CanadaCanada's Anti-Spam Legislation
Officially Canada's Anti-Spam Legislation, Installation of Computer Programs
Also known as CASL.
A citation is an address, not a summary. The first part names the law; what follows narrows it to the exact section, article or paragraph.
What follows is LexLint's own research summary of this law, not legal advice.
In force since .
A device storage and tracking consent rule binding public and private bodies.
As of .
What it requires
- Get the express consent of the computer system's owner or an authorized user before installing, or causing to be installed, a computer program on that system in the course of a commercial activity, and before causing an electronic message to be sent from a system on which you installed a program this way.
- This duty applies only if the computer system is in Canada, or if you (or whoever directed you) are in Canada, at the relevant time.
- A user is treated as having expressly consented to a cookie, HTML code, JavaScript, an operating system, or another program that runs only through a program they already consented to, provided their conduct makes it reasonable to believe they consent to it running.
- If the program collects personal information stored on the system, interferes with the owner's or user's control of the system, changes or interferes with settings or data without their knowledge, causes the system to communicate with another device without authorization, or can be activated by a third party without the owner's or user's knowledge, describe those material elements and their impact clearly, prominently and separately from the licence agreement when requesting consent, and obtain a written acknowledgement that the person understands and agrees.
- For one year after installing a program with one of those functions, give the person who consented an address to request its removal or disabling if they believe the description they were given was inaccurate, and, where it was, help them remove or disable it at no cost, as soon as feasible.
- An update or upgrade to a program already expressly consented to does not need fresh consent, provided it is installed on the terms of that original consent.
If you get it wrong
Criminal exposureNo
Private right of actionNo
Penalty structure
The same administrative monetary penalty scheme that backs sections 6, 7 and 9 backs this section: up to $1,000,000 per violation for an individual and $10,000,000 per violation for any other person, including a corporation.
- Rule
- Per violation only
- As of
- Currency
- CAD
- Per violation unit
- Violation
- Per violation amount
- 10,000,000
Who enforces it
Enforcement body
Administrative monetary penalties are imposed by a person designated under the Act following an investigation, subject to review by the Commission and appeal to the Federal Court of Appeal; the Canadian Radio-television and Telecommunications Commission administers this scheme.
What it reaches
Obligation class
Consent, Disclosure
What this law does
Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page.
Section 8 prohibits installing, or causing to be installed, a computer program on another person's computer system in the course of a commercial activity, and prohibits causing an electronic message to be sent from a system on which a program was installed this way, unless the owner or an authorized user of the system has given express consent or a court has ordered it; the prohibition applies only where the computer system is in Canada, or where the person installing the program, or the person directing them, is in Canada.
Section 10(8) deems a person to have expressly consented to a cookie, HTML code, JavaScript, an operating system, or another program that runs only through a program they already consented to, where their conduct makes it reasonable to believe they consent to it running.
Where a program performs a function the owner or user would not reasonably expect, such as collecting personal information stored on the system, interfering with the owner's or user's control of it, changing settings or data without their knowledge, or letting a third party activate it without their knowledge, section 10(4) requires that function's material elements and their impact to be described clearly and prominently, separately from the licence agreement, with a written acknowledgement obtained from the person consenting; section 11(5) then requires a one-year window in which that person can ask to have the program removed or disabled if the description they were given was inaccurate.
An update or upgrade to a program already consented to under these rules does not need fresh consent under section 10(7). The same administrative monetary penalty scheme that backs sections 6 to 9 backs this section, and CASL's private right of action, sections 47 to 51, was repealed before it was ever brought into force.
When LexLint raises it
tracks_devicesdistributes_software_product
Read the law
Every line above is drawn from the primary source linked here, read on the date shown. This is a research summary, not legal advice.