Defining Consent (Both Expressed and Implied) -- Canada's Anti-Spam Laws Simplified and Demystified

At the core of Canada's anti-Spam laws, which come into effect July 1, 2014, is the word "consent." Essentially, as we discussed yesterday in our introductory anti-Spam blog post, this legislation is mandating courtesy – and that starts with asking and receiving permission.

I remember attending a conference in Chicago about 10 years ago where we talked about these very issues. Back then, we identified "best practices" similar to what the law enacts -- and I've been lucky to work in places that adhere to these basic principles. But not every company does. So now we're at the point where we have to legislate courtesy.

We identified the three basic rules to ensure compliance:

• Obtain consent
• Clearly identify yourself
• Make it easy to unsubscribe

Today we focus on consent. Consent can be explicit or implied – but, going forward, you have to make sure it's documented and it's legit.

Gone are the days when companies would ask you to enter into a draw and use that e-mail to contact you. Now, you'll have to ask up front for that permission. And remember the halcyon days of negative-option billing (where is that sarcasm font)? Well, you can't pre-check or bundle agreements in a long and convoluted series of conditions within a contract. (You know, how people never read those Terms and Conditions? Not an excuse).

The easiest way to move forward is to ask clearly for permission to message someone up front, then confirm it with a follow-up message.

And make sure you keep records of all the consent. You may be asked to identify when consent was first obtained. So if you've collected a bunch of e-mail contacts at a trade event, keep them on file. If you're storing the information in a database, you may want to add a field, which you can keep hidden, that allows you to enter the location and/or date of obtained consent.

But what does "implied" consent mean?

Simply put, if you've entered into an interaction where there is a reasonable expectation of a follow-up message, then you've obtained "implied" consent. Examples of this would be a conversation at a trade show where you've indicated you're going to follow-up, or the sharing of a business card with contact information.

Explicit consent is more direct. By filling out a clearly defined sign-up form for an e-mail, a newsletter, or quote, the user is providing you with that explicit consent – and that's good in perpetuity, assuming the recipient does not formally request you cease communications.

So how does this work in real-life? And what about your existing contacts?

If you have an existing relationship – e.g., people who have been receiving your electronic newsletter – you have three grandfathered years to convert them to expressed consent. You can do that simply by sending out an e-mail and asking. Same thing going forward with your new sign-ups -- just having them formally request content isn't enough. You need to follow up with an e-mail confirming their request and then keep the affirmative response on file.

For implied consent interactions, such as the exchange of business cards at a trade show, you have two years of interactions available, unless you can convert them to a formal expressed consent. This is particularly important in sales relationships, where you can interact – assuming the other party doesn't ask you to stop – as per usual for a two-year period. By that point, hopefully, you've entered into some form of formal agreement.

But what about cold-calling? Though this doesn't apply to telephone-based conversations (except, of course, if you're texting them), this doesn't mean the death-knell of the 'unsolicited' approach.

For example, you can still reach out to prospective clients through LinkedIn or Twitter. If they accept your request, you can connect with them – as a prospect/client relationship – for six months.

The better way is to introduce yourself and express your intent through a direct message. If the person responds in a positive manner, for example, "Yes, I'd love to have more information," then that's considered expressed consent.

And if they say no? Stop.

Simple, right? Just ask, be polite, be honest and up front about your interactions and your intent, and you're good to go.

Now, the cumbersome part is documentation. There is no standard or protocol in place to help you determine the best way for you to keep track of your connections. However you best deem appropriate for you and your organization, just ensure there's a record someplace so that if you're ever questioned by the CRTC, you have the proof of your relationship.

Suggestions?

• Write down date/locations of meetings on the back of the business card;
• Hang on to any daytimers and notes you may have;
• Use a spreadsheet to track contacts, dates, and locations
• Archive e-mails in clearly identified folders
• Back up texts

Document the wheres and hows of consent acquisition. Be open and honest up front about what people are signing up for and how you're going to use it. Don't bundle consent in some serpentine, biz-speak-filled jargon-fest document hoping nobody's going to use it.

Basically, use common courtesy. Sadly, courtesy is not so common -- and that's why we have this legislation.

Your thoughts? Comments, as always, are open.