Canada's Anti-Spam Legislation affects how you can ask customers for reviews via email and text. Here's what's allowed and what's not. This guide covers everything Canadian service businesses need to know, with practical steps you can act on today.
Canada's Anti-Spam Legislation (CASL), which came into full effect in 2017, regulates commercial electronic messages (CEMs). A CEM is broadly defined as any electronic message that encourages participation in a commercial activity — including, in some interpretations, asking for a business review.
The good news: in-person review requests are completely outside CASL's scope. When you hand a customer an NFC card or show them your review stand, that's a verbal or physical interaction — not an electronic message. CASL doesn't apply.
CASL's requirements become relevant when you send review requests via email, text message, or any other electronic channel.
A review request email is likely CASL-compliant if:
1. You have express or implied consent to send the customer electronic messages. Implied consent exists when you have an existing business relationship — a customer who purchased from you in the past 2 years generally qualifies.
2. The email includes your physical mailing address (248 Port Colborne Drive or your actual address).
3. The email includes a clear and functioning unsubscribe mechanism.
4. The subject line is honest — not misleading. 'A quick favour' or 'How did we do?' are fine. 'URGENT: Your account needs attention' for a review request is not.
For most established businesses asking existing customers for reviews, the implied consent provision covers standard review request emails.
Text message review requests are commercial electronic messages under CASL and require the same compliance elements as emails: consent, unsubscribe mechanism, and accurate identification.
Express consent for SMS is harder to establish — implied consent from a business transaction applies, but you need to document when the transaction occurred and confirm it's within the 2-year window.
Practically speaking: SMS review requests from legitimate businesses to recent customers are generally defensible under CASL's implied consent provision. But this area is less settled than email, and enforcement focus has been on bulk commercial messaging rather than individual business review requests.
The simplest way to avoid all CASL complexity for review collection is to use in-person NFC technology. When a customer taps their phone to a CAN-TAP puck or stand, no electronic message is sent by your business. The customer's phone initiates the interaction by reading the NFC chip. This is outside CASL's jurisdiction entirely.
For businesses concerned about CASL exposure — particularly those in regulated industries or those who have received previous CASL complaints — in-person NFC collection is the cleanest compliance path.
If you use email to request reviews: - Send only to customers with a documented transaction in the last 2 years - Include a genuine, functioning unsubscribe link (not just 'reply STOP') - Include your physical business address - Send no more than one review request per customer per service interaction - Use honest subject lines - Keep records of consent (when the transaction occurred, what consent was given)
For most small businesses asking their own recent customers by email, the risk profile is low and the implied consent provision provides reasonable coverage. The CRTC has historically focused CASL enforcement on mass commercial spammers, not small businesses with genuine existing customer relationships.
CAN-TAP NFC cards make it effortless for customers to review you in 10 seconds. Pre-programmed to your Google Business Profile. Ships anywhere in Canada in 2 days.
Collect Reviews Without Email — NFC Kit →No. Sending a review request link through Google's own tools (like the 'Share review form') doesn't constitute a commercial electronic message under CASL because Google manages the delivery.
Individual fines can reach $1 million per violation. Corporate fines can reach $10 million per violation. In practice, enforcement has focused on bulk spammers, not businesses making good-faith review requests to their own customers.
No. Registration is not required for commercial email senders under CASL. Compliance with consent, identification, and unsubscribe requirements is what matters.
Public social media posts asking customers to review you are generally not CEMs under CASL — they're public messages, not targeted at specific individuals. Direct messages on social media could be CEMs and should follow the same consent principles as email.
Yes. A link in a standard business email signature is generally not considered a CEM for CASL purposes — it's incidental to an existing communication, not a standalone commercial message.