A Checkout That Signs Customers Up Automatically

A box that was ticked for them

At the end of many online checkouts, just above the pay button, sits a line such as keep me up to date with news and offers. The box beside it is already ticked.

Most customers never touch it. They are checking the total and the delivery address, and anything already filled in looks like part of the order.

So the mailing list grows with every sale, and the shop counts each new address as someone who chose to hear from it.

Under CASL, Canada's anti-spam law, that count is shakier than it looks. This is a general account of the rules, not legal advice.

What the regulator's guidance says

CASL says a business needs consent before sending commercial email. Express consent is the person's own clear yes; implied consent comes from relationships such as a recent purchase.

The CRTC, which enforces those rules, says in its guidance that the box must be ticked by the person giving consent. One ticked in advance by the shop is not express consent.

The same guidance says consent to email cannot be bundled with agreeing to the terms of sale. A customer must be able to buy without signing up.

What a valid request includes

• An unticked box the customer ticks, or another clear action of theirs.
• What they will receive, such as news, offers or event invitations.
• Who is asking, with the business's name and contact details.
• A line saying they can unsubscribe whenever they choose.
• A place apart from the terms of sale, so buying is not agreeing.

The first is where the pre-ticked box fails, and no wording elsewhere makes up for it. The rest can usually be fixed by editing a sentence.

Implied consent is a different thing

A purchase does give the shop something: implied consent, through what the law calls an existing business relationship. It lasts two years from the purchase, and each new purchase starts the two years again.

That is useful but limited. A customer who bought once this spring and never again can be sent offers until the spring two years from now, and not after.

An enquiry gives six months. Receipts, order confirmations and shipping notices are treated differently again, since they complete a sale rather than promote one.

Express consent, by contrast, has no end date; it holds until the person withdraws it. That alone makes it worth asking for properly.

Why a long list can be weak

People added without choosing open less, unsubscribe more and press the spam button more often. Mail providers notice complaints, and a list that draws them can push the shop's other email toward junk folders, order confirmations included.

A smaller list of people who ticked the box themselves is a list of people who wanted the email. The size of the list was never the point.

Wording the box plainly

Say what the customer is agreeing to in words they would use: email me news, events and offers from the shop, about twice a month; unsubscribe any time.

Name the business as customers know it, and if it trades under a different name from the company, make the connection clear. Contact details belong on the same page.

Leave the box unticked, keep it apart from the terms and conditions, and let the order go through either way.

A worked example

A bouldering gym in a former bowling alley sells day passes, ten-visit cards, memberships and gift cards through a small online shop, and most new climbers buy their first pass there.

The shop's checkout came with the newsletter box already ticked, and nobody had changed it. Every buyer joined the list for route-setting news and member offers.

The list grew quickly, and so did the unsubscribes. A few climbers asked at the front desk why they were getting emails they never signed up for.

The gym unticked the box and rewrote it to say what the emails contain and how often. It also split the list in two: people who had used its separate signup form, and people who had only bought something.

The second group was treated as implied consent, each address carrying the date of its latest purchase, and was asked once, well within its two years, whether it wanted to stay.

The list is smaller now. Everyone on it either chose to be there or bought something recently.

Recording who chose it

A business relying on consent has to be able to prove it, and a list of addresses is not proof.

For each signup at checkout, keep the date and time, the order number and the exact wording of the box as it appeared that day. When the wording changes, keep the old version and the date.

Check too that the answer to the box travels to the email service with the address. Some shop connections send every customer across as a subscriber, ticked or not.

Sorting the list you already have

Divide the current list by how each address arrived. Signups through a form with an unticked box count as express consent, provided the records exist.

Addresses that came through the pre-ticked checkout belong with implied consent, valid for two years from each customer's latest purchase. Note those dates beside the addresses.

Ask that group for express consent while their two years are still running. Even the email that asks counts as a commercial message, so it can only reach people whose implied consent has not lapsed.

Customers already receiving the shop's commercial email before CASL took effect last July keep implied consent through a transition period, unless they withdraw it.

The counter-case

A shop that sends only receipts and shipping notices has nothing here to fix, since those messages are not promotions.

A shop with a few dozen customers a year may keep its records in a spreadsheet beside the order list.

And some customers will decline when asked properly. The loss is real but small, since people who never chose the newsletter were unlikely to read it.

Whatever the shop's size, the change is the same: an unticked box, plain wording and a record of who ticked it.

The box, then the list

1. Untick the box in the checkout settings.
2. Rewrite the wording to say what and how often.
3. Separate it from the terms and conditions.
4. Record the date, order and wording for each signup.
5. Split the existing list by how people joined.
6. Note each customer's latest purchase date.
7. Ask the implied group before their two years end.

Step seven is the one that cannot wait. Once a customer's two years pass without another purchase, even an email asking for consent is no longer allowed.

The two failures behind the CRTC's first penalty are covered in the first CASL penalty and the lesson in it.

Frequently asked questions

West Coast Media Solutions Inc. provides web design, web development, hosting, digital marketing, and business consulting to organisations across Canada, drawing on more than twenty-five years in the field.