Enforcement Advisory - Notice for businesses collecting customer data with in-store WiFi
Many businesses offer free WiFi to enhance customers’ experience in their stores, restaurants, or shopping centres. Businesses often require that customers provide personal information as well as consent to receive marketing messages (usually email or text messages) as a condition of use. This business model is known as Social WiFi and provides the customers with free WiFi and businesses with valuable demographic and behavioural data of their visitors.
Under Canada’s Anti-Spam Legislation (CASL), these marketing messages are considered commercial electronic messages, or CEMs.
Commission staff has published this advisory directed to consumers, businesses, and Social WiFi service providers in Canada to inform them of their respective roles under CASL.
What do Consumers need to know?
When attempting to connect to a business’ open WiFi network, you may be asked to provide your email address, phone number, or social media information in order to connect. If that business plans to send you CEMs, you must be asked to provide express consent to receive those CEMs.
While consent can be revoked at any time, agreeing to receive CEMs may be a condition of accessing the business’ publicly-available WiFi in the future.
How can Businesses and Social WiFi Service Providers ensure they are compliant?
Businesses and Social WiFi service providers have responsibilities under CASL. They must request their users’ informed consent to receive CEMs and include required details in all CEMs.
Specifically, all requests for consent must include the purpose for which consent is being sought, the identity and contact information of the sender, as well as a statement indicating that the recipient can revoke their consent at any time. In addition, all CEMs require a functioning unsubscribe mechanism.
Taking different technologies into consideration, the Commission suggests that examples of a readily performed unsubscribe mechanism are
- a link in an email or SMS that takes the user to a web page where they can unsubscribe from receiving all or some types of CEMs; or,
- the ability to respond to a SMS message with the word “STOP” or “unsubscribe” (see Compliance and Enforcement Information Bulletin 2012-548).
Where can I learn more about consent and record keeping?
To promote compliance, Commission staff has issued guidance on consent and how to prove consent.
For more information on CASL requirements and prohibitions, please see the Commission’s website for guidance material.
Note to Canadians
If you receive spam (by email, text message, or other electronic message) for which you have not provided consent or have previously unsubscribed from, please submit a complaint at the Spam Reporting Centre website.
- Date modified: