Navigating Canada’s new email marketing laws, with Cyberimpact GM Geoffrey Blanc

As Cyberimpact plans its expansion in Canada, general manager Geoffrey Blanc discussed the benefits of using a local martech solution, the effects of laws like CASL and Quebec’s Law 25, and the impact of upcoming regulations on the ROI of email marketing. This conversation covers why now is the time for Canadian companies to prepare for a shake-up in how they do email marketing.

What makes customers excited about working with a Canadian martech? Is it patriotism, or something else?

I think the fact we’re a local player is something they really like about us. Speaking to people in Toronto—just talking about the CASL Law, Law 25 in Quebec, and Bill C-27— people were super happy to have someone talking about that and making them understand what they need to do to be compliant with those laws.

Another thing people really appreciate is having software billed in Canadian dollars compared to US dollars. The exchange rate makes a big difference. 

Also, having boots on the ground in Canada. We understand the companies better and are closer to them as well.

Do local laws affect how international companies build their stack? Can’t they just use MailChimp for their entire database?

It’s a good question. I know some big companies have local marketing companies, and they are really aware of how they choose their software. They want to ensure compliance with the different laws. As soon as you send emails in Canada, you have to comply with the Canadian-specific law. This is something we’ll be pushing throughout the year to ensure people understand the compliance needed for email marketing. 

One example: People using MailChimp often delete contacts to avoid paying for unsubscribers. But this is something you cannot do. You’re not going to prison for it, but it’s not a good practice and could lead to problems in the future. Especially with Law 25 in Quebec regarding privacy, you want to keep a trace and take care of the privacy of the contact. If that person doesn’t want to be a subscriber anymore, you need to ensure you have the proper tool in place to respect that. From what I’ve heard and seen in the past year, I’m not sure people understand how this will impact them. And, this is something that we need to make sure that companies understand in the near future.

We recently discussed about who will be the first company to get fined, which will likely trace the next steps for other companies. You don’t want to be that company or person that gets caught because you were trying to save a little money and didn’t understand what you needed to do.

Email laws have been around for years in Canada. Nobody has been caught, nobody’s been hit. Does the risk warrant changing your processes and martech stack? Why not just follow general anti-spam practices? 

It’s like speeding on the highway; you have a chance of being caught or not, but you could do it. It doesn’t make you a bad person. It’s more about the company direction—do you want to ensure you have everything in place to be fully compliant? Right now, yes, you could play your odds and say, okay, flip a coin, I think it’s not going to be me. But we’ll see. It’s like the cookie banner; everyone’s putting it on their website without really knowing why.

I’m just preparing the next steps because, in terms of privacy, I think companies are waiting. Just to give you an example, in Quebec they are about to start applying Law 25 in September. By the 24th, you need to be fully compliant, have everything in place to ensure privacy and confidentiality, and have the right tools to protect client data. This law requires designating an employee for compliance. That’s a bit different from CASL. 

In terms of confidentiality and email marketing, one of the big changes coming with all the regulations is everything regarding tracking. You have to put everything in place to allow the contact or user to not be tracked, similar to what happened with the cookie banner, but this time for any software tracking the behavior of a user or collecting personal information. This is going to be coming, that’s for sure. You’re going to see it in a year or two, probably with the updated version of PIPEDA.

What does “allowing the contact to not be tracked” mean practically?

For email marketing, double opt-in would be the best option, if not the only option. Make sure you have the proper authorization to contact that person. Double opt-in is always the best. Another thing is in terms of tracking, you need to make sure that anyone giving you an email address or permission to communicate with them has the option to not be tracked or identified.

For example, if you’re doing a mailing campaign to 10,000 people, having the option to track or not will give you the open rate but not the full data about the open rate. You won’t know who is actually opening and closing it.It’s all about identification.

One of the things we needed to do was give the ability to fully anonymize the campaign. It’s more like a company choice or giving the user the option to be anonymized. 

So concretely, what you will do is, again, for a 10,000 email campaign, half want to be tracked, the other half don’t. When you check your open rate, you’ll see the information for half of them but miss the information for the other half. You want to give that flexibility to the user.

If you want the option to not be tracked, what would you do as a contact? 

It’s going to be a preference you can manage directly on the email, in your preferences as a contact. 

Right now, when we do an email campaign, for every client, you have the option to unsubscribe, manage preferences, and report abuse. So you could manage your preferences. 

We’re discussing splitting it from “manage preferences” and adding another option, like “manage my tracking.” 

For example, you can say, “I don’t want to be tracked, but I’m still interested in getting emails from that company.”

Is it complicated incorporating this functionality into Cyberimpact? 

It was a surprise, but not a surprise, that we needed to make changes to get more compliant with a new law. It’s also giving us more strength when we expand across Canada, and we can tell people we’re ready for privacy and all that comes with it. 

For example, we have some government entities across Canada that want to go right away with the more stringent privacy measures. They don’t want to track information; they want to send emails and know the open and click rates but not go into privacy details.

So, companies without a tool made for these new Canadian laws will need to anonymize all their data whereas, in your system, you could have some users tracked and some anonymized? 

If you don’t have a system to anonymize your data, it will be fine, but you won’t be able to use that data. You need to be very careful about it. If you’re not capable of anonymizing the data, you shouldn’t use it because you don’t know if the person wants you to have that data or not.

What are some examples of using this tracked data in your marketing campaigns?

Tracking data is important for marketing automation. It’s very useful because I know that the user clicked on that link, so I can send him another email. If they said no, I wouldn’t be able to send another email. 

That’s going to be the big challenge in the future—to understand and change our behavior. How long will it take, and will there be any fines? 

It will be very useful for government organizations because they want to communicate with their clients but not be responsible for tracking the data. They don’t want a breach in their system and then all the emails, IP addresses, geolocations, and all that being exposed. They want a system that can protect them from data breaches and user identification.

Modern marketing is built around collecting as much user data as possible within a giant lifecycle marketing system. How will companies with these complex systems of data collection and messaging be affected?

You’ll see a lot of CDPs, the customer data platforms that accumulate information from different exterior systems, making changes. You’ll see more compliance, or asking you to comply to get the information. It’s like cookies; when you comply to accept the cookies, they just change where they store the information. If it’s stored in a system registering your acknowledgment of compliance, it will make it available for different platforms without giving private information about the user. The user will be replaced by an ID or something to change the interaction. 

It’s not going to be an easy transformation or next step. Everyone will try to do their best. We’ve done what our lawyers told us to ensure compliance. When we spoke with government entities, they said we were doing the right thing and expected that. We’re on the right path, but it will change and evolve with some adjustments. Laws are not made directly thinking about Cyberimpact. They just did it, and we deal with it.

It changed a lot for our company and system. We had to make many changes to ensure compliance. It will evolve and change, but you must be very careful. It will refocus things. Companies will build proper email lists with the proper consent. It will be a refocus, not a free-for-all anymore. Companies will revisit their emails, ensure consent, and interact differently with email contacts to rebuild or build trust with customers.

Will the ROI of email marketing decrease?

The answer is yes. You saw it as soon as we implemented the cookie banner on websites. Every single company got a hit on their ROI, AdWords investment, and conversion. It’s just a question of getting used to it, finding new ways to revise their ROI. 

Companies with lots of data will need to revise how they will be using this data and mostly ask for proper consent in the future. You will see more and more companies trying to update their list through some consent campaigns and or validate the interest of those contacts to continue receiving emails. You will also see more and more personalization in order to get better ROI as lists are going to start shrinking. You will want to make sure that every email counts. And in order to do that you need to make sure you send the right content to the right person.