
CASL for car dealers: consent rules for follow-up texts and emails
A shopper asks about a truck on Tuesday. How long can you follow up, by text or email, and what has to be in the message? The official answers, in dealer terms.
Your customer list is the most valuable thing your dealership owns that is not parked on the lot. Here is how to find out whether you actually own it — before you need to leave.

Narrated by an AI voice designed for Roman — not Roman's own recording. The article below is the transcript.
Ask most dealers who owns their customer data and they will say "we do", without hesitating. Then ask them to send you a complete export of it — every customer, every lead, every note and every conversation, in a file you can open — by the end of the week. That is usually where the hesitation starts.
The question matters most at the moment you can least afford to find out the answer: when you want to change CRM, when a vendor raises prices, when a manager leaves with a phone full of customers, or when you sell the business. This article is about finding out now, while nothing depends on it. If you are choosing a website provider at the same time, the same question is one of the twelve to ask a provider.
When dealers think of their data, they think of the customer list. The valuable part is bigger than that:
That last one is easy to forget and expensive to lose. Under CASL, the government's guidance says senders should be ready to provide proof of consent if asked. If the proof lives in a system you can no longer open, it is not much use.
Many agreements say the dealer owns its data. Fewer say in what form you get it back, how quickly, at what cost, and whether that includes the history and notes or only a contact list. Ownership you cannot exercise is not much of an ownership.
If your CRM is a shared, multi-dealer platform, your records are rows in the vendor's database next to everyone else's. That is a normal way to build software, and it can be perfectly secure. It does mean every export, report or change goes through the vendor, on their timetable.
Leads in a salesperson's personal texts. A trade-in conversation in one manager's email. Website chats that live in the chat vendor's dashboard and nowhere else. Data that was never captured is the most common kind of lost data, and no contract fixes it. Getting every lead source into one place is also the first item on the first-hour checklist for internet leads.
Send these in writing and keep the answers.
The last question is the most revealing. If the answer is yes, try it.
The contract tells you who owns the data. The export tells you whether you can take it with you.
Roman · CRMPick a quiet afternoon and run the export your vendor offers. Then open it and check:
If the export is a contact list and nothing else, you now know what leaving would really cost.
Ownership comes with responsibility. The federal privacy law, PIPEDA, applies to private-sector organisations across Canada that collect, use or disclose personal information in commercial activity — which covers dealers in all four Atlantic provinces (PIPEDA in brief).
The Privacy Commissioner's guidance on accountability is the part that matters when a vendor holds your data. It says you must protect all personal information your organisation holds, including any personal information you transfer to a third party for processing, and ensure through contractual or other means that the third party provides a comparable level of protection. In plain terms: hiring a CRM vendor does not hand them your obligations. You still need to know where the data is, who can see it, and what happens to it when the contract ends.
There are two broad ways to run a dealer CRM. On a rented one, changes also go through the vendor's support queue.
Billed monthly, often per seat
Built once
On the vendor's shared platform; the data lives on their servers
A database that belongs to the dealer, in the dealer's name
The price rises as your team grows
Adding people does not add fees
Leaving means asking for a copy
Leaving means taking the database with you
Neither is right for every dealer. A large group with an in-house team may be happy renting a big platform. A used-car dealer with one or a few lots usually wants something simpler: one place where every lead lands with the shopper's own words, which the team will actually open every morning, and which does not hold the customer list hostage.
That second model is what we build. Each dealer's CRM runs in its own database — the dealer's own Supabase project, in their name. Every lead from the website, the chat and the ads lands as a card with the shopper's exact words, their name, number and the car they asked about. There are no per-seat fees, and if a dealer ever leaves us, the data leaves with them because it was theirs to begin with. The CRM build is a one-time fee, $1,999–$2,499 in USD; the pricing page lists everything.
If you are moving from another system, we start by looking at what your current export actually contains — which is the test above.
Want someone to look at where your leads actually end up today? That is part of the free lot check. Or read more about the CRM.
Rules change. This article explains, it is not legal advice; check the source before you act on it.


A shopper asks about a truck on Tuesday. How long can you follow up, by text or email, and what has to be in the message? The official answers, in dealer terms.

Twelve questions to ask before you sign, what the answers should sound like, and the red flags we see most often when dealers in the Maritimes and Newfoundland show us their current contracts.

A shopper asks about a car on your website. What happens in the next hour decides whether they hear from you or from the dealer down the road. Here is what usually goes wrong, and a plan a small team can actually run.
Your site, your inventory feed and how you show up on Google — read by the people who build them. You keep the teardown either way.
Get the free lot check