WordPress website maintenance & support
in Ottawa

Canada has an anti-spam law, usually called CASL, that governs commercial electronic messages. For a WordPress site it matters wherever the site collects an email address and later sends something promotional to it. That covers the newsletter form, the checkout, the member sign-up and many contact forms. A support team touches all of these, often without anyone thinking about the law.

The core idea is consent. The law separates express consent, where the person actively agreed to receive messages, from implied consent, which can come from an existing business relationship and lasts for a limited period. The two need different records. Express consent needs proof of what the person agreed to, when and through which form. Implied consent needs the date of the purchase or enquiry that created it.

On a WordPress site these records live in plugins. A form plugin stores entries. A newsletter plugin stores subscribers and sometimes the source. A membership plugin stores accounts. Very often none of them keeps the wording of the consent checkbox as it looked on the day someone ticked it. Support can fix that by logging the form version or the checkbox text with each entry.

Checkboxes deserve a close look. A box that is ticked by default does not give express consent. Neither does a sentence buried in the terms. The request should be separate, clear, and say who is asking. Plugin updates sometimes reset form settings or change field defaults, so a box that was blank last month may be pre-ticked now.

Every commercial message also has to identify the sender and include contact information. It must offer a working way to unsubscribe. The unsubscribe request has to be honoured promptly, within the time the law sets. In WordPress terms that means the footer of every template in the mail plugin, and the unsubscribe link itself.

Links break quietly. A change of mail plugin, a new permalink structure or a page deleted during a cleanup can leave the unsubscribe link pointing at an error page. Nobody notices, because people who want to leave do not complain first. They mark the message as spam. Enough of those reports and the mail provider starts filtering every message from the domain, including invoices and password resets.

Membership sites add a wrinkle. Account emails such as password resets and renewal notices are transactional, but a renewal notice that also advertises a new course is partly commercial. Templates drift that way over time. Support should know which templates are purely service messages and keep promotions out of them unless consent exists.

After each round of updates, a short checklist helps. Submit every form that collects email and confirm that consent is recorded. Check that no consent box is pre-ticked. Send a test newsletter and click the unsubscribe link. Confirm the address is removed in the mail system as well as on the site. Look at the sender name and contact details in the footer.

Imports are the last risk. Someone uploads a list from a trade fair or an old spreadsheet into the newsletter plugin. Support cannot judge the legal basis of every list. It can ask where the list came from and refuse to merge addresses without a consent source.

None of this replaces legal advice on a specific campaign. It keeps the technical side honest. When a question about consent does come up, the owner can show records, templates and dates in minutes instead of reconstructing them from memory and old exports.