Computer program rules

Things to know

Computer program provisions in Canada’s Anti-Spam Law (known as CASL) impose express (opt-in) consent rules on the installation of a computer program (including updates) another person’s laptop, smartphone, desktop, gaming console or other computing device
It is prohibited for a website to automatically install software on a visitor's computer without getting consent, or for software to be updated without first obtaining consent
The consent rules apply regardless of whether the program is installed for a malicious or fraudulent purpose
Regulatory guidance suggests that self-installed software (e.g., a download from an app store) is not covered under CASL – although consent is needed for software that is not brought to the attention of the consumer prior to installation
Penalties for non-compliance include fines of up to CAD $10 million per violation

Consider whether Canada’s Anti-Spam Law (CASL) applies in your situation and whether you can rely on an exception to the consent rules
If requesting express consent, ensure that your request complies with CASL’s prescriptive notice rules (which include setting out a description in general terms of the functions and purpose of the computer program to be installed, a statement that consent may be withdrawn, the purpose/scope of the consent, and prescribed identity and contact information) and regulator guidance
Consider whether your program will trigger “written acknowledgement” rules applicable to certain computer functions that you know and intend to be contrary to reasonable expectations of the owner or authorized user of the device

Download topic