Opt-out

How BC law treats it

Under the Personal Information Protection Act, SBC 2003, c 63 (PIPA), organizations need consent to collect, use or disclose personal information, but consent may be express, implied or deemed. PIPA also permits opt-out consent: the organization gives the individual clear notice of the purpose and a reasonable opportunity to decline, the individual does not decline, and the use is reasonable given how sensitive the information is (s. 8(3)). Opt-out is not appropriate for sensitive information such as health or financial details. Organizations covered by the federal Personal Information Protection and Electronic Documents Act, SC 2000, c 5 (PIPEDA) follow similar consent principles. Email and text marketing is different. Canada's Anti-Spam Legislation, SC 2010, c 23 (CASL), s. 6, prohibits sending a commercial electronic message without the recipient's prior express or implied consent. A pre-checked box or "we will email you unless you object" is not valid express consent. Every message must identify the sender and include an unsubscribe mechanism, and unsubscribe requests must be given effect within 10 business days, and the mechanism must remain valid for at least 60 days after the message is sent (s. 11). Implied consent, such as from an existing business relationship, is time-limited. "Opt-out" also has a litigation meaning. BC class actions under the Class Proceedings Act, RSBC 1996, c 50 are opt-out proceedings, and since October 1, 2018 that includes class members who live outside BC: once the BC Supreme Court certifies a class, members are bound by the result unless they opt out by the deadline the court sets.

What it means for your business

Marketing teams often assume an unsubscribe link makes it lawful to email anyone. Under CASL it does not, and penalties can be severe. Privacy notices that rely on opt-out consent must be clear and limited to non-sensitive uses, or the consent may be invalid under PIPA. Businesses facing a class action, or that are members of a certified class, need to track opt-out deadlines because staying in the class means accepting the outcome. Example: A Vancouver retailer adds a pre-checked "send me offers" box to its checkout page. That box does not give express consent under CASL, so the retailer changes it to an unchecked box the customer must actively tick.

Risks and common mistakes

Treating an unsubscribe link as a substitute for prior consent to send marketing emails. Using pre-checked boxes to obtain express consent under CASL. Relying on opt-out consent for sensitive personal information. Taking longer than 10 business days to process unsubscribe requests. Missing a class action opt-out deadline and being bound by a settlement.