An Act to promote the efficiency and adaptability of the Canadian economy by regulating certain activities that discourage reliance on electronic means of carrying out commercial activities (Canada's Anti-Spam Legislation), S.C. 2010, c. 23 (ss. 1 to 13 and s. 20)

Section 1§Sections Definitions

(1) The following definitions apply in this Act.

commercial activity means any particular transaction, act or conduct or any regular course of conduct that is of a commercial character, whether or not the person who carries it out does so in the expectation of profit, other than any transaction, act or conduct that is carried out for the purposes of law enforcement, public safety, the protection of Canada, the conduct of international affairs or the defence of Canada. (activité commerciale)

Commission means the Canadian Radio-television and Telecommunications Commission. (Conseil)

Commissioner of Competition means the Commissioner of Competition appointed under subsection 7(1) of the Competition Act. (commissaire de la concurrence)

computer program has the same meaning as in subsection 342.1(2) of the Criminal Code. (programme d’ordinateur)

computer system has the same meaning as in subsection 342.1(2) of the Criminal Code. (ordinateur)

court of competent jurisdiction means the Federal Court or a superior court of a province. (tribunal compétent)

data means signs, signals, symbols or concepts that are being prepared or have been prepared in a form suitable for use in a computer system. (données)

document has the same meaning as in section 487.011 of the Criminal Code. (document)

electronic address means an address used in connection with the transmission of an electronic message to

(a) an electronic mail account;

(b) an instant messaging account;

(c) a telephone account; or

(d) any similar account. (adresse électronique)

electronic message means a message sent by any means of telecommunication, including a text, sound, voice or image message. (message électronique)

person means an individual, partnership, corporation, organization, association, trustee, administrator, executor, liquidator of a succession, receiver or legal representative. (personne)

Privacy Commissioner means the Privacy Commissioner appointed under section 53 of the Privacy Act. (Commissaire à la protection de la vie privée)

telecommunications facility means any facility, apparatus or other thing that is used for telecommunications or for any operation directly connected with telecommunications. (installation de télécommunication)

telecommunications service means a service, or a feature of a service, that is provided by means of telecommunications facilities, whether the telecommunications service provider owns, leases or has any other interest in or right respecting the telecommunications facilities and any related equipment used to provide the service. (service de télécommunication)

telecommunications service provider means a person who, independently or as part of a group or association, provides telecommunications services. (télécommunicateur)

transmission data means data that

(a) relates to the telecommunications functions of dialling, routing, addressing or signalling;

(b) either is transmitted to identify, activate or configure an apparatus or device, including a computer program, in order to establish or maintain a communication, or is generated during the creation, transmission or reception of a communication and identifies or purports to identify the type, direction, date, time, duration, size, origin, destination or termination of the communication; and

(c) does not reveal the substance, meaning or purpose of the communication. (données de transmission)

Meaning of commercial electronic message

(2) For the purposes of this Act, a commercial electronic message is an electronic message that, having regard to the content of the message, the hyperlinks in the message to content on a website or other database, or the contact information contained in the message, it would be reasonable to conclude has as its purpose, or one of its purposes, to encourage participation in a commercial activity, including an electronic message that

(a) offers to purchase, sell, barter or lease a product, goods, a service, land or an interest or right in land;

(b) offers to provide a business, investment or gaming opportunity;

(c) advertises or promotes anything referred to in paragraph (a) or (b); or

(d) promotes a person, including the public image of a person, as being a person who does anything referred to in any of paragraphs (a) to (c), or who intends to do so.

Other commercial electronic message

(3) An electronic message that contains a request for consent to send a message described in subsection (2) is also considered to be a commercial electronic message.

Exclusion

(4) An electronic message described in subsection (2) or (3) that is sent for the purposes of law enforcement, public safety, the protection of Canada, the conduct of international affairs or the defence of Canada is not considered to be a commercial electronic message.

Person to whom a message is sent

(5) For the purposes of this Act, a reference to the person to whom an electronic message is sent means the holder of the account associated with the electronic address to which the message is sent, as well as any person who it is reasonable to believe is or might be authorized by the account holder to use the electronic address.

Section 2§Sections Precedence of this Act

In the event of a conflict between a provision of this Act and a provision of Part 1 of the Personal Information Protection and Electronic Documents Act, the provision of this Act operates despite the provision of that Part, to the extent of the conflict.

Section 3§Sections Purpose of Act

The purpose of this Act is to promote the efficiency and adaptability of the Canadian economy by regulating commercial conduct that discourages the use of electronic means to carry out commercial activities, because that conduct

(a) impairs the availability, reliability, efficiency and optimal use of electronic means to carry out commercial activities;

(b) imposes additional costs on businesses and consumers;

(c) compromises privacy and the security of confidential information; and

(d) undermines the confidence of Canadians in the use of electronic means of communication to carry out their commercial activities in Canada and abroad.

Section 4§Sections Act binding on certain agents

This Act is binding on any corporation that is expressly declared by or under any Act of Parliament or of the legislature of a province to be an agent of Her Majesty, when the corporation is acting as such in the course of any commercial activity.

Section 5§Sections Broadcasting excluded

This Act does not apply in respect of broadcasting by a broadcasting undertaking, other than an online undertaking, as those terms are defined in subsection 2(1) of the Broadcasting Act.

2010, c. 23, s. 5; 2023, c. 8, s. 32

Section 6§Sections Unsolicited electronic messages

(1) It is prohibited to send or cause or permit to be sent to an electronic address a commercial electronic message unless

(a) the person to whom the message is sent has consented to receiving it, whether the consent is express or implied; and

(b) the message complies with subsection (2).

Contents of message

(2) The message must be in a form that conforms to the prescribed requirements and must

(a) set out prescribed information that identifies the person who sent the message and the person — if different — on whose behalf it is sent;

(b) set out information enabling the person to whom the message is sent to readily contact one of the persons referred to in paragraph (a); and

(c) set out an unsubscribe mechanism in accordance with subsection 11(1).

Period of validity of contact information

(3) The person who sends the commercial electronic message and the person — if different — on whose behalf the commercial electronic message is sent must ensure that the contact information referred to in paragraph (2)(b) is valid for a minimum of 60 days after the message has been sent.

Interpretation

(4) For the purposes of subsection (1)

(a) an electronic message is considered to have been sent once its transmission has been initiated; and

(b) it is immaterial whether the electronic address to which an electronic message is sent exists or whether an electronic message reaches its intended destination.

Exception

(5) This section does not apply to a commercial electronic message

(a) that is sent by or on behalf of an individual to another individual with whom they have a personal or family relationship, as defined in the regulations;

(b) that is sent to a person who is engaged in a commercial activity and consists solely of an inquiry or application related to that activity; or

(c) that is of a class, or is sent in circumstances, specified in the regulations.

Exception

(6) Paragraph (1)(a) does not apply to a commercial electronic message that solely

(a) provides a quote or estimate for the supply of a product, goods, a service, land or an interest or right in land, if the quote or estimate was requested by the person to whom the message is sent;

(b) facilitates, completes or confirms a commercial transaction that the person to whom the message is sent previously agreed to enter into with the person who sent the message or the person — if different — on whose behalf it is sent;

(c) provides warranty information, product recall information or safety or security information about a product, goods or a service that the person to whom the message is sent uses, has used or has purchased;

(d) provides notification of factual information about

(i) the ongoing use or ongoing purchase by the person to whom the message is sent of a product, goods or a service offered under a subscription, membership, account, loan or similar relationship by the person who sent the message or the person — if different — on whose behalf it is sent, or

(ii) the ongoing subscription, membership, account, loan or similar relationship of the person to whom the message is sent;

(e) provides information directly related to an employment relationship or related benefit plan in which the person to whom the message is sent is currently involved, is currently participating or is currently enrolled;

(f) delivers a product, goods or a service, including product updates or upgrades, that the person to whom the message is sent is entitled to receive under the terms of a transaction that they have previously entered into with the person who sent the message or the person — if different — on whose behalf it is sent; or

(g) communicates for a purpose specified in the regulations.

Exception

(7) This section does not apply to a telecommunications service provider merely because the service provider provides a telecommunications service that enables the transmission of the message.

Exception

(7.1) This section does not apply to a commercial electronic message that is sent or caused or permitted to be sent by an online undertaking, as defined in subsection 2(1) of the Broadcasting Act, if

(a) the person to whom the message is sent has expressly or implicitly consented to the transmission of a program, as defined in that subsection, from that online undertaking to an electronic address; and

(b) the message is or forms part of that program or is sent in the course of the transmission of that program to the electronic address to which that program is transmitted.

Exception

(8) This section does not apply to a commercial electronic message

(a) that is, in whole or in part, an interactive two-way voice communication between individuals;

(b) that is sent by means of a facsimile to a telephone account; or

(c) that is a voice recording sent to a telephone account.

2010, c. 23, s. 6; 2023, c. 8, s. 33

Section 7§Sections Altering transmission data

(1) It is prohibited, in the course of a commercial activity, to alter or cause to be altered the transmission data in an electronic message so that the message is delivered to a destination other than or in addition to that specified by the sender, unless

(a) the alteration is made with the express consent of the sender or the person to whom the message is sent, and the person altering or causing to be altered the data complies with subsection 11(4); or

(b) the alteration is made in accordance with a court order.

Exception

(2) Subsection (1) does not apply if the alteration is made by a telecommunications service provider for the purposes of network management.

Section 8§Sections Installation of computer program

(1) A person must not, in the course of a commercial activity, install or cause to be installed a computer program on any other person’s computer system or, having so installed or caused to be installed a computer program, cause an electronic message to be sent from that computer system, unless

(a) the person has obtained the express consent of the owner or an authorized user of the computer system and complies with subsection 11(5); or

(b) the person is acting in accordance with a court order.

Application

(2) A person contravenes subsection (1) only if the computer system is located in Canada at the relevant time or if the person either is in Canada at the relevant time or is acting under the direction of a person who is in Canada at the time when they give the directions.

Section 9§Sections Contravention of sections 6 to 8

It is prohibited to aid, induce, procure or cause to be procured the doing of any act contrary to any of sections 6 to 8.

Section 10§Sections Express consent — sections 6 to 8

(1) A person who seeks express consent for the doing of an act described in any of sections 6 to 8 must, when requesting consent, set out clearly and simply the following information:

(a) the purpose or purposes for which the consent is being sought;

(b) prescribed information that identifies the person seeking consent and, if the person is seeking consent on behalf of another person, prescribed information that identifies that other person; and

(c) any other prescribed information.

Exception

(2) Despite paragraph (1)(b), for the purposes of section 6, if a person is seeking express consent on behalf of a person whose identity is not known,

(a) the only information that is required to be provided under that paragraph is prescribed information that identifies the person seeking consent; and

(b) the person seeking consent must comply with the regulations in respect of the use that may be made of the consent and the conditions on which the consent may be used.

Additional requirement — section 8

(3) A person who seeks express consent for the doing of any act described in section 8 must, when requesting consent, also, in addition to setting out any other prescribed information, clearly and simply describe, in general terms, the function and purpose of the computer program that is to be installed if the consent is given.

Additional requirements associated with certain functions

(4) In addition to the requirements set out in subsections (1) and (3), if the computer program that is to be installed performs one or more of the functions described in subsection (5), the person who seeks express consent must, when requesting consent, clearly and prominently, and separately and apart from the licence agreement,

(a) describe the program’s material elements that perform the function or functions, including the nature and purpose of those elements and their reasonably foreseeable impact on the operation of the computer system; and

(b) bring those elements to the attention of the person from whom consent is being sought in the prescribed manner.

Description of functions

(5) A function referred to in subsection (4) is any of the following functions that the person who seeks express consent knows and intends will cause the computer system to operate in a manner that is contrary to the reasonable expectations of the owner or an authorized user of the computer system:

(a) collecting personal information stored on the computer system;

(b) interfering with the owner’s or an authorized user’s control of the computer system;

(c) changing or interfering with settings, preferences or commands already installed or stored on the computer system without the knowledge of the owner or an authorized user of the computer system;

(d) changing or interfering with data that is stored on the computer system in a manner that obstructs, interrupts or interferes with lawful access to or use of that data by the owner or an authorized user of the computer system;

(e) causing the computer system to communicate with another computer system, or other device, without the authorization of the owner or an authorized user of the computer system;

(f) installing a computer program that may be activated by a third party without the knowledge of the owner or an authorized user of the computer system; and

(g) performing any other function specified in the regulations.

Exception

(6) Subsection (4) does not apply in respect of a computer program that performs a function described in subsection (5) if that function only collects, uses or communicates transmission data or performs an operation specified in the regulations.

Updates and upgrades

(7) Subsections (1) and (3) do not apply in respect of the installation of an update or upgrade to a computer program the installation or use of which was expressly consented to in accordance with subsections (1) and (3) if the person who gave the consent is entitled to receive the update or upgrade under the terms of the express consent and the update or upgrade is installed in accordance with those terms.

Person considered to expressly consent

(8) A person is considered to expressly consent to the installation of a computer program if

(a) the program is

(i) a cookie,

(ii) HTML code,

(iii) Java Scripts,

(iv) an operating system,

(v) any other program that is executable only through the use of another computer program whose installation or use the person has previously expressly consented to, or

(vi) any other program specified in the regulations; and

(b) the person’s conduct is such that it is reasonable to believe that they consent to the program’s installation.

Implied consent — section 6

(9) For the purpose of section 6, except subsection 6(7.1), consent is implied only if

(a) the person who sends the message, the person who causes it to be sent or the person who permits it to be sent has an existing business relationship or an existing non-business relationship with the person to whom it is sent;

(b) the person to whom the message is sent has conspicuously published, or has caused to be conspicuously published, the electronic address to which the message is sent, the publication is not accompanied by a statement that the person does not wish to receive unsolicited commercial electronic messages at the electronic address and the message is relevant to the person’s business, role, functions or duties in a business or official capacity;

(c) the person to whom the message is sent has disclosed, to the person who sends the message, the person who causes it to be sent or the person who permits it to be sent, the electronic address to which the message is sent without indicating a wish not to receive unsolicited commercial electronic messages at the electronic address, and the message is relevant to the person’s business, role, functions or duties in a business or official capacity; or

(d) the message is sent in the circumstances set out in the regulations.

Definition of existing business relationship

(10) In subsection (9), existing business relationship means a business relationship between the person to whom the message is sent and any of the other persons referred to in that subsection — that is, any person who sent or caused or permitted to be sent the message — arising from

(a) the purchase or lease of a product, goods, a service, land or an interest or right in land, within the two-year period immediately before the day on which the message was sent, by the person to whom the message is sent from any of those other persons;

(b) the acceptance by the person to whom the message is sent, within the period referred to in paragraph (a), of a business, investment or gaming opportunity offered by any of those other persons;

(c) the bartering of anything mentioned in paragraph (a) between the person to whom the message is sent and any of those other persons within the period referred to in that paragraph;

(d) a written contract entered into between the person to whom the message is sent and any of those other persons in respect of a matter not referred to in any of paragraphs (a) to (c), if the contract is currently in existence or expired within the period referred to in paragraph (a); or

(e) an inquiry or application, within the six-month period immediately before the day on which the message was sent, made by the person to whom the message is sent to any of those other persons, in respect of anything mentioned in any of paragraphs (a) to (c).

Clarification

(11) For the purposes of subsection (10), the following organizations are considered to be businesses:

(a) a cooperative as defined in subsection 2(1) of the Canada Cooperatives Act;

(b) a cooperative corporation as defined in section 2 of the Cooperative Credit Associations Act; and

(c) any similar organization incorporated under an Act of Parliament or the legislature of a province.

Clarification

(12) If a person has an existing business relationship with another person in accordance with subsection (10), and the business is sold, the person who purchases the business is considered to have, in respect of that business, an existing business relationship with that other person.

Definition of existing non-business relationship

(13) In subsection (9), existing non-business relationship means a non-business relationship between the person to whom the message is sent and any of the other persons referred to in that subsection — that is, any person who sent or caused or permitted to be sent the message — arising from

(a) a donation or gift made by the person to whom the message is sent to any of those other persons within the two-year period immediately before the day on which the message was sent, where that other person is a registered charity as defined in subsection 248(1) of the Income Tax Act, a political party or organization, or a person who is a candidate — as defined in an Act of Parliament or of the legislature of a province — for publicly elected office;

(b) volunteer work performed by the person to whom the message is sent for any of those other persons, or attendance at a meeting organized by that other person, within the two-year period immediately before the day on which the message was sent, where that other person is a registered charity as defined in subsection 248(1) of the Income Tax Act, a political party or organization or a person who is a candidate — as defined in an Act of Parliament or of the legislature of a province — for publicly elected office; or

(c) membership, as defined in the regulations, by the person to whom the message is sent, in any of those other persons, within the two-year period immediately before the day on which the message was sent, where that other person is a club, association or voluntary organization, as defined in the regulations.

Clarification

(14) Where a period is specified in subsection (10) or (13) in relation to the purchase or lease of a product, goods, a service, land or an interest or right in land, or in relation to a donation, gift or membership,

(a) in the case of a purchase, lease, donation or gift, if it involves an ongoing use or ongoing purchase under a subscription, account, loan or similar relationship, the period is considered to begin on the day that the subscription, account, loan or other relationship terminates; and

(b) in the case of a membership, the period is considered to begin on the day that the membership terminates.

2010, c. 23, s. 10; 2023, c. 8, s. 34

Section 11§Sections Unsubscribe mechanism — section 6

(1) The unsubscribe mechanism referred to in paragraph 6(2)(c) must

(a) enable the person to whom the commercial electronic message is sent to indicate, at no cost to them, the wish to no longer receive any commercial electronic messages, or any specified class of such messages, from the person who sent the message or the person — if different — on whose behalf the message is sent, using

(i) the same electronic means by which the message was sent, or

(ii) if using those means is not practicable, any other electronic means that will enable the person to indicate the wish; and

(b) specify an electronic address, or link to a page on the World Wide Web that can be accessed through a web browser, to which the indication may be sent.

Period of validity of contact information

(2) The person who sends the commercial electronic message and the person — if different — on whose behalf it is sent must ensure that the electronic address or World Wide Web page referred to in paragraph (1)(b) is valid for a minimum of 60 days after the message has been sent.

Additional requirement

(3) The person who sent the commercial electronic message and the person — if different — on whose behalf the message was sent must ensure that effect is given to an indication sent in accordance with paragraph (1)(b) without delay, and in any event no later than 10 business days after the indication has been sent, without any further action being required on the part of the person who so indicated.

Withdrawal of consent — section 7

(4) A person who has the express consent of the sender or the person to whom a message is sent to do any act described in section 7 must

(a) for the period covered by the consent, ensure that the person who gave their consent is provided with an electronic address to which they may send notice of the withdrawal of their consent; and

(b) ensure that effect is given to a notice of withdrawal of consent sent in accordance with paragraph (a) without delay, but in any event no later than 10 business days after receiving it.

Withdrawal of consent — section 8

(5) A person who has the express consent of an owner or authorized user to do any act described in section 8 must

(a) for a period of one year after any computer program that performs one or more of the functions described in subsection 10(5) but not referred to in subsection 10(6) is installed under the consent, ensure that the person who gave their consent is provided with an electronic address to which they may, if they believe that the function, purpose or impact of the computer program installed under the consent was not accurately described when consent was requested, send a request to remove or disable that computer program; and

(b) if the consent was based on an inaccurate description of the material elements of the function or functions described in subsection 10(5), on receipt within that one-year period of a request to remove or disable that computer program, without cost to the person who gave consent, assist that person in removing or disabling the computer program as soon as feasible.

Section 12§Sections Contravention of section 6

(1) A person contravenes section 6 only if a computer system located in Canada is used to send or access the electronic message.

Contravention of section 7

(2) A person contravenes section 7 only if a computer system located in Canada is used to send, route or access the electronic message.

Section 13§Sections Burden of proof

A person who alleges that they have consent to do an act that would otherwise be prohibited under any of sections 6 to 8 has the onus of proving it.

Section 20§Sections Violations

(1) Every person who contravenes any of sections 6 to 9 commits a violation for which they are liable to an administrative monetary penalty.

Purpose of penalty

(2) The purpose of a penalty is to promote compliance with this Act and not to punish.

Factors for penalty

(3) The following factors must be taken into account when determining the amount of a penalty:

(a) the purpose of the penalty;

(b) the nature and scope of the violation;

(c) the person’s history with respect to any previous violation under this Act, any previous conduct that is reviewable under section 74.011 of the Competition Act and any previous contravention of section 5 of the Personal Information Protection and Electronic Documents Act that relates to a collection or use described in subsection 7.1(2) or (3) of that Act;

(d) the person’s history with respect to any previous undertaking entered into under subsection 21(1) and any previous consent agreement signed under subsection 74.12(1) or 74.131(1) of the Competition Act that relates to acts or omissions that constitute conduct that is reviewable under section 74.011 of that Act;

(e) any financial benefit that the person obtained from the commission of the violation;

(f) the person’s ability to pay the penalty;

(g) whether the person has voluntarily paid compensation to a person affected by the violation;

(h) the factors established by the regulations; and

(i) any other relevant factor.

Maximum penalties

(4) The maximum penalty for a violation is $1,000,000 in the case of an individual, and $10,000,000 in the case of any other person.

Regulations

(5) The Governor in Council may make regulations

(a) designating provisions whose contravention constitutes a separate violation in respect of each day during which it continues; and

(b) establishing factors for the purposes of paragraph (3)(h).

2010, c. 23, s. 20; 2024, c. 15, s. 270