Rules
PIPEDA and CASL Consent Workflows for Marketing Automation
PIPEDA and CASL consent workflows decide what Canadian marketing automation can send, keep and prove. A guide to the federal rules, the records and the regulators.
What to take away
- Two federal statutes govern most Canadian marketing emailPIPEDA covers personal information, and CASL covers the message itself.
- Consent must be positive, documented and tied to a stated purpose. A pre-ticked box or a bought list fails both tests.
- The Office of the Privacy Commissioner of Canada and the CRTC are separate regulators with separate powers.
- Provincial privacy law applies on top of the federal rules in Quebec, British Columbia and Alberta.
- The sender bears the burden of proof, so the record matters more than the wording on the form.
PIPEDA and CASL consent workflows live inside the marketing automation platform. A form fill can create the contact, stamp the source and start a welcome series in one pass. If the workflow stores no proof of the opt-in, that same pass creates a compliance gap.
Mapping identity and triggers before writing copy tends to settle the consent questions early, and designing marketing automation covers that order of work.
Regulators, triggers and tools for a Canadian send
CASL applies to every commercial electronic message sent from Canada or received in Canada, including a message sent to one address. The CRTC enforces it and can act on a single complaint. The full text of CASL sets out the consent, identification and unsubscribe requirements.
Who Enforces What
CASL
- Scope
- Messages sent or received in Canada
- Regulator
- CRTC
- Trigger
- Single complaint
- Coverage
- Nationwide
PIPEDA
- Scope
- Private-sector organizations
- Regulator
- OPC
- Trigger
- Complaint to Commissioner
- Coverage
- Provinces without similar law
PIPEDA is enforced by the Office of the Privacy Commissioner of Canada. It covers private-sector organizations in provinces without a substantially similar law, and federal works such as banks and airlines. The OPC publishes guidance on PIPEDA for those organizations.
The tools below can store consent state or connect the systems that do. Each row shows a workflow job and a public plan or contract note.
Regulators, triggers and tools
Consent workflow job
- HubSpot
- Stores opt-in status in contact properties and subscription types, then fires workflows from that field
- Salesforce Marketing Cloud
- Carries consent flags through Journey Builder and Data Extensions
- Mailchimp
- Records opt-in source and tags on the audience record
- Klaviyo
- Keeps email and SMS consent on each profile
- ActiveCampaign
- Stamps consent date into a custom field and starts automations
- OneTrust
- Manages form and cookie consent with consent receipts and APIs
- Segment
- Routes consent state from a profile to connected tools
- Zapier
- Connects form tools to a CRM without code
- Make
- Builds custom consent triggers between apps
Plan or limit to know
- HubSpot
- Free CRM; Marketing Hub Starter commonly published near $20 per seat per month
- Salesforce Marketing Cloud
- Enterprise contracts, usually quoted annually with a CRM admin
- Mailchimp
- Free plan supports up to 500 contacts and 1,000 sends per month
- Klaviyo
- Free plan for up to 250 contacts and 500 sends per month
- ActiveCampaign
- Starter plan commonly published near $29 per month for 1,000 contacts
- OneTrust
- Enterprise pricing, usually annual
- Segment
- Free tier includes 1,000 monthly tracked users
- Zapier
- Free plan includes 100 tasks per month
- Make
- Free plan includes 1,000 operations per month
Quebec, British Columbia and Alberta each have their own private-sector statute and their own commissioner. One national campaign can draw questions from two or three regulators.
Consent record fields a workflow must disclose and store
Under PIPEDA, consent is valid only when the person understands what they are agreeing to. A compliant disclosure names the organization, states the purpose of the collection, describes the type of messages the person will receive, and explains how to withdraw. The OPC's compliance help for businesses sets out those duties in more detail.
CASL adds requirements at the message level. Every message must carry the sender's name, a mailing address, and at least one contact method, such as an email address or a web form. The unsubscribe mechanism must keep working for at least 60 days after the message is sent. CASL gives the sender 10 days to process an unsubscribe request.
The wording shown at collection is the part most teams cannot reconstruct later, which is where marketing data governance earns its place.
Consent records to keep in the CRM
- The date and time each contact gave consent
- The source, whether a web form, a store sign-up, an event list or a paper slip
- The wording the person saw, including the label on the checkbox
- The purpose stated at the time, such as a newsletter or product updates
- The date of each unsubscribe request and the date it was processed
PIPEDA does not set a fixed retention period. The working rule is to keep consent evidence for as long as you rely on it, and to delete personal information once the stated purpose is met.
Consent Records To Keep
- Date and time consent was given
- Sourceweb form, store, event, paper
- Wording seen, including checkbox label
- Purpose stated at the time
- Date of unsubscribe request
- Date unsubscribe was processed
Under CASL the burden of proof sits with the sender. Consent evidence held in a queryable CRM field is easier to produce, and CRM strategy works only when that field is defined before the first campaign.
A list bought from a broker is not consent. The sender has to point to the moment the recipient agreed, not to the vendor who sold the file.
Penalties and court orders for noncompliance
The CRTC can issue an administrative monetary penalty to a company or to an individual, order the sender to stop, and publish the decision with the name of the business. Directors and officers who directed the violation can be named as well.
A PIPEDA complaint can go to the Privacy Commissioner and then to Federal Court, which can award damages and order changes to an organization's practices.
Provincial privacy rules for a multi-province campaign
Provincial privacy rules
| Recipient's province | Main privacy statute | Regulator |
|---|---|---|
| Most provinces and territories | PIPEDA | Office of the Privacy Commissioner of Canada |
| Quebec | Quebec private-sector privacy law, amended by Law 25 | Commission d'acces a l'information du Quebec |
| British Columbia | BC PIPA | Office of the Information and Privacy Commissioner for BC |
| Alberta | Alberta PIPA | Office of the Information and Privacy Commissioner of Alberta |
Quebec's Law 25 tightened consent and transparency duties in the province. British Columbia and Alberta run their own consent and breach rules for the organizations they regulate.
CASL still applies nationwide because it is a federal law. A campaign reaching several provinces must satisfy the strictest rule it touches, one reason reading marketing operations with a skeptical eye pays off.
Quebec also requires commercial communications in French, a duty that sits beside consent rather than replacing it.
