Law 25 and CASL for restaurants: what collecting guest emails requires
Restaurants that collect guest emails in Canada deal with CASL for commercial messages and, in Québec, the private-sector privacy law as amended by Law 25. In practice the two lead to the same habits: ask separately, ask clearly, make withdrawal easy and act on it. This article explains those habits and how they look at checkout.
Two sets of rules, one moment at the table
A guest who pays at your table hands you more than money. If they type an email address to get a receipt, you now hold personal information. If they also tick a box to hear from you, you hold their consent to receive commercial messages. Two sets of rules apply to that moment.
CASL, Canada’s anti-spam law, covers commercial electronic messages. You need consent before you send, your messages must identify you, and every message must include a working way to unsubscribe. In Québec, the private-sector privacy law, as amended by Law 25, covers how personal information is collected, used and kept, including the consent that makes prospecting legitimate.
Details depend on your situation, and this article is not legal advice. It describes sound habits, not a legal opinion. Ask a lawyer to review your wording before you rely on it.
Keep the receipt and the newsletter apart
A receipt is a service: the guest asked for proof of their own payment. A newsletter is marketing. The most common mistake is to treat every receipt request as a subscription, which turns a service email into a marketing list without the guest ever agreeing.
In OpenRate, entering an email to get a receipt creates a service contact only. The marketing choice is a separate checkbox, unchecked by default, and leaving it unchecked never subscribes anyone. A guest who skips the box on a later visit is not unsubscribed either: an existing consent stays until the guest withdraws it.
Ask clearly, in the guest’s language
Good consent wording is short and specific. It says who will write, what the guest will receive and that they can unsubscribe at any time. In Québec, offer it in French as well as English. The Commission d’accès à l’information publishes its criteria for valid consent, and they are worth reading: consent should be clear, free, informed and specific, and requested separately from other information.
- Name the restaurant that will send the emails
- Describe the content in a few words: news, events, offers
- Keep the checkbox optional and unchecked
- Never make the box a condition of paying or of getting a receipt
Make withdrawal as easy as consent
The CRTC expects an unsubscribe mechanism that is simple, works without an account, keeps working for at least 60 days after your message and is processed without delay, and no later than ten business days. In Québec, where the law applies, you must also inform people of their right to withdraw and stop using their information for prospecting once they do.
In OpenRate, each subscribed guest in your marketing export has a personal unsubscribe link tied to your restaurant. The guest opens it, sees your restaurant’s name and confirms with one button. There is no account and no address to retype. Opening the link alone changes nothing, so an email scanner cannot cancel a subscription by accident. The withdrawal takes effect at once for your establishment, with its date recorded, and it does not touch the guest’s subscriptions at other restaurants.
The exported list is your responsibility
Once you export subscribed guests and load them into your own email tool, OpenRate cannot reach into that file. A guest who withdraws tomorrow is still in the list you downloaded today. OpenRate does not send marketing campaigns for you at the moment, so the sending, and the link you include, are on your side.
- Export the Subscribed list again before every campaign
- Remove addresses that withdrew since your last export
- Act on requests that reach you another way: a reply, a call, a message to the restaurant
- Do not publish the file or share unsubscribe links between recipients
A short checklist for your restaurant
- Unchecked, optional marketing checkbox, separate from the receipt
- Consent wording in English and French
- An unsubscribe link in every email you send
- A fresh export before each send
- Someone named in your business to answer privacy questions: Law 25 expects a designated person, by default the person with the highest authority
- A lawyer’s review of your wording and your messages
Where OpenRate helps, and where it stops
OpenRate provides the unchecked checkbox, the separate receipt, the per-restaurant unsubscribe link and the export. It does not make your restaurant compliant by itself, and it does not review the messages you send. The step-by-step version is in our guide on email opt-in at checkout. For questions about how OpenRate handles guest data, write to privacy@openrate.ca.