Re-Permission Emails and the Canadian List

A week of please stay emails

The subject lines are variations on one theme: we do not want to lose you, please confirm you still want to hear from us, last chance to stay on our list.

They are arriving because Europe's new privacy rules, GDPR, apply from May 25, and many organisations have decided to ask every subscriber again before then.

Some of the senders have no European customers at all. Others are asking people whose consent was perfectly sound.

If you send a newsletter, you may be wondering whether to send one too. For many Canadian businesses the answer is no; for some it is yes. None of this is legal advice, only the general picture.

What CASL already requires

Canada's anti-spam law, CASL, has governed commercial email since 2014. It requires consent, clear identification of the sender, and an unsubscribe that works, with each request processed inside ten business days.

Consent can be express, where somebody actively agreed, or implied, for example from a purchase in the past two years or an enquiry in the past six months.

Express consent does not expire unless the person withdraws it. And if consent is ever questioned, the law puts the burden of proving it on the sender.

Sorting the list

• Express consent on record: valid under CASL, with no expiry date.
• Implied consent from a purchase: valid for two years after it.
• Implied consent from an enquiry: valid for six months.
• European subscribers: subject to GDPR as well as CASL.
• No record at all: addresses whose origin nobody can explain.

The last group is the one that tempts businesses into a re-permission email, and the one it cannot fix. Under CASL, an email requesting consent counts as a commercial message too, so it needs consent to send.

When asking again only shrinks the list

A re-permission email asks people to click to stay. Many will not, and the reason is rarely an objection. They skim, they mean to get to it, or they assume it does not apply to them.

If anyone who does not click is removed, every one of those people is lost, including subscribers who agreed properly years ago and were happy to keep reading.

For subscribers whose express consent is on record, that loss buys nothing under CASL. Their consent was already valid, and asking again does not make it more so.

What GDPR asks of a Canadian sender

GDPR can apply to a Canadian business that sells to people in the European Union, or that monitors their behaviour. A list with European subscribers on it may fall within that.

For marketing email, the usual basis is consent that is freely given, specific, informed and unambiguous, shown by a clear action such as ticking an empty box. A box ticked in advance does not count.

The sender must be able to show that consent was given. But GDPR does not require asking again where existing consent already meets its standard, a point much of the current flood overlooks.

Regulators in Europe see the request itself the way CASL does. Britain's privacy regulator fined companies last year for emails asking people who had opted out, or never agreed, to update their preferences.

When a re-permission email is right

There are two common cases.

The first is European subscribers whose consent you cannot show met the standard, such as people added through a checkout box ticked by default. Asking them once, and keeping only those who agree, is the usual approach.

The second is Canadian customers on implied consent that is about to lapse, such as buyers from nearly two years ago. Asking for express consent while you may still email them keeps the ones who want to stay.

That second reason comes from CASL, not from May 25, and it is worth acting on all year.

A worked example

A small studio in the Kootenays sells hand-dyed yarn online and sends a monthly newsletter to a few thousand knitters, some of them in Europe.

The owner had drafted a please confirm email to the whole list, because so many newsletters arriving that week were asking the same thing.

The records told a different story. Since 2015, sign-ups had come through an unticked box at checkout and a form on the site, each stored with the date and the wording shown.

That consent was express and recorded. For the European knitters, it was already the kind GDPR expects.

The real problem was an older group: names copied from craft fair sign-up sheets in 2013, with no record of what anybody had been told. Emailing them to ask would have been a problem in itself.

So the email was never sent. The craft fair names were removed, the privacy policy was updated, and a sign-up sheet with proper wording went back on the fair table for this summer.

If you do send one

Write it plainly. Say why you are asking, what subscribers will receive and how often, and that doing nothing means they will be removed.

Give it one button and a short subject line, and include the sender identification and unsubscribe link CASL requires in any commercial email.

Send it only to people you are already allowed to email, and store each answer with its date. That record is the point of the exercise.

Records from here on

Whatever you decide this month, the lasting fix is a record for every sign-up: when it happened, where, and the exact wording the person agreed to.

Most email services store the date and source automatically when sign-ups come through their own forms, and a confirmation click adds a clean record to each one.

Export those records whenever you change providers, so the proof travels with the list.

The counter-case

Some businesses should ask everyone again.

A list with many European subscribers, one built over years from sources nobody documented, or one full of people who have not opened anything in years may be better rebuilt than defended. Smaller and certain beats larger and doubtful.

Where the stakes or the uncertainty are high, an hour with a lawyer who knows privacy law is well spent.

For a Canadian list with recorded express consent, though, keep it as it is and put the effort into better records.

Before you send anything

1. Export the list with sign-up dates and sources.
2. Find any European subscribers on it.
3. Check how each group agreed.
4. Stop emailing addresses with no record.
5. Leave recorded consent as it is.
6. Ask once where consent falls short.
7. Record every new sign-up properly.

Step four is the one most businesses resist, because it shrinks the list on purpose. But an address with no record of consent cannot be fixed by emailing it, and every send to it carries the risk.

How the newsletter itself now looks to readers in Gmail is covered in Gmail's new design and your newsletter.

Frequently asked questions

West Coast Media Solutions Inc. provides web design, web development, hosting, digital marketing, and business consulting to organisations across Canada, drawing on more than twenty-five years in the field.