Canada’s Anti-Spam Legislation Requirements for Installing Computer Programs

If your business installs software or computer programs on other people's computer systems, you must comply with new requirements as of January 15, 2015. The following guidelines provide an overview of these requirements, which stem from section 8 of CASL, as well as practical examples.

CASL prohibits the installation of a computer program (software) to another person's computing device (e.g., laptop, smartphone, desktop, gaming console or other connected device) in the course of commercial activity without the express consent of the device owner or an authorized user (e.g., other family member or employee).

For example, under CASL, it is prohibited for a website to automatically install software on a visitor's computer without getting consent, or for software to be updated without first obtaining consent.

Usually, CASL requires you to obtain consent from the owner or another authorized user of the computer or device prior to the installation of a computer program. However, in some circumstances, you are considered to already have consent without having to request it. Depending on what your program does, you may need to meet additional requirements. These circumstances and requirements will be explained throughout these guidelines.

CASL does not apply to programs or apps owners or authorized users download themselves to install on their own computer or device, or updates they install for those programs.

1. Does CASL apply to your situation?

When does CASL apply to the installation of computer programs?

First off, don't panic. CASL does not apply to owners or authorized users installing software on their own computer systems (e.g., personal devices such as computers, mobile devices or tablets).

CASL only applies when you install or cause the installation of software on another person's device in the course of commercial activity.

If CASL applies, then you must have consent to install the software. More information about consent is provided later in these guidelines.

Not sure what "cause the installation of software" means? Let us clarify.

CASL applies to software or computer programs that are both installed and caused to be installed on any other person's computer system, without consent.

The following are examples of computer programs which are 'caused to be installed':

What about when people install software on their own computer or device? Is self-installed software covered under the law?

No, self-installed software is not covered under CASL.

For example, the owner of a mobile device goes to an app store to purchase and download an app. As the owner is installing the app on their own personal device, CASL does not apply.

Other examples include the following, if the programs are installed on your own device:

1. You buy software on a CD and install it on your computer.
2. You download software from a website and install it on your device.
3. A small business installs software on business devices used by its employees.
4. A previously installed app offers an update, and the individual installs the update. (However, if the app installs the update in the background, without prompting or informing the user, then CASL would apply. More information about updates and upgrades is available in part 5 of this guidance.

However, if the computer program to be installed performs functions that would normally not be expected by the user, then you must disclose additional information and seek the necessary consent from the user. For more information on consent and disclosure requirements, please see "Are there any other consent requirements?".

Does CASL apply to offline installations (e.g. a CD/DVD that is purchased at a store)?

No, CASL does not apply to offline installations in which a person installs a computer program on their own computer system.

2. When are you considered to already have consent?

Do I need consent to install certain types of programs like cookies or operating systems?

Yes, if CASL applies, then you need express consent to install computer programs. However, for certain types of programs, you are considered to already have express consent without requesting it. If your program is included in the following list, you do not need to request consent prior to the installation:

1. Cookies
2. HTML
3. Javascript
4. An operating system
5. Any other program that is executable through another program that was already consented to
6. If you are a telecommunications service provider (as defined in CASL; see below for an explanation) and you are installing software to:
   1. protect the security of all or part of your network from a current and identifiable threat; or
   2. update or upgrade all or part of your network
7. Software installed solely to correct a failure in a computer system (e.g., bug fixes)

Note that you are only considered to have consent for these types of computer programs as long as the person's conduct indicates that they consent to it. For example, if the person disables Javascript in their browser, you would not be considered to have consent under CASL since their conduct would not indicate that they consent to that type of program. Similarly, if the person disables cookies in their browser, you would not be considered to have consent to install cookies.

For more detailed information see section 10(8) of CASL and section 6 of the Governor-in-Council regulations.

3. How can consent be obtained?

How do I seek express consent to install software or computer programs under CASL?

In order to install software or computer programs on another person's computer or device, consent is required. If you are not considered by CASL to already have consent without needing to ask for it (see part 2 above for more information), you must request it before installing the software. When seeking consent for the installation you must clearly and simply set out:

1. The reason you are seeking consent;
2. Who is seeking consent (e.g., name of the company; or if consent is sought on behalf of another person, that person's name);
3. If consent is sought on behalf of another person, a statement indicating which person is seeking consent and which person on whose behalf consent is being sought;
4. The mailing address and one other piece of contact information (i.e., telephone number, email address, or Web address);
5. A statement indicating that the person whose consent is sought can withdraw their consent; and
6. A description in general terms of the functions and purpose of the computer program to be installed. (See additional considerations below).

Note that the person who has obtained consent has the responsibility to prove consent. This means that a person who seeks consent should keep a record of it.

Note also that if a person withdraws their consent, you can no longer rely on that consent for future updates or upgrades that are installed in the background. More information about updates and upgrades is provided in part 5 of this guidance.

Who do I seek consent from?

Consent must be obtained from the owner or authorized user of the computer system or device.

What constitutes the 'owner or authorized user'?

For the purposes of CASL, an owner or authorized user includes anyone that has permission to use a particular device or computer system. For example,

1. In the context of an employment relationship, the employer would be the owner and the employee would be the authorized user.
2. If an individual owns a computer but provides it to their child, spouse, or other relative for their sole use, the child, spouse or other relative is the authorized user of the computer.
3. If someone leases a device, the lessor will retain ownership of the device for the purposes of CASL and the lessee is the authorized user.
4. If a device is sent out for repair, the person conducting the repair would be considered an authorized user under CASL, but only to the extent that they perform the agreed-upon repairs to the device.

4. Are there any other consent requirements?

What functions require you to disclose additional information when seeking consent?

If the computer program performs one or more of the following functions that would normally not be expected by the user, then you must disclose additional information when seeking consent, as outlined below:^{Footnote 1}

1. Collects personal information;

   Example: An application or software program that has been installed collects user credentials, such as usernames and passwords.

2. Interferes with the user's control of the device;

   Example: A program is installed on a user’s home computer and it prevents the user from being able to start their computer.

3. Changes or interferes with the user's settings, preferences or commands without their knowledge;

   Example: The program turns on the location tracking services without the user’s knowledge.

4. Changes or interferes with the data stored on the device in a way that obstructs, interrupts or interferes with the user's access to the data;

   Example: The program blocks the user’s access to documents stored on the user’s device.

5. Causes the computer system to communicate with another computer system or device without the user's authorization;

   Example: The program causes the computer system to send spam emails to the user’s friends and family without the user’s authorization.

6. Installs a program that may be activated by a third party without the user's knowledge:

   Example: An extension to a user’s internet browser is installed that may be activated by a third party to allow it to collect, store, and use personal information of the user without the user’s knowledge.

See section 10(5) of CASL for more detailed information.

What are the additional disclosure requirements?

Whenever you are seeking express consent, you must meet the consent requirements described in these guidelines. In addition, there are disclosure requirements when installing software that performs any of the functions listed above. In particular, the installer must clearly and prominently, and separate and apart from the licence agreement:

1. Describe to the user what the program does in relation to those functions and why it does it.
2. Describe to the user the impact of those functions on the operation of the computer system.

All of the above must be done prior to the installation of the computer program. See section 10(4) of CASL and section 5 of the Electronic Commerce Protection Regulations (CRTC) for more details.

Suppose you develop a gaming app for a smartphone or tablet that includes functionality to collect information from the GPS, camera and microphone that would not normally be expected by the user. You would be required to disclose the unexpected functionality as described above and you would need consent to install the app on another person's computer. When seeking consent, you would have to, among other things, describe to the user why the game collects that information and what it does with it as well as the impact of those functions on the operation of the computer system. This description would need to be provided in a clear fashion, separate and apart from the terms and conditions or end-user licensing agreement.

For greater clarity, although CASL does not generally apply to situations where a person installs a particular computer program themselves, there could be elements in relation to that computer program that are not reasonably expected by the owner or authorized user. This would be covered by CASL and its requirements regarding installing computer programs would apply. For further clarification, see "Does CASL apply to your situation?".

When do I need to provide assistance with uninstalling computer programs or software?

Only in very specific circumstances would you be required under CASL to assist somebody to remove or disable software from their computer or device.

The circumstance arises when the software performs one of the functions listed in section 10(5) of CASL (e.g., collects personal information), and the owner or authorized user believes that the function or impact of the software was inaccurately described to them.

In that instance, the owner or authorized user can request, within a one-year period of the software's installation, that you assist in disabling or removing the software. This must be done as soon as feasible and at no cost to the user. In addition, for a period of one year after installation, you must provide the person who consented to the installation with an electronic address where they can send the request to remove or disable the program.

Beyond that, you are not generally required to help users remove software from their computers.

See section 11(5) of CASL for more details.

5. Are updates and upgrades covered by CASL?

What is an update or upgrade?

An update or upgrade is generally a replacement of software with a newer or better version, in order to bring the system up to date or to improve its characteristics. Usually the update or upgrade will have new features. Common software updates or upgrades include changing the version of an operating system, an office suite, an anti-virus program, or various other tools.

An update or upgrade makes changes to or replaces previously installed software. Retrieving current information and displaying it within a program is not considered to be updating the program within the context of CASL. For example, updating or refreshing information displayed in a program, such as refreshing the weather forecast in a weather app, or refreshing television listings in an electronic programming guide are not updates or upgrades for the purposes of CASL.

Do I need consent for upgrades or updates and, if so, how do I get it?

Yes, you need consent to install updates or upgrades. There are several options to obtain consent:

1. When you get the initial consent to install the original computer program, you can also seek consent for all future updates and upgrades.
2. Consent can be assumed for updates and upgrades to the specified computer programs discussed above (listed in section 10(8) of CASL, e.g., cookies and operating systems)
3. If the program was self-installed by the device owner or authorized user and you didn't get consent for updates or upgrades at the time of original installation, you will need to seek consent to install any updates or upgrades. You can do this in the same way that you would generally seek consent to install software.
4. You can update or upgrade computer programs until January 15, 2018 if the program was installed on the device or computer system prior to January 15, 2015. (See more details later in this guidance.)

For example, if a person installs an app from an app store on their own device, CASL would not apply. As a result, their consent for future updates may not have been requested by the app developer. If the software developer wishes to install an update to the app at a later date, they must obtain the person's consent to do so. Alternatively, when the user self-installs the app, the developer can use that opportunity to request consent to automatically install future updates.

What about software that was installed before January 15, 2015?

Under CASL, if a computer program was installed on a person's computer system before January 15, 2015, the person's consent to the installation of an upgrade or update is implied until January 15, 2018, unless the person notifies you that they no longer consent to the installation of future updates or upgrades.

If you obtained valid express consent prior to January 15, 2015, you will be able to rely on that express consent for the purpose of section 8 of the Act. It is important to note that the onus of proving consent rests with the person installing the computer program.

Date modified:

2020-09-18