Earlier this month, new rules regulating email communications took effect in Canada, forcing American associations that have members and customers there to adjust their marketing strategy and take a close look at their email lists.

Canada’s Anti-Spam Law (CASL), which as been around since July 1, 2014, requires email marketers to receive direct consent from users (that is, users must explicitly opt in to receive emails), instead of implied consent (marketers give users the opportunity to opt out). But the law included a grace period: Organizations that had a preexisting business relationship with a user—such as an association member—could continue communications under implied consent for three years.

This is a reminder for you to take steps to comply with the law and get systems in place to deal with it.

That period ended July 1.

“The message is, if you’re an American company that sends any kind of marketing material online to Canadians, this is a reminder for you to take steps to comply with the law and get systems in place to deal with it,” says Peter N. Mantas, a partner at the Ottawa law firm Fasken Martineau.

CASL’s rules now dictate that implied consent for business relationships lasts two years after a business transaction and six months after an inquiry. Implied consent is also two years for relationships that don’t involve commercial transactions, such as volunteer work or donations.

After those periods are over, sending an email to a user in Canada gets tricky. If you had been sending messages under implied consent and haven’t had a relationship with a user in that time period, an email asking for direct consent now violates the law.

“While you can use that implied consent to try to get express consent from the people to whom you’re already sending commercial emails, the problem under CASL is that even sending an email asking for that express consent constitutes a commercial message for which you needed some level of consent,” says Shahin O. Rothermel, an associate for the law firm Venable.

To ensure that you’re compliant, “organizations should take a close look at their sign-up process,” Rothermel says. “That’s the easiest way to make sure their members are opting in.” They should also keep good records on the when consent was given, the level of consent, the content of the messages, and recipients’ IP addresses. “In the event of a challenge, the onus is going to be on the organization sending the message to show it has consent or that it has complied,” she says.

For the moment, email marketers needn’t fear class-action suits alleging noncompliance: Last month, the Canadian government suspended a CASL “private right of action” provision that would have allowed individuals to sue organizations under the law. So for now, only the Canadian Radio-Television and Telecommunications Commission is empowered to enforce the law and levy fines.

Mantas cautions that email marketers shouldn’t rest easy. Private right of action “isn’t gone, it’s just been put on hold,” he says. “It could come back at any time, on short notice. There’s a reprieve, but you really need to start paying attention to this.”

(iStock/Thinkstock)