many revisions/updates, and inDecember 2013 it was finally passed into law with a (mostly) go-live date set for July 1, 2014.Sections of the act related to the unsolicited installation of computer programs go into effect onJan. 15, 2015, with private right of action (limiting civil litigation) going into effect July 1, 2017.While these areas are important, for the purpose of this document we’re going to focus mostlyon messages sent to email addresses.The main takeaway for CASL is that it’s strictly opt-in (express consent). In other words, youcan only send CEMs when you have prior expressed consent (permission). In this respect CASLdiffers from CAN-SPAM, which largely focuses on opt-out, generally meaning you can sendcommercial email as long as you have a working opt-out link and process opt-outs within 10business days.When CASL goes into effect, it will generally prohibit the sending of CEMs without therecipient’s consent (permission), including messages to email addresses, social networkingaccounts and text messages sent to a cell phone.Primary Requirements for CASL ComplianceAs with any law, there are some primary aspects you should be concerned with and have a planin place to address. For CASL these include: Identification – Must identify sender and include prescribed contact info Unsubscribe – Must include a working unsubscribe mechanism Unsubscribe Processing – Must process all unsubscribe requests in 10 business days,without delay Consent – Must have expressed or implied consent for all recipients residing in Canada(more on this later) Opt-in – Proof of expressed 2014 Copyright Silverpop. All rights reserved. The Silverpop logo is a registered trademark of Silverpop Systems Inc.PAGE 1

What Is Consent?Consent is vital to CASL. There are two types of consent — express and implied.1.Express consent: The recipient has given explicit consent to receive CEMs(e.g., by checking an unchecked checkbox on a form).2.Implied consent: There is an existing relationship and/or the recipient hasprovided an email address but not expressly stated they would like to receivefurther communication (and has not opted out).It’s important to note that by July 1, 2017, you must obtain express consent for anyrecipients in your list or database that have not previously given express consent toreceive commercial email and reside in Canada. Silverpop’s recommendation is toproactively seek express consent for all recipients in your database since it would takesignificant effort to identify/track and ensure that all recipients residing in Canada at thetime of sending a CEM have provided express consent. Please note: There are significantpenalties for violation of CASL. Play it safe and seek consent for all recipients.Transitional Provision for Existing Email Contacts(Implied Consent)If you have (or had) existing business or non-business relationships that already includecommunications by commercial electronic message, you’ll have three years to upgradethese contacts from implied to express consent.The “implied consent” category encompasses any recipients who have opted in througha Web form with a pre-checked opt-in, instances in which the sender and recipient havean existing business (or non-business) relationship, and occasions in which the recipienthas supplied an email address and has not included a statement that indicates they do notwish to receive CEMs.Important: ANY new recipient opt-ins obtained starting July 1, 2014, MUST have expresslyconsented. In other words, the recipient must give explicit consent to receive CEM(e.g., by checking an unchecked checkbox on a form). Failure to obtain, track and maintainproof of express consent is in direct violation of the 2014 Copyright Silverpop. All rights reserved. The Silverpop logo is a registered trademark of Silverpop Systems Inc.PAGE 2

What Does CASL Mean to You?Most marketing databases or lists can be broken into categories as they relate to CASLcompliance. To try to simplify, we’ve created the diagram below, which illustrates whichrecipients fall into which category. The good news is because Silverpop is a permission-based ESP,a large portion of the contacts in your list or database should fall into the first category of expressconsent. In other words, most Silverpop clients already have an existing process for capturingexpress consent AND have detailed records indicating as such.For any records in your database that do not match one of the first three categories below,express consent will need to be obtained. Any that fall under the last category below (Purchase/No Consent) should be removed from your list.Type of ConsentExpress ConsentCompliantRecommendationsNo additional consent is needed for recipients thatfall into this category.ExistingBusinessRelationshipYou have a two-year rolling window each time a recipientmakes a purchase. Any recipients approaching the24-month window without a purchase should be movedinto one of the categories below.Exemptions/ExclusionsSee exclusions and exemptions charts. No additionalconsent is needed for any recipients matching one ormore exclusions/exemptions.Implied ConsentAdditional (Express) consent will be needed for anyrecipients in this category. This includes anyrecipients not matching one of the categories above.Purchase/No ConsentPurchased lists are against Silverpop’s Terms ofService. Also, if proof of consent is not readilyavailable, the record/list should be removed. Allrecipients not matching a category above shouldalso be removed from your list/ 2014 Copyright Silverpop. All rights reserved. The Silverpop logo is a registered trademark of Silverpop Systems Inc.PAGE 3

Exclusions & ExemptionsCASL provides a number of exemptions and exclusions from seeking express consent.We’ve listed a few below.Please note that with the B2B communications referenced in the chart below, theexemption only applies if certain criteria are met, including but not limited to: An email sent within a business or sent between businesses An email sent in response to a business request, complaint or offered in aprofessional capacity by a recipient that has conspicuously published theirelectronic addressCASL ExemptionsCASL ExclusionsFrom ConsentThe following types of messages areexempt:The following messages do notrequire express consent: B2B communications Messages to those with whom youhave an existing non-businessrelationship/donations or gifts,etc. Communications to those withwhom you have an existingbusiness relationship within a twoyear period Messages sent to consumers inresponse to a request forinformation Messages sent to enforce a legalright Third-party referrals/Forwardto a friend Communications sent betweenthose with personal relationshipswithin organizations Messages sent betweenorganizations with an existingrelationship Communications sent to satisfylegal obligations Messages sent to foreign stateswith anti-spam legislation Communications that provide aquote or estimate Messages that facilitate atransaction previously agreed to Warranty/recall/safety or securityrelated emails Communications relating topurchase or ongoing maintenanceof memberships, loans, etc. Messages that deliver goods orservices/product updates 2014 Copyright Silverpop. All rights reserved. The Silverpop logo is a registered trademark of Silverpop Systems Inc.PAGE 4

What’s Required in an Email When SeekingExpress Consent?When seeking expressed consent from an existing list/database, there are some elementsthe message must contain to be compliant: Clear purpose/request for consent Contact information of sender or group seeking consent Name of person/group seeking consent Clear unsubscribeHow Are Transactional Emails HandledUnder CASL?Although transactional emails can be sent, they must not contain ANY reference topersonal or product promotion. And while transactional messages don’t require consent,they must link to the unsubscribe page. A recommendation here would be to offer apreference center where recipients can opt out of marketing messages.Also note: Any commercial content, including a request for consent for future CEMs,would be considered a commercial email. A recommendation would be to send twomessages — one strictly transactional, followed a day later with an upsell CEM to peoplewho have not unsubscribed from future commercial 2014 Copyright Silverpop. All rights reserved. The Silverpop logo is a registered trademark of Silverpop Systems Inc.PAGE 5

Differences and Similarities in CAN-SPAM and CASLWhile there are some important differences to note in CAN-SPAM (U.S. anti-spam law) and CASL,it’s also important to note their similarities (see chart below for a high-level description of both).As mentioned earlier, the most important takeaway is that CASL is an opt-in law, requiringproof of opt-in. In contrast, CAN-SPAM is opt-out focused, mainly requiring the ability to optout anyone who chooses to no longer receive your emails. Thus, under CAN-SPAM purchasedlists could be identified as “legal,” though a very bad practice and against Silverpop’s Terms ofService. CASL makes purchasing of lists illegal.Again, while the law requires proof of opt-in only for recipients residing in Canada, most of theworld has moved to an opt-in versus opt-out law. Silverpop’s recommendation would be toadhere to the most restrictive law to avoid any chance of non-compliance.DIFFERENCESCASLCAN-SPAM All CEMs require opt-outmechanism Requires Express Consent Opt-in required Web forms must not contain a prechecked opt-in (implied consent) Personal/Family Exemptions Transactional messages do notrequire opt-out Consent is not required Web forms can utilize pre-checkedopt-in Opt-out requiredSIMILARITIESCASLCAN-SPAM Transactional messages are exempt(must not contain any personal/product promotion) Emails required to be sent, such aswarranty information/recall/etc.,are exempt Unsubscribes must be handledwithin 10 days and without delay Transactional messages areexempt and can containpromotional or product promotion All messages can be sent as long asthey have a working unsubscribemechanism and are handled within10 business 2014 Copyright Silverpop. All rights reserved. The Silverpop logo is a registered trademark of Silverpop Systems Inc.PAGE 6

CASL PreparationIt’s important to restate that the enforcement date for CASL is July 1, 2014. If you haven’tstarted already, you should develop a plan to ensure CASL compliance. Below are a fewpoints to help get you started.1) Meet internally and devise a plan Ensure proper stakeholders are aware (this includes legal counsel, etc.). Make sure all internal policies and procedures are updated.2) Inventory your data collection methods Determine the different ways you currently collect data and ensure they are incompliance with CASL. Remember, any forms cannot have a pre-checked opt-in.3) Identify and determine how your email is being sent Ensure that any third-party companies and/or ESPs have tools and mechanisms inplace to ensure CASL compliance.Hefty Fines for Non-ComplianceFinally, non-compliance with CASL comes with hefty fines: 10 million per violation for a corporation 1 million per violation for individualsFor the sake of your bottom line and the quality of your database, it’s important you takeinventory and put a plan in place to ensure compliance – soon.Again, please note that Silverpop does not provide legal guidance and presents thisinformation as a discussion of general legislation issues and not as legal advice. Pleaseconsult your attorney for legislation compliance guidance.Related Resources:CASL - - 2014 Copyright Silverpop. All rights reserved. The Silverpop logo is a registered trademark of Silverpop Systems Inc.PAGE 7 2014 Copyright Silverpop. All rights reserved. The Silverpop logo is a registered trademark of Silverpop