Digital marketing just got a bit more complicated for companies that do business in Canada this month as certain long-awaited regulations under Canada’s Anti-Spam Law (CASL) officially went into effect.

Passed in July 2014, the law had allowed organizations that had prior business relationships with a user to continue to send commercial electronic messages to that person under implied consent rules up until July 1 of this year – unless, of course, the person unsubscribed.

But this month, that grace period ended. Now, implied consent applies only for up to two years after the last sale to the recipient and up to six months after an inquiry from them. If the implied consent period expires, or the businesses never had the consent in the first place, organizations need express consent from the intended recipients to send them commercial electronic messages via email, text and other forms of electronic communication.

Express consent means the recipient has to give, orally or in writing, the organization specific permission to contact them. Implied consent allows marketers to contact people as long as an opt-out option is provided.

In the wake of CASL, what steps should businesses take? If not already done, you should try to get express consent from customers, provided you have made a sale to them within two years or had an inquiry from them within the last six months. Express consent never expires unless the person unsubscribes.

Still, be careful about requesting express consent: If the implied consent period has already ended, and you send an electronic message requesting express consent, you’re likely violating the law through that contact.

“While you can use that implied consent to try to get express consent from the people to whom you’re already sending commercial emails, the problem under CASL is that even sending an email asking for that express consent constitutes a commercial message for which you needed some level of consent,” Shahin O. Rothermel, an associate for the law firm Venable, told Associations Now.

When requesting express consent, multinational consulting and advisory firm Deloitte advises that you must provide recipients with: the name of the person or organization seeking consent; a mailing address and either a phone number, voice message system, email address or website where recipients can access an agent for more information; a statement identifying the person on whose behalf consent is being sought; the identity and contact information of any third party or affiliate used to obtain consent; a free unsubscribe mechanism that lets recipients electronically opt-out of communications; and the ability to opt-out of all types of communications sent by either your organization or a third-party partner.

Adding to some of the complication with CASL is that, according to legal intelligence source JD Supra, there are some caveats where implied consent still lasts indefinitely. For instance, if an email marketer received a business card from the intended recipient, and the recipient gave no disclaimer about being contacted, then the marketer could contact that person.

Consequences for spammers who violate the law can include fines of $1 million to $10 million.

As of now, the Canadian government has suspended the provision of CASL that would have allowed lawsuits to be filed against individuals and organizations for alleged violations of the legislation. This provision, known as “private right of action,” had been on track to take effect July 1^st, but was tabled in June following broad-based concerns raised by businesses, charities and the not-for-profit sector.

PLEASE NOTE: The full text of the law can be found here and the CRTC has posted FAQs here. All marketers with Canadian prospects and clients are encouraged to speak with an attorney for any individual questions relating to CASL. This article does not constitute legal advice.