Cold Emails to Other Companies Under CASL

Addresses copied from websites

A firm that sells to other businesses wants new customers next year, so someone spends a few days copying addresses from prospects' contact pages and staff lists into a spreadsheet.

Under CASL, Canada's anti-spam law, the introduction that follows counts as a commercial electronic message, and those need consent.

For addresses published on websites, the law allows a form of implied consent, with conditions that many firms either do not know or assume cover every address they can find.

What follows outlines the rules for such lists and is not legal advice. With Christmas tomorrow and January's prospecting ahead, it is a good week to check how such a list was built.

What the law allows

CASL treats consent as implied when an address was published in a particular way. In practice that means four things.

• Conspicuously published by the person or at their request, such as on a company site.
• No statement refusing unsolicited commercial messages alongside it.
• A message relevant to the recipient's business or their role in it.
• Identification and an unsubscribe in every message, whatever the consent.

The third decides most cases. An address being easy to find is not enough; the message has to concern the work of the person it belongs to.

Relevant to the role

Relevance is about the recipient's job, not about whether they might like your product.

Commercial cleaning offered to an office manager named on a firm's website relates to her role. The same offer to the bookkeeper, or to a job applications address, does not.

So for each company, ask whose job your offer concerns. Use that person's published address, and leave the rest of the staff list alone.

A general address such as info@ is a judgement call, though a short, relevant introduction is the kind of message it exists to receive.

Statements that refuse messages

Some sites say, on the contact page or in the footer, that they do not accept unsolicited commercial email, or simply no solicitations.

Where that statement appears with the address, the published-address route is closed. The address may be visible, but its owner has said no in advance.

Check the page where you found it, the contact page and the footer, and note that you looked and when.

Where the address was published

The clearest case is the company's own website: the person or their employer chose to put the address there.

Directories and member lists are less clear: it depends on whether the person arranged the listing and what the directory says about using it. Many forbid exactly this.

Bought lists rarely record where each address appeared. Addresses gathered by software that crawls websites raise a separate problem, since CASL also amended PIPEDA to deal with address harvesting.

Write down where and when

Under CASL the sender has to show consent if it is ever questioned. For a published address, that means showing the publication.

For each address, keep the page where it appeared, the date you saw it, the person's role as described there, and a note that no refusal statement was present.

A screenshot of the page, saved with the date in its file name, covers most of that. Pages change, and a record made on the day beats a memory of what a site once said.

A worked example

A land clearing contractor with two excavators, a mulcher and a crew of five clears lots for builders and developers, and wanted more work in two neighbouring towns.

Last winter the office manager gathered about three hundred addresses from builders' and developers' websites and a member directory, then sent one promotion to all of them through the newsletter service.

Problems surfaced at once. Dozens of addresses belonged to receptionists, bookkeepers or a careers inbox, two sites refused unsolicited email in their footers, and nobody had noted where any address came from.

Two recipients marked the message as spam, and the mailing service paused the account while it asked how the list had been built.

This year the list was rebuilt by hand from company websites, with the page, date, role and a screenshot recorded for each builder, and sites carrying a refusal left out.

Messages now go to one company at a time, each mentioning the lots that builder is working on, with the contractor's address and a line inviting a reply to opt out.

What the first message should look like

Keep it short, specific and plainly from a real business. Use the person's name and say in the first line why you are writing to them.

Mention where you found their address. It is honest, it shows the message is not from a bought list, and it keeps the record in mind.

Include your business name, a mailing address, another way to reach you and an opt-out that works. CASL expects those in every commercial message, cold or not.

Keep prospects off the newsletter list. If someone replies with interest, ask whether they would like the newsletter, and record the answer with its date.

Routes that do not need a published address

CASL's exemption for messages between organisations applies only where the two already have a relationship and the message concerns the recipient's activities. It does not cover a first approach to a stranger.

A referral can. One message may follow a referral from someone with a relationship to both sides, provided it names that person and says it was sent because of the referral.

And a phone call sits outside CASL altogether, though calls have rules of their own.

The counter-case

A firm with a short list of known prospects may find a call or a visit works as well, and one whose work comes by referral may need little cold email.

A large list, a bought one or one gathered by software is a different matter, and worth a lawyer's review before anything is sent.

For the ordinary case the rule of thumb holds: a published address, a message about the recipient's work, no refusal on the page, and a dated record of all three.

Before the January sends

1. Take addresses from prospects' own websites.
2. Look for a refusal statement on each site.
3. Choose the person whose role your offer concerns.
4. Record the page, date and role.
5. Write to each company individually.
6. Include your address and a working opt-out.
7. Keep prospects off the newsletter list.

Step four is the one that matters if anyone ever asks. The consent rests on what a page said on a particular day, and only a record made that day can show it.

The first penalty under the law, and the two ordinary failures behind it, are covered in the first CASL penalty and the lesson in it.

Frequently asked questions

West Coast Media Solutions Inc. provides web design, web development, hosting, digital marketing, and business consulting to organisations across Canada, drawing on more than twenty-five years in the field.