BRIEFING

Rules of the Road: The Rules Were Already in Force. What Changed Is the Tone.

Published 2026-10-02 by Marketingz, Laval.

Several regulators made news this summer. Canada's spam regulator said it expects more compliance. The US Federal Trade Commission settled charges against a marketing company over an AI service. A Dutch regulator fined Uber €825 million over automated driver suspensions. Read together, they look like a crackdown on marketing.

This issue's thesis is narrower: for a business in Laval, the Canadian and Quebec rules that bind it today were already in force before any of this news, and the enforcement reports checked here do not show penalties landing on small marketers. The EU rules are the exception: some took effect this summer, but they reach a Laval business only in specific cases. What changed is the regulators' stated posture. That is a reason to fix the basics now, while doing so is cheap. It is not evidence that fines are on the way. Every figure links to its source next to the claim. Sources are cited as they stood on 2 October 2026. Where the evidence is thin, this issue says so.

The short version

• Canada's anti-spam law (CASL) applies to any commercial email or text a Laval business sends. Its consent and identification rules are already in the Act (CASL s. 6). The regulator now speaks of a "heightened expectation" of compliance (emailexpert, 26 August 2026), but its latest reported six months show 11 warning or information letters and no new financial penalty announced.
• Quebec's private-sector privacy law already requires a business to publish who is in charge of personal information, and to tell people when a decision about them was made by software alone (CAI, Principaux changements apportés par la Loi 25).
• The FTC case settled charges; a settlement is not a court finding. Canada has its own rule against false or misleading claims made to promote a business (Competition Act s. 52(1)).
• The EU AI Act and GDPR reach a Laval business only in specific cases: when its AI output is used in the EU, or when it offers goods or services to people in the EU or monitors their behaviour there.

Is CASL enforcement getting tougher, or just the language?

On the record published so far, the language. The latest six months show 11 warning or information letters and no new financial penalty announced.

Between 1 October 2025 and 31 March 2026, Canada's Spam Reporting Centre received 189,908 submissions, an average of 7,304 a week. Over those six months the CRTC issued "11 warning or information letters, 96 notices to produce and two preservation demands", and the report "does not announce a new financial penalty for the period" (emailexpert, 26 August 2026). The same summary reports the CRTC's statement that there is "a 'heightened expectation' that businesses comply". The CRTC's own page for that period (CRTC, Enforcing CASL, period ending 31 March 2026) could not be retrieved for this issue, so those figures are given as emailexpert reports them.

Among complaints filed through the detailed form, 93% cite missing consent and 48% a sender who could not be identified. Those are the two things CASL asks of every commercial message: the recipient consented, expressly or by implication, and the message identifies who sent it, how to reach them, and how to unsubscribe (CASL s. 6). Implied consent covers a few narrow cases, such as an existing business relationship, or an address the person published conspicuously with no "no unsolicited messages" statement when the message is relevant to their role (CASL s. 10(9)). The law applies when a computer system in Canada is used to send or access the message (s. 12(1)), so it covers the commercial emails and texts a Laval business sends. For a small business, the chart shows what a complaint is most likely to be about. A dated record of how each contact agreed to hear from you, plus your business name, a way to reach you and a working unsubscribe link in every message, addresses the two reasons complaints cite most.

The latest report, as summarised by emailexpert, describes no penalty against a small business for marketing email. That is what this report shows, not proof that no such case exists. The ceiling remains $10 million per violation for a business and $1 million for an individual (CASL s. 20(4)). What this report cannot tell you is whether the "heightened expectation" turns into penalties against ordinary senders. The next CRTC report will show more.

What does Quebec's privacy law already require of a business in Laval?

Three things matter most: publish who is in charge of personal information, tell people when software alone made a decision about them and let them ask a person to review it, and follow the consent rules in force since September 2023. Quebec's Law 25 amended the province's private-sector privacy act: some changes applied from September 2022, others from September 2023, and the right to data portability from 22 September 2024 (CAI, Principaux changements apportés par la Loi 25). A business operating in Laval is covered.

In detail, from the Commission d'accès à l'information (CAI), Quebec's privacy regulator:

• A named person in charge. By default it is the person with the highest authority in the business, usually the owner. The role can be delegated in writing, in whole or in part, and the title and contact details of that person must be published on the business's website (CAI, Responsable de la protection des renseignements personnels).
• Notice of automated decisions. When a decision about a person is based exclusively on automated processing of their personal information, the business must tell them, at the latest when it informs them of the decision. It must also give them a chance to present their observations to a staff member who can review it (CAI, Principaux changements apportés par la Loi 25).
• Consent. New rules on consent to the collection, use and communication of personal information have applied since September 2023 (same CAI page).

The penalties are set out by the CAI. Administrative monetary penalties can reach $10 million or 2 percent of worldwide turnover, whichever is higher. Failing to inform people of an exclusively automated decision, or of their right to have it reviewed, is on the list of failings that can draw one. Penal fines for a business run from $15,000 up to $25 million or 4 percent of the previous year's worldwide turnover, whichever is higher, and double for a repeat offence (CAI, Sanctions). The sources checked for this issue do not say how often the CAI has used these powers, or against businesses of what size. That gap is real, and nothing here should be read as saying small firms are being fined.

The practical point for a Laval business is narrower than the penalty figures. If software alone decides something about a person, such as rejecting an application, closing an account or flagging a payment, Quebec law already requires you to tell them and to let them reach a person who can review the decision. The CAI places responsibility for personal information on the business that holds it (CAI, Principaux changements apportés par la Loi 25), whichever tool makes the decision.

Can a business get in trouble for what it says about AI?

In the US, a marketing company has just paid to settle charges over what it said an AI service could do. In Canada, the general rule against misleading claims already covers it.

On 27 August 2026 the FTC gave final approval, by a 2-0 vote, to consent agreements with CMG Media Corporation, which does business as Cox Media Group, and two other firms. The FTC charged that the companies "deceived customers by falsely claiming to offer an AI-powered service that could target localized ads based on conversations captured from consumers' smart devices". Cox Media Group must pay $880,000, and MindSift LLC and 1010 Digital Works LLC $25,000 each. The money will be used to provide redress to affected CMG customers (FTC, 27 August 2026). These are settlements of charges. The release describes what the FTC alleged, not a court finding that the allegations are true.

The FTC enforces US law, and the sources checked here do not settle whether or how it could reach a business in Quebec. Canadian rules are closer to home. Under the Competition Act, no person may, to promote a product or any business interest, knowingly or recklessly make a representation to the public that is false or misleading in a material respect (Competition Act s. 52(1)). The Act also treats misleading claims as reviewable civil conduct, where intent does not have to be shown (s. 74.01). The Commissioner of Competition administers and enforces the Act (s. 7(1)). Nothing in that section is specific to AI. It applies in Laval today to claims a business makes to the public, including claims about what an AI tool does for its customers. The cheap habit: do not repeat a vendor's capability claim in your own marketing unless you have checked it. This is one US case, and it does not show a pattern either way.

Do the EU AI Act and the Uber fine reach a business in Laval?

Only in specific cases, which each law defines.

The EU AI Act. Its transparency rules in Article 50 apply from 2 August 2026. The EU's Digital Omnibus, in force from 27 July 2026, moved the high-risk deadlines to 2 December 2027 for Annex III systems and 2 August 2028 for AI embedded in regulated products such as machinery, toys and lifts. Generative systems already on the market have until 2 December 2026 to carry machine-readable marking of synthetic output (euaiact.com, implementation timeline, consulted 2 October 2026). The Act covers providers and deployers outside the EU when the output of their AI system is used in the Union (Article 2(1)(c)). For a business that uses AI tools (a "deployer"), Article 50 requires disclosure that a deepfake image, audio or video was artificially generated or manipulated. It also requires disclosure of AI-generated text published to inform the public on matters of public interest, unless a person reviewed it and someone holds editorial responsibility (Article 50(4)). Telling people they are talking to an AI system, and marking output in machine-readable form, are duties placed on providers, the companies that build the tools (Article 50(1) and (2), same link). A Laval business whose AI output is not used in the EU is outside this. One whose AI output is used there is not.

The Uber fine. The Dutch Data Protection Authority fined Uber €825 million, about US$966 million. The regulator found that Uber "committed serious infringements" by deactivating driver accounts through automated processes without sufficient warning or human oversight. Uber disputes the findings, says no permanent deactivation happens without human review, and will appeal. TechCrunch calls it the second-largest penalty issued under GDPR (TechCrunch, 23 August 2026). It is a decision under appeal, not a final outcome.

GDPR reaches a business outside the EU only when it processes the personal data of people in the EU in connection with offering them goods or services, or monitoring their behaviour there (GDPR Article 3(2)). For any Laval business, the rule on automated decisions that applies in every case is Quebec's, described above. It is narrower than GDPR's. The CAI describes a duty to inform and to offer review, where GDPR gives a right not to be subject to such a decision at all, with exceptions (GDPR Article 22). The Uber case shows one European regulator acting against automated decisions it found lacked sufficient human oversight. Whether the CAI will act the same way in Quebec, the sources checked here do not say.

What to watch next

• The CRTC's next CASL report, covering April to September 2026, will show whether the "heightened expectation" produced penalties, and against whom.
• Any published CAI decision imposing a monetary penalty under the private-sector act, which would show how the 2 percent and $10 million ceilings apply in practice.
• Uber's appeal of the Dutch decision.
• The 2 December 2026 marking deadline under the EU AI Act, and whether the December 2027 and August 2028 high-risk dates hold after already moving once.

Questions, or a correction: marketingz@campaigncrush.org or (438) 813-2465.