Consent is not a checkbox you tick once
CASL is not the problem people think it is. The problem is that most stores cannot produce evidence of consent when asked, which is a different failure entirely.
Canadian anti-spam rules are not especially hard to comply with in principle. Where stores get into trouble is not the rule — it is the record.
When somebody asks how a specific customer came to be on your list, the answer has to be a specific fact with a timestamp, not a general description of your process.
The three things to be able to produce
- 01When consent was given, to the minute.
- 02How it was given — which form, which conversation, which checkbox, with the wording that was on screen at the time.
- 03What has happened since: every message sent, and every opt-out, honoured and dated.
If those three live in three different systems, you do not really have them. Reconstructing consent from a CRM note, an email archive and somebody memory is not evidence.
The compliance question is almost never did you have consent. It is can you show it, today, for this customer.
Where stores actually slip
Channel drift
A customer messages you on a marketplace or a social platform. That is not consent to text them. Moving to SMS needs its own explicit yes, and it needs to be logged as its own event.
Inherited lists
A list that came with an acquisition, from a previous vendor, or from a lead source, carries whatever consent it carries — which is often nothing you can evidence. Treat those with far more care than your own captured leads, and in a lot of cases, do not text them at all.
Informal opt-outs
Please stop is an opt-out. Take me off your list is an opt-out. Not interested, do not contact me again is an opt-out. If your system only honours the keyword, you are non-compliant in exactly the cases most likely to generate a complaint, because a customer who has to escalate to the magic word is already annoyed.
And make no mean no everywhere
The failure that produces actual complaints is a customer who opted out of one campaign and got contacted by another, because the two systems did not share a suppression list.
One list. Everything checks it. No exceptions for the campaign somebody is excited about.