CASL for car dealers: consent rules for follow-up texts and emails

Follow-up is how used cars get sold. A shopper sends a question about a Tacoma on a Tuesday night, your salesperson replies on Wednesday, and three weeks later a text about a similar truck that just came in turns into a test drive. Every step of that is normal dealership work — and from the second message on, most of it is regulated by Canada's anti-spam legislation, CASL.

This is a plain-language walk through the parts of CASL that matter to a dealer's follow-up, with a link to the official page for each rule. It is written by the person who builds our CRM, not by a lawyer, so treat it as a map rather than advice. When something is on the line, check the source or ask counsel.

What CASL covers, in dealer terms

CASL applies to commercial electronic messages: messages that encourage someone to buy something, sent to an electronic address. For a dealer that means emails, and it also means texts. The government's own guidance for businesses that text says it directly: CASL is technology neutral, and you must obtain consent to send commercial electronic messages, including text messages. Its guidance on consent mentions email, SMS, instant messaging or similar platforms.

Phone calls are a different regime (the CRTC's telemarketing rules), and a shopper's personal information more broadly falls under the federal privacy law, PIPEDA, which applies to private businesses across the four Atlantic provinces. This article stays with texts and emails.

Two kinds of consent

CASL recognises express consent and implied consent. Almost every follow-up question comes down to which one you have, and when it ends.

Express consent

The shopper actively said yes to hearing from you — for example, by ticking an empty box on your credit application that says they agree to receive offers by email and text, or by saying so on a recorded call. According to the government guidance, express consent has no time limit unless the recipient withdraws it.

The detail that trips up dealer websites is how the box is set. The CRTC's bulletin on toggling explains that a pre-checked box puts the onus on the person to opt out, and that kind of inaction is not express consent (CRTC 2012-549). The box has to start empty and the shopper has to tick it.

A second detail: the request for consent to receive messages cannot be buried inside the general terms. The CRTC says it must not be bundled with consent to the terms and conditions of use or sale — a shopper must be able to accept your terms while refusing marketing messages (CRTC 2012-548). The same bulletin says a request for consent must include a statement that the person can withdraw it.

Implied consent

You can also have consent without asking, through an existing business relationship. The two windows dealers need to know:

• —after a purchase, implied consent lasts up to two years;
• —after an inquiry or an application, it lasts six months.

Both windows are set out in the government's consent guidance, which also warns that if you rely on an existing business relationship, you must make sure each message is sent within the right time frame.

In practice: the shopper who asked about the Tacoma on Tuesday made an inquiry. You can follow up with commercial messages for six months from that inquiry. If they buy the truck, the clock changes to two years from the purchase. If you want to keep in touch longer than that — for a trade-in offer at year three, say — you need express consent, and the easiest time to ask for it is while the relationship is fresh.

What to send inside that window, from the first reply to the last attempt, is laid out in the first hour after an internet lead.

What every follow-up message must contain

Consent is half of it. The other half is what goes in the message itself, whether email or text:

• —Who it is from. Your business name, and the name of anyone you are sending on behalf of. The texting guidance asks businesses to include their name in commercial messages, including texts.
• —How to reach you. A mailing address and a phone number, email or website. The government guidance says this contact information must stay valid for at least 60 days after you send the message.
• —A way to unsubscribe. It must be easy to use — the CRTC's wording is that it must be "readily performed" — and free.

Unsubscribes have a deadline. The guidance says every unsubscribe request must be actioned within 10 business days or less and at no cost to the recipient. For texts, the government's advice is short: when you receive a "STOP" text from a customer, respect it.

Where dealers usually get it wrong

None of the following is unusual. Each is easy to fix once someone owns it.

• —The salesperson's personal phone. Follow-up texts from a personal mobile have no record of consent, no unsubscribe handling and no way to see that a shopper asked to stop. When that salesperson leaves, the history leaves too.
• —Buying or importing lists. An email list from a previous owner, an event or a partner does not come with your consent attached.
• —"They bought from us in 2019." Implied consent from a purchase runs for two years. An old customer list without express consent is not a mailing list.
• —Pre-checked boxes on credit apps, trade-in forms and chat widgets.
• —A STOP that only one system heard. The shopper texts STOP, the text system honours it, and the email newsletter goes out anyway because the two systems do not share a list.
• —No proof. The government guidance says senders should be ready to provide proof of consent if asked. "She said it was fine on the lot" is not a record.

How to set your CRM up so this is mostly automatic

You cannot make a person remember a six-month window for every shopper. You can make the system remember it.

1. 01Record where each lead came from and when. A web inquiry, a chat, a credit application and a purchase each start a different clock. The CRM should store the type and the date as soon as the lead lands.
2. 02Store consent as data, not as a note. For each person: what they agreed to (email, text or both), how (the form, the chat, a call), when, and the exact wording they agreed to. Keep it for as long as you rely on it.
3. 03Calculate the expiry. Six months from the inquiry, two years from the purchase, none for express consent until it is withdrawn. Show it on the lead card so a salesperson sees it before they hit send.
4. 04One opt-out list for every channel. An unsubscribe from email and a STOP by text should land in the same place, and every sending tool should check it.
5. 05Ask for express consent at the right moments. On the credit application, at delivery, in the chat after a useful answer — with an empty box and clear words.

This is the kind of work we do on the CRM side. On our builds, every lead lands as a card with the shopper's own words, where they came from and when, and the database belongs to the dealer — which matters here, because the consent record is part of the customer record. If you change vendors, the proof of consent should leave with you. There is more on that in who owns your dealer CRM data.

A one-page checklist

• Every web form, chat and credit application that asks for marketing consent uses an empty box and separate wording from your terms.
• Each lead stores its source, its date and its consent status.
• Your CRM shows when implied consent runs out (six months after an inquiry, two years after a purchase).
• Every commercial email and text identifies your dealership and how to reach you.
• Unsubscribes and STOP replies reach one shared list and are processed well inside 10 business days.
• Follow-up texts go through a business system, not personal phones.
• You can show proof of consent for anyone you message.

If you want a second pair of eyes on your forms and your follow-up flow, the free lot check includes a look at what your site collects and where it goes. For the rules themselves, the official pages listed under this article are the place to check.