How to measure offline campaigns under CASL and Canadian privacy rules

What to take away

What CASL covers when a campaign starts offline

Canada's Anti-Spam Legislation (CASL) covers commercial electronic messages: email, text, instant messages and some social media messages. It does not cover printed mail, door hangers or a flyer in a Canada Post postal walk. That distinction decides how you may measure.

The moment an offline campaign collects an email address and sends a follow-up message, CASL consent rules apply to that message. A trade show badge scan that triggers a thank-you email is a commercial electronic message.

So is a direct mail piece with a QR code that opens a form asking for an email address and then sends a receipt.

A QR code that opens a plain web page is not a message. A QR code that opens a pre-filled text message is. The Justice Laws Website holds the current text of the Act.

The Consolidated Acts index is the fastest route to the marketing statutes you need to check.

CASL also sets rules for address harvesting and for installing software, which matter when a campaign uses a downloaded app or a browser extension to read responses. Keep measurement tooling inside the browser session and you stay clear of that section.

The Canadian Radio-television and Telecommunications Commission enforces CASL with administrative monetary penalties of up to 1 million Canadian dollars for an individual and up to 10 million for a business. Those maximums sit in the Act, so confirm the current text before you quote them.

Where the line falls

The table is the practical core of casl compliance offline marketing. Print and web measurement sit outside CASL. Anything that pushes a message to a device sits inside it.

PIPEDA obligations for direct mail lists and event data

The Personal Information Protection and Electronic Documents Act (PIPEDA) applies to personal information collected, used or disclosed in commercial activity. A mailing list with names, home addresses and purchase history is personal information, even when no email address appears.

PIPEDA requires a stated purpose for collection, consent appropriate to the sensitivity of the data, limits on retention, accuracy, safeguards and a way for people to ask what you hold. For pipeda direct mail lists, that means knowing where each record came from and being able to remove it.

The Office of the Privacy Commissioner of Canada publishes plain guidance on these duties. Its page on privacy laws in Canada sets out the federal framework, and the privacy for businesses section covers list handling, consent and breach reporting.

PIPEDA sets no fixed fine schedule of its own. The Privacy Commissioner investigates and publishes findings, and can apply to the Federal Court, which may order compliance and award damages to a complainant.

Quebec adds its own layer. The province's private-sector privacy law, updated by Law 25, requires consent that is clear, free and informed, and given for each specific purpose. Consent for sensitive information must be express, and a separate request is needed for each use you intend.

Law 25 also creates a portability right. Since September 22, 2024, a person can ask for computerized personal information in a structured, commonly used format and ask you to send it to another organization. The right covers information collected from the person, not data you infer about them.

Penal fines for an enterprise reach 25 million Canadian dollars or 4 percent of worldwide turnover, whichever is greater. The Office quebécois de la langue française requires French-language commercial advertising under Bill 101. A list built in Ontario cannot simply be mailed into Quebec without both checks.

Retention is where most teams slip. A postal walk list rented for a spring campaign should not still sit in a CRM two years later with no purpose attached. Set a deletion date when the list is loaded.

A workable default is 90 days after the campaign closes for a rented prospect list, and 24 months from the last purchase for an active customer file. Those are typical ranges, not statutory periods, so test yours against the purpose you stated at collection.

Consent, implied consent and business card collection at events

Consent offline marketing Canada style comes in two forms under CASL: express and implied. Express consent is a clear affirmative act with the required information about the sender and purpose. Implied consent arises from an existing business relationship or a published business address.

A business card handed to you at a Toronto trade show does not automatically carry consent to email. The card gives you the person's contact details, not permission to send commercial electronic messages. Ask at the booth, record the answer, and keep the wording you used.

Implied consent from an existing business relationship has a clock on it. Under CASL the period runs 24 months from the last purchase and 6 months from the last enquiry.

A record from a 2023 purchase is not a live basis for a 2026 send. Track the trigger date, not the scan date.

The Office of the Privacy Commissioner of Canada's guidance for individuals is a useful mirror: it shows what people expect to be told, which is a good test for your booth script. If your script would surprise the person reading that page, rewrite it.

Worked example: a Halifax conference booth

A software firm scans 400 badges at a Halifax conference in June. The booth sign says scans receive a product update by email. That wording makes the scan an express consent for that purpose.

That is the shape of a clean offline campaign measurement workflow. The consent record is part of the dataset, not a separate file.

Collecting data offline without triggering CASL violations

Most CASL trouble starts with a well-meant follow-up. A team collects business cards, loads them into a CRM and sends a newsletter. The newsletter is a commercial electronic message.

Build the collection step so the follow-up is lawful before it happens. Ask a direct question, offer a real choice, and record the answer with the date. A checkbox on a paper form works if the form is then stored or scanned with the consent line intact.

Avoid pre-checked boxes, bundled consent and silence as a basis. CASL requires the consent to be positive and the person to understand what they are agreeing to receive. A line reading "we may contact you" is too vague to rely on.

Telephone follow-up brings the Canadian Radio-television and Telecommunications Commission into play. Its telemarketing rules and the National Do Not Call List sit alongside CASL, so a call campaign needs its own scrubbing step before dialling.

For the tracking side, our direct mail marketing guide covers how to structure collection points so the data stays usable. The privacy question is separate: what you may do with the record once you have it.

Measurement frameworks that stay inside privacy rules

A measurement framework is a set of definitions, sources and review points. Under Canadian privacy law it also needs a lawful basis column for every data field you collect.

Start with the outcome. If the goal is store visits, measure store visits. If the goal is qualified leads, define what makes a lead qualified before the campaign runs, not after the numbers arrive.

Aggregate where you can. Postal walk response rates, regional lift and redemption counts by province do not identify anyone. Build the reporting structure so individual records stay out of the summary layer.

Where you need person-level data, collect the minimum. A reply card needs a name and address to fulfil the request. It does not need a date of birth or an income band. Every extra field is a field you must protect and eventually delete.

The three layers: collection, measurement and compliance

The compliance layer is what makes the other two defensible. Run it as a live table, not an annual audit.

Attribution and tracking for offline campaigns under Canadian privacy law

Offline attribution in Canada cannot lean on the tracking that US teams take for granted. Cross-device fingerprinting and third-party ad tracking raise questions under PIPEDA, and Quebec's law is stricter still.

Use identifiers the recipient controls. A unique reply code on a mailer, a dedicated phone number per region and a campaign-specific landing page all attribute response without identifying anyone who did not choose to respond.

When you track QR codes on printed materials, keep the landing page free of third-party trackers that build a profile across sites. First-party session data on your own domain is easier to justify and easier to explain in a privacy policy.

Postal walk data from Canada Post gives you distribution volume and neighbourhood counts. That is aggregate data and carries no personal information. Pair it with redemption counts to get a rate per thousand households without touching a single name.

For events, count scans, sessions and meetings rather than named attendees in the headline metric. Named records stay in the CRM under the consent you collected; the dashboard shows totals.

Documenting consent and handling complaints

A consent record needs four things: who consented, what they agreed to receive, when they agreed, and how they agreed. If any of the four is missing, the record will not hold up.

Store the record with the campaign, not in a separate legal folder. When a complaint arrives, the first task is to find the exact basis for that contact. That should take minutes, not days.

Complaints about commercial electronic messages go to the Canadian Radio-television and Telecommunications Commission. Privacy complaints go to the Office of the Privacy Commissioner of Canada. Both bodies publish process guidance, and a breach of security safeguards with real risk of significant harm carries a mandatory reporting duty.

Under PIPEDA, individuals can ask what you hold about them and request correction. Build a response path before you need it. A named owner, a standard reply and a 30-day working target cover most cases.

The Canadian Marketing Association's code of ethics and Ad Standards give you industry benchmarks that often go further than the statute. Following them reduces the chance of a complaint reaching a regulator at all.

A compliance checklist for offline measurement

Run this before every campaign. It takes an hour and prevents most of the problems that surface months later.

Our guide to canada post neighbourhood mail rates covers the reporting side of the same work. Keep the two together so a metric is never reported without its basis.

Common questions