Texting customers under CASL: a plain-language summary for contractors

What CASL covers

CASL covers commercial electronic messages: messages that encourage participation in a commercial activity. Texts count.

ISED's overview of CASL explains that a commercial message is one that encourages participation in commercial activity, whether or not anyone expects a profit, and that spam includes unsolicited texts as well as email. Its page on texting for good client relations is direct: CASL is technology neutral, and consent is needed for commercial text messages too.

The CRTC enforces CASL and publishes a detailed CASL FAQ. ISED adds that senders should be ready to provide proof of consent if asked.

For a contractor, the messages that matter fall into roughly three groups:

1. Conversation replies. Someone called or texted about a job; you reply about that job.
2. Transactional messages. A quote they asked for, an appointment confirmation, a "we're on our way."
3. Promotional messages. A seasonal offer, a tune-up reminder to past customers, a discount.

The rules bite hardest on the third group. The next sections explain why.

Express and implied consent

There are two kinds of consent under CASL: express and implied. The difference is mostly about time.

ISED's consent guidance explains them this way:

• Express consent means the person agreed, verbally or in writing, to receive commercial messages from you. It has no time limit unless they withdraw it.
• Implied consent is recognised only in certain situations. One is an existing business relationship, for example when someone bought from you or sent you an inquiry. It's time-limited: ISED says it may be valid for up to 2 years after a purchase, or just 6 months after an inquiry or application.

What that means in practice for a trades business:

• A caller who asked about a furnace repair last week has an inquiry relationship with you. That clock is roughly six months.
• A customer whose roof you replaced 18 months ago is inside the two-year purchase window. One who hired you three years ago is outside it, unless they gave express consent or did business with you again.
• If you'd like to send promotions beyond those windows, you need express consent, and a record of it.

ISED also suggests asking yourself practical questions: did they actually say yes, did they agree only to specific types of message, and how long has it been since your last interaction?

Messages the Act treats differently

Some messages are exempt from the consent requirement, though not necessarily from everything else. The wording in the Act is precise, so it's worth reading.

Section 6 of the Act, subsection (6), says the consent requirement does not apply to a commercial electronic message that solely:

• provides a quote or estimate for a product or service, if the recipient requested it
• facilitates, completes or confirms a commercial transaction the recipient previously agreed to
• provides warranty, product recall, or safety or security information about something the recipient uses, has used or bought
• delivers factual information about an ongoing subscription, membership, account or similar relationship
• delivers a product, service or update the recipient is entitled to under a previous transaction

Two words carry a lot of weight: "solely" and "requested." A text that delivers the quote someone asked for sits in one place. A text that delivers the quote and adds "PS: 15% off duct cleaning this month" may not be "solely" a quote anymore.

Note that this subsection lifts the consent requirement only. It does not, on its face, lift the other requirements about identifying the sender and offering an unsubscribe mechanism. Check with a lawyer how those apply to your transactional texts.

What a commercial text must include

Every commercial message needs identification and a way to opt out. Short texts make this harder, so plan it.

ISED's consent page lists what a commercial message must include:

• your business name, and the name of anyone you're sending on behalf of
• a current mailing address, plus a phone number, email or website address
• contact information that stays valid for at least 60 days after the message
• an unsubscribe mechanism that meets the Act's requirements

Its texting page adds practical points for text messages, such as making sure your business name is visible in the text and actually respecting it when someone replies STOP. Offering a STOP keyword isn't enough on its own; the request has to be honoured. The CRTC's FAQ has more on how identification and unsubscribe information can be provided.

How we handle this in text-back

For a missed-call text-back, we include the business name and an opt-out line in the first message, and we make sure your full contact details, including a mailing address, are readily available, for example on your website's contact page. Because a 160-character text can't hold everything, ask a lawyer how best to meet the identification requirements for your specific messages.

Honouring opt-outs

Opt-outs are where small businesses most often slip, usually because the request reaches one person and nobody else.

ISED says every unsubscribe request must be actioned within 10 business days or less and at no cost to the recipient. That's the legal outer limit. Good practice is immediate: most texting tools can stop all messages to a number the moment it replies STOP.

Steps that help:

1. Use one texting account for the business, not personal phones, so an opt-out applies to everyone.
2. Record the date and time of each opt-out.
3. Train every staff member, and any outside company texting on your behalf, to treat STOP the same way. ISED specifically mentions training employees and third parties.
4. Watch your opt-out rate. ISED notes that a high unsubscribe rate can mean customers see your messages as spam, even when they technically aren't.

Keeping proof of consent

Under CASL, the sender needs to be able to show consent if asked. Build the record as you go; reconstructing it later is painful.

A simple record for each contact:

• how the contact reached you (called, texted, asked for a quote, hired you)
• the date of that first contact, and of the most recent job or purchase
• any express consent given, with the date and the wording they agreed to
• any opt-out, with the date

This is also why we're careful about importing old contact lists into a new texting tool. If you don't know how or when a number was collected, treat it as having no consent for promotions.

Phone calls are a separate set of rules

CASL is about electronic messages. Voice calls are mostly handled elsewhere.

The Act's section 6(8) says the section doesn't apply to an interactive two-way voice communication between individuals, or to a voice recording sent to a telephone account. Telemarketing calls fall under the CRTC's Unsolicited Telecommunications Rules and the National Do Not Call List.

The National DNCL exemptions page explains that calls to someone with an existing business relationship are exempt from the national list, for example a customer who bought from you in the last 18 months, or who made an inquiry within the last six months. Even then, every telemarketer must keep an internal do-not-call list, add a person within 14 days of their request, and keep them on it for three years. The national list rules don't apply to calls made to businesses.

Note the different time frames: 18 months for calls under the telemarketing rules, two years for messages under CASL. Don't assume one set of rules covers the other.

Privacy law sits alongside CASL

CASL decides when you may send. Privacy law governs how you handle the personal information in your inbox.

ISED notes that businesses must comply with both CASL and the federal privacy law, PIPEDA. The Office of the Privacy Commissioner's summary of privacy laws explains that PIPEDA covers private-sector organisations in most provinces and territories, while Alberta, British Columbia and Quebec have their own private-sector privacy laws that may apply instead in some cases.

For texting, the practical habits are simple: don't ask for more personal information by text than the job needs, don't send sensitive details by text, and limit inbox access to the people who need it. ISED's texting page also points out that customers hesitate to click links in texts, so give transaction details in the message itself where you can.

A pre-send checklist

Before any text that goes beyond a direct reply, run through this:

• ☐ Is this a reply about what they asked, a transactional message, or a promotion?
• ☐ If it's a promotion, do I have express consent, or implied consent within its time limit?
• ☐ Is my business name in the message?
• ☐ Is there a clear way to opt out, and will it be honoured immediately?
• ☐ Are my full contact details, including a mailing address, available as required?
• ☐ Am I avoiding sensitive personal information and unnecessary links?
• ☐ Have I recorded how this person came to be in my contacts?

Where to go from here

Use the official links above as your reference, and a lawyer for anything you're unsure about. If you'd like the consent habits built into your setup from the start, that's part of every service we offer; see quote and job follow-up for the area where it matters most, or the first-text templates guide for message wording. Questions about working with us are answered in the FAQ.