Move the list into a mailing service that records when and how each person agreed, handles unsubscribes automatically and keeps the list off any single computer. Import consent dates and past unsubscribes with it.

The list on the back-office computer

In many small businesses the mailing list is a spreadsheet. It began as a few dozen names typed from a sign-up sheet and has grown, a column at a time, for years.

It lives on one computer. One person knows which copy is current, and the newsletter goes out from that person's email program in batches.

Nothing about this feels risky until something happens: the computer fails, that person leaves, someone who unsubscribed gets another email, or a customer asks how you got their address.

Each of those has an answer. The spreadsheet rarely holds it.

What the spreadsheet is missing

The first is the one the law cares about. Under CASL, the business sending the email has to be able to show consent, and a list with no dates or sources shows nothing.

Consent the spreadsheet cannot show

Consent under CASL comes in kinds, and the implied kind expires on a date set by each customer's last purchase or enquiry.

A spreadsheet row holds a name and an address. It does not say which kind of consent applies, when it began or where it came from, so it cannot say who may still be mailed.

Most of those dates still exist somewhere: on old sign-up sheets, in the online shop's order history, in the point-of-sale system. The longer the list goes unrecorded, the harder they are to match back.

Unsubscribes that do not stick

CASL requires an unsubscribe in every commercial email, and a request to leave must take effect within ten business days.

In a spreadsheet, an unsubscribe is a deleted row, a note in a column or a reply sitting in someone's inbox. When copies are merged, or an older version is restored, the address comes back.

Most mailing services keep unsubscribed addresses on a suppression list, a record of addresses they will refuse to send to, so importing the same address again does not quietly resubscribe it.

One computer, one point of failure

A spreadsheet on one machine goes with that machine: a failed drive, a stolen laptop, ransomware that encrypts the office files.

It is also personal information about your customers, unprotected on a shared desk. Canadian privacy law expects businesses to protect personal information with safeguards suited to it.

And copies multiply: one on a USB stick, one emailed home to work on over the weekend. Each is another version to drift and another place to lose.

A worked example

A meadery on a farm outside a small town makes honey wine from its own hives and sells most of it from its tasting room and at markets.

For six years, visitors who wanted news of new batches wrote their email address on a clipboard at the counter.

The addresses went into a spreadsheet on the tasting room computer, and the newsletter went out from the owner's email program.

Last autumn a customer complained that she had asked twice to be removed. Both requests were recorded in a copy on a laptop; the newsletter went out from the desktop copy.

The move took an afternoon and a few decisions. Both copies were merged, duplicates removed, and every address that had ever asked to leave went into a mailing service marked as unsubscribed.

The clipboard sheets had been kept in a box, so most remaining addresses got a source and a date. Addresses with no sheet and no recent purchase were set aside rather than mailed.

The newsletter now goes from the service, with a working unsubscribe link and the meadery's address, and the website's sign-up form feeds the same list.

Moving the list properly

Gather every copy first and merge them, keeping any unsubscribe found in any copy. That one rule prevents the complaint in the example.

Before importing, add columns for the kind of consent, when and where it was given, and, where consent is implied, the purchase or enquiry that created it.

Remove addresses that bounced. Mailing services watch bounce and complaint rates, and an old list full of dead addresses can get a new account paused before its first newsletter.

Keep the old spreadsheet and any paper sheets, archived, as the record of where each consent came from.

The addresses with no record

Addresses with no record of consent are the hard part, and it is tempting to send them one email asking whether they want to stay.

The catch is that CASL counts that request, sent by email, as a commercial message, which needs consent of its own.

Where implied consent is still running, from a recent purchase, asking for express consent is fine and worth doing.

Where there is nothing, the address stays out of the mailing service. For how CASL applies to your own list, ask a lawyer; none of this is legal advice.

Once the list has moved

Sign-ups through a form on the website are recorded with the date, the time and the form used, which is exactly the record a spreadsheet never had.

Paper sign-ups at the counter still happen. Enter them weekly with the date on the sheet, and keep the sheets.

One person owns the list, and nobody keeps a private copy on another machine.

The counter-case

A list of thirty regulars who know the owner by name carries less risk than a list of thousands. The records still matter; the move is simply smaller.

A business that only sends receipts, order confirmations and similar messages is in a different position, since CASL treats those differently from promotions. It still needs a backup.

For any list that carries news or offers, the advice holds: a mailing service with consent dates, sources and unsubscribes, kept off any single computer.

The move, step by step

  1. Gather every copy of the list.
  2. Merge them, keeping every unsubscribe.
  3. Add consent type, date and source.
  4. Set aside addresses with no record.
  5. Import the rest into a mailing service.
  6. Archive the old files and paper sheets.
  7. Delete stray copies on other devices.

Step two is the one that protects the people who asked to leave. Miss one copy's unsubscribes and the move carries the same mistake into a better system.

Working out when each customer's implied consent runs out is covered in customers whose implied consent runs out this year.

Frequently asked questions

What is wrong with a spreadsheet mailing list?

It usually has no consent dates or sources, no reliable record of unsubscribes and no backup, and it lives on one computer that can fail or be lost.

Why does the list need consent dates?

Because CASL puts the burden of showing consent on the sender, and implied consent expires. Without a date and a source for each address, nobody can say who may still be mailed.

How do unsubscribed people end up mailed again?

When copies of a spreadsheet are merged or an older one is restored, deleted rows return. Mailing services keep a suppression list so that cannot happen.

Can I email people to ask for consent?

Only where you already have consent, such as implied consent from a recent purchase. An emailed request for consent is itself treated as a commercial message under CASL.

What should I import with the addresses?

The kind of consent, its date and source, the purchase or enquiry date for implied consent, and every past unsubscribe, marked as unsubscribed rather than deleted.

Should I keep the old spreadsheet afterwards?

Yes, archived with any paper sign-up sheets, as the record of where consent came from. Delete the working copies on other devices so nobody mails from them.

West Coast Media Solutions Inc. provides web design, web development, hosting, digital marketing, and business consulting to organisations across Canada, drawing on more than twenty-five years in the field.

Mailing list living in one spreadsheet?

Tell us how the list is kept today. We will plan the move, the consent records and the import with you.

Start a Conversation