The Act's first gate is consent: you generally need it before sending the first message. It governs commercial electronic messages sent to recipients in Canada.
The requirements below follow the consolidated Act published by Canada's Department of Justice.
What does the Act prohibit?
Sending a commercial electronic message without consent, and without the right contents:
It is prohibited to send or cause or permit to be sent to an electronic address a commercial electronic message unless
(a) the person to whom the message is sent has consented to receiving it, whether the consent is express or implied; and
(b) the message complies with subsection (2).
The second limb requires the message to identify who sent it and on whose behalf, to give contact information the recipient can use, and to carry an unsubscribe mechanism.
Two scope points that catch people out. The Act applies to messages sent to an electronic address, which is not limited to email, so text messages and messaging accounts are in scope. And the Act says explicitly that it does not matter whether the message arrives: "it is immaterial whether the electronic address to which an electronic message is sent exists or whether an electronic message reaches its intended destination." Sending to a dead address is still sending.
What counts as consent?
Express consent, or implied consent in four defined situations.
The implied cases are a closed list, and the first of them is the one most businesses rely on:
consent is implied only if
(a) the person who sends the message ... has an existing business relationship or an existing non-business relationship with the person to whom it is sent;
(b) the person to whom the message is sent has conspicuously published ... the electronic address to which the message is sent, the publication is not accompanied by a statement that the person does not wish to receive unsolicited commercial electronic messages at the electronic address and the message is relevant to the person’s business, role, functions or duties in a business or official capacity;
(c) the person to whom the message is sent has disclosed, to the person who sends the message ... the electronic address to which the message is sent without indicating a wish not to receive unsolicited commercial electronic messages at the electronic address, and the message is relevant to the person’s business, role, functions or duties in a business or official capacity; or
(d) the message is sent in the circumstances set out in the regulations.
Paragraphs (b) and (c) are narrower than they look. Both require that the message be relevant to that person's role, so a published work address does not license a general marketing list. Both also fail if the address was published or given alongside a statement declining unsolicited mail.
How long does implied consent last?
Two years, or six months, depending on what created it.
The Act defines the existing business relationship by the event that started it and puts a clock on each:
existing business relationship means a business relationship ... arising from
(a) the purchase or lease of a product, goods, a service, land or an interest or right in land, within the two-year period immediately before the day on which the message was sent ...
(e) an inquiry or application, within the six-month period immediately before the day on which the message was sent ...
So implied consent decays. A customer who bought from you three years ago and never opted in is not someone you may mail, and somebody who enquired seven months ago is not either. This is the requirement that most affects how you model consent in a database: the fact that consent was implied is not enough, you need the date and the event that implied it.
What must the unsubscribe do?
Work at no cost, on the same channel, and keep working for sixty days.
The unsubscribe mechanism referred to in paragraph 6(2)(c) must
(a) enable the person to whom the commercial electronic message is sent to indicate, at no cost to them, the wish to no longer receive any commercial electronic messages, or any specified class of such messages ... using
(i) the same electronic means by which the message was sent, or
(ii) if using those means is not practicable, any other electronic means that will enable the person to indicate the wish
with a deadline and a validity period attached:
The person who sent the commercial electronic message ... must ensure that effect is given to an indication sent in accordance with paragraph (1)(b) without delay, and in any event no later than 10 business days after the indication has been sent, without any further action being required on the part of the person who so indicated.
The address you point them at has its own lifetime:
The person who sends the commercial electronic message ... must ensure that the electronic address or World Wide Web page referred to in paragraph (1)(b) is valid for a minimum of 60 days after the message has been sent.
That sixty-day validity applies to the contact information in the message too, and it is an operational requirement rather than a drafting one. An unsubscribe URL scheme that stops resolving when a campaign is archived breaks it.
Which exceptions exist?
A short list, and they are about the message rather than the recipient.
Section 6(6) removes the consent requirement for a message that solely
(a) provides a quote or estimate for the supply of a product, goods, a service, land or an interest or right in land, if the quote or estimate was requested by the person to whom the message is sent;
(b) facilitates, completes or confirms a commercial transaction that the person to whom the message is sent previously agreed to enter into with the person who sent the message
along with warranty, recall and safety information, and the delivery of goods or a service the recipient is entitled to. Section 6(5) separately carves out messages between individuals with a personal or family relationship, and enquiries sent to someone about their commercial activity.
The word doing the work in most of those is solely. A confirmation with a promotion attached is not solely a confirmation, in the same way that CAN-SPAM's primary purpose test treats a mixed message as commercial.
How does this change my programme?
It makes consent a per-recipient fact with provenance, not a flag.
If you mail Canadian recipients, you need to know for each of them whether consent is express or implied, what event created it, and when. A single boolean cannot answer the question the Act asks. Bird records consent as statements with the moment of consent attached, which is the shape this needs; messaging preferences covers recording an opt-in and what it takes to reverse an opt-out.
In short
Consent comes first, and it can be express or implied.
The Act permits both, which is what makes it workable, and it defines implied consent narrowly rather than leaving it to judgment.
An existing business relationship expires.
Two years from a purchase, six months from an enquiry. After that the implied consent it created is gone.
It covers messages, not just email.
The Act regulates commercial electronic messages sent to an electronic address, which takes in text messages and messaging accounts.
The unsubscribe has a validity period as well as a deadline.
Ten business days to act on it, and the address or web page has to keep working for sixty days after the message was sent.