CASL Spam Compliance

• Community projects
• Dogfood on a *.tiki.org site
• Legislative Compliance

I just reviewed Canadas anti-spam legislation & it looks like we're currently not complying with it.

http://fightspam.gc.ca/eic/site/030.nsf/eng/00285.html

1. Express consent (rules for implied consent are too difficult to satisfy)
2. Name of the Sender
3. Address of the Sender.
4. A way of getting in touch with the sender. (phone number, domain name, email address) For us, a simple domain name would be ideal.
5. Easy unsubscribe mechanism.

I just reviewed an email I received from a user watch at dev.tiki.org. We comply with (maybe) #1. 2-5 we do not comply on.

A lot hinges on if the emails we send out are considered "Commercial Electronic Messages" but we don't appear to fall in the exception list, so I'm guessing that means almost all our messages are considered CES, including watches.

There is implied and also explicit consent. It looks like most of our emails are explicit concent emails, so that makes things easier. However if no specific action was taken to request an email, it falls in "implied consent" and there is a 2-year limitation on this clause. That would be a lot of work to program, so I suggest that we place a line in our Terms and Conditions that states that we may send occasional emails, and require them to agree to these upon registration. This would seem to cover our basis in making a strong case for explicit consent. The onus is upon us to prove that explicit consent has been granted. The empty toggle box concent is mentioned as "acceptable" under these regulations.

Now that we have explicit consent (and can prove it) we need to comply with the required information in an email. For Tiki already has the name and domain name, but perhaps we need a field for the business address in the preferences somewhere.

We also need an "easy unsubscribe mechanism" so if someone creates a "user watch" we need to include a link to an unsubscribe page. Or a page that unsubscribes them. I'm sure we already have this within tiki, we just need to generate the link and include it in user watches, and other emails.

It would also be nice if we had some generic compliance built into Tiki. So the solution taken is not specific to *.tiki.org and everyone else needs to come up with there own solution. More and more legislation is playing a larger role in how business on the net is conducted.

I would love to see a generic feature in Tiki called something like Terms, Conditions & Privacy Policy. Where terms, conditions and privacy policy can be (almost) auto generated based on selected options. This then could be integrated into the user registration form as part of the standard process.

This bug has been demonstrated on show2.tiki.org

Please demonstrate your bug on show2.tiki.org