How to measure offline campaigns under CASL and Canadian privacy rules

What to take away

• Measuring offline campaigns CASL Canada style starts with one question: is the contact address you are tracking tied to a commercial electronic message, or to mail and events only?
• CASL governs commercial electronic messages, not print mail, so a Canada Post drop can be measured without express consent as long as no email or text follows it.
• PIPEDA applies to personal information in your direct mail list, event scans and call logs, and it requires a stated purpose, limited retention and a working opt-out.
• Consent must be documented at the point of collection, with the date, source and wording kept alongside the record.
• Attribution works better with unique reply codes, dedicated phone numbers and landing pages than with cross-device fingerprinting.
• Complaints go to the Office of the Privacy Commissioner of Canada, and the Canadian Radio-television and Telecommunications Commission handles CASL violations.

What CASL covers when a campaign starts offline

Canada's Anti-Spam Legislation (CASL) covers commercial electronic messages: email, text, instant messages and some social media messages. It does not cover printed mail, door hangers or a flyer in a Canada Post postal walk. That distinction decides how you may measure.

The moment an offline campaign collects an email address and sends a follow-up message, CASL consent rules apply to that message. A trade show badge scan that triggers a thank-you email is a commercial electronic message.

So is a direct mail piece with a QR code that opens a form asking for an email address and then sends a receipt.

A QR code that opens a plain web page is not a message. A QR code that opens a pre-filled text message is. The Justice Laws Website holds the current text of the Act.

The Consolidated Acts index is the fastest route to the marketing statutes you need to check.

CASL also sets rules for address harvesting and for installing software, which matter when a campaign uses a downloaded app or a browser extension to read responses. Keep measurement tooling inside the browser session and you stay clear of that section.

Where the line falls

Campaign element	CASL applies?	Measurement implication
Printed mailer with reply card	No	Track by reply code, no consent needed
QR code to a landing page	No	Track scans and sessions
QR code to a pre-filled SMS	Yes	Consent required before the text
Event badge scan followed by email	Yes	Consent wording must cover it
Telemarketing call to a listed number	CRTC rules	Check the National Do Not Call List

The table is the practical core of casl compliance offline marketing. Print and web measurement sit outside CASL. Anything that pushes a message to a device sits inside it.

PIPEDA obligations for direct mail lists and event data

The Personal Information Protection and Electronic Documents Act (PIPEDA) applies to personal information collected, used or disclosed in commercial activity. A mailing list with names, home addresses and purchase history is personal information, even when no email address appears.

PIPEDA requires a stated purpose for collection, consent appropriate to the sensitivity of the data, limits on retention, accuracy, safeguards and a way for people to ask what you hold. For pipeda direct mail lists, that means knowing where each record came from and being able to remove it.

The Office of the Privacy Commissioner of Canada publishes plain guidance on these duties. Its page on privacy laws in Canada sets out the federal framework, and the privacy for businesses section covers list handling, consent and breach reporting.

Quebec adds its own layer. The province's private-sector privacy law has tighter consent and portability rules than PIPEDA, and the Office québécois de la langue française requires French-language commercial advertising under Bill 101. A list built in Ontario cannot simply be mailed into Quebec without both checks.

Retention is where most teams slip. A postal walk list rented for a spring campaign should not still sit in a CRM two years later with no purpose attached. Set a deletion date when the list is loaded.

Consent, implied consent and business card collection at events

Consent offline marketing Canada style comes in two forms under CASL: express and implied. Express consent is a clear affirmative act with the required information about the sender and purpose. Implied consent arises from an existing business relationship or a published business address.

A business card handed to you at a Toronto trade show does not automatically carry consent to email. The card gives you the person's contact details, not permission to send commercial electronic messages. Ask at the booth, record the answer, and keep the wording you used.

Implied consent from an existing business relationship has a clock on it. The period runs from the last purchase or the last written enquiry, so a record from a 2023 event is not a live basis for a 2026 send. Track the trigger date, not the scan date.

The Office of the Privacy Commissioner of Canada's guidance for individuals is a useful mirror: it shows what people expect to be told, which is a good test for your booth script. If your script would surprise the person reading that page, rewrite it.

Worked example: a Halifax conference booth

A software firm scans 400 badges at a Halifax conference in June. The booth sign says scans receive a product update by email. That wording makes the scan an express consent for that purpose.

1. The scan record stores the badge ID, the timestamp and the exact consent wording shown on the sign.
2. Two weeks later, 310 recipients open the update and 44 click through to a demo page.
3. The firm reports cost per demo, not cost per scan, because the scan alone is not a business outcome.
4. The 90 non-openers are suppressed after the defined window rather than re-mailed without a new basis.
5. Anyone who asks to be removed is removed across the CRM, the mail house file and the event platform the same day.

That is the shape of a clean offline campaign measurement workflow. The consent record is part of the dataset, not a separate file.

Collecting data offline without triggering CASL violations

Most CASL trouble starts with a well-meant follow-up. A team collects business cards, loads them into a CRM and sends a newsletter. The newsletter is a commercial electronic message, and the card is not consent.

Build the collection step so the follow-up is lawful before it happens. Ask a direct question, offer a real choice, and record the answer with the date. A checkbox on a paper form works if the form is then stored or scanned with the consent line intact.

Avoid pre-checked boxes, bundled consent and silence as a basis. CASL requires the consent to be positive and the person to understand what they are agreeing to receive. A line reading "we may contact you" is too vague to rely on.

Telephone follow-up brings the Canadian Radio-television and Telecommunications Commission into play. Its telemarketing rules and the National Do Not Call List sit alongside CASL, so a call campaign needs its own scrubbing step before dialling.

For the tracking side, our direct mail marketing guide covers how to structure collection points so the data stays usable. The privacy question is separate: what you may do with the record once you have it.

Measurement frameworks that stay inside privacy rules

A measurement framework is a set of definitions, sources and review points. Under Canadian privacy law it also needs a lawful basis column for every data field you collect.

Start with the outcome. If the goal is store visits, measure store visits. If the goal is qualified leads, define what makes a lead qualified before the campaign runs, not after the numbers arrive.

Aggregate where you can. Postal walk response rates, regional lift and redemption counts by province do not identify anyone. Build the reporting structure so individual records stay out of the summary layer.

Where you need person-level data, collect the minimum. A reply card needs a name and address to fulfil the request. It does not need a date of birth or an income band. Every extra field is a field you must protect and eventually delete.

Three framework layers

1. Campaign layer: spend, volume, response count, cost per response, by province or region.
2. Channel layer: Canada Post Neighbourhood Mail versus Personalized Mail, event scans, inbound calls, QR scans.
3. Compliance layer: consent source, consent date, retention date, suppression status.

The compliance layer is what makes the other two defensible. Run it as a live table, not an annual audit.

Attribution and tracking for offline campaigns under Canadian privacy law

Offline attribution in Canada cannot lean on the tracking that US teams take for granted. Cross-device fingerprinting and third-party ad tracking raise questions under PIPEDA, and Quebec's law is stricter still.

Use identifiers the recipient controls. A unique reply code on a mailer, a dedicated phone number per region and a campaign-specific landing page all attribute response without identifying anyone who did not choose to respond.

When you track QR codes on printed materials, keep the landing page free of third-party trackers that build a profile across sites. First-party session data on your own domain is easier to justify and easier to explain in a privacy policy.

Postal walk data from Canada Post gives you distribution volume and neighbourhood counts. That is aggregate data and carries no personal information. Pair it with redemption counts to get a rate per thousand households without touching a single name.

For events, count scans, sessions and meetings rather than named attendees in the headline metric. Named records stay in the CRM under the consent you collected; the dashboard shows totals.

Documenting consent and handling complaints

A consent record needs four things: who consented, what they agreed to receive, when they agreed, and how they agreed. If any of the four is missing, the record will not hold up.

Store the record with the campaign, not in a separate legal folder. When a complaint arrives, the first task is to find the exact basis for that contact. That should take minutes, not days.

Complaints about commercial electronic messages go to the Canadian Radio-television and Telecommunications Commission. Privacy complaints go to the Office of the Privacy Commissioner of Canada. Both bodies publish process guidance, and a breach of security safeguards with real risk of significant harm carries a mandatory reporting duty.

Under PIPEDA, individuals can ask what you hold about them and request correction. Build a response path before you need it. A named owner, a standard reply and a 30-day working target cover most cases.

The Canadian Marketing Association's code of ethics and Ad Standards give you industry benchmarks that often go further than the statute. Following them reduces the chance of a complaint reaching a regulator at all.

A compliance checklist for offline measurement

Run this before every campaign. It takes an hour and prevents most of the problems that surface months later.

• Every data field has a stated purpose and a lawful basis recorded next to it.
• Consent wording is captured verbatim with the date and the collection point.
• Direct mail list compliance is confirmed: source, permission basis and suppression status.
• Email and SMS follow-ups have a consent record that covers that specific channel.
• Retention dates are set at load time, not at review time.
• Opt-out requests flow to the mail house, the CRM and the event platform.
• Quebec campaigns check French-language requirements and provincial privacy rules.
• The dashboard reports aggregates, with named records held only where consent allows.

Our guide to canada post neighbourhood mail rates covers the reporting side of the same work. Keep the two together so a metric is never reported without its basis.

Common questions

Does CASL apply to printed direct mail? No. CASL covers commercial electronic messages, so printed mail, door hangers and postal walk drops fall outside it. The moment a mailer drives an email or text follow-up, that message is covered.

Can I email someone whose business card I collected at a Canadian event? Not on the card alone. A business card gives you contact details, not consent. Ask at the booth, record the answer with the date, and keep the wording you used.

How long can I keep a direct mail list? Only as long as the stated purpose requires. Set a deletion date when the list is loaded and remove records that no longer serve that purpose.

Who receives a CASL complaint? The Canadian Radio-television and Telecommunications Commission handles commercial electronic message complaints. Privacy complaints go to the Office of the Privacy Commissioner of Canada.

Can I use QR codes to track offline response? Yes, if the landing page is yours and does not build a cross-site profile. First-party session data is easier to justify than third-party tracking pixels.

What changes for a campaign in Quebec? Quebec's private-sector privacy law is stricter than PIPEDA on consent and portability, and Bill 101 requires French-language commercial advertising. Check both before mailing into the province. For the queries that recur most often, see our post on common offline marketing strategy questions.