Is it legal to let AI text your customers?
Short answer: yes, with consent — and you are the sender, not your software. That is the part most vendors skip, so here is exactly what Quietworkk enforces for you, and what stays yours.
Written by the person who built it, not a marketing team. It is not legal advice — if your situation is unusual, ask a lawyer.
What the software enforces, and how
“Fully compliant” is a claim anyone can make. These name the mechanism, so you can judge whether it would actually hold.
STOP, UNSUBSCRIBE and CANCEL are honoured immediately, and nothing can override it
The suppression check runs inside the send function itself, not at the call sites. A new feature that sends a text cannot forget to check — there is no path to the carrier that skips it.
Every business-initiated text carries an opt-out instruction
Appended automatically unless the message already contains one, so it is present whether the wording came from the AI, from an automation, or from you.
Someone who opts out stays opted out, even if the business closes its account
The database enforces it. Deleting an account used to erase its opt-out records by cascade; the foreign key now detaches them instead, so one party's erasure cannot undo another party's withdrawal of consent.
Automated emails to your customers carry RFC 8058 one-click unsubscribe
So Gmail and Outlook can offer Unsubscribe in their own interface, rather than the recipient reaching for Report Spam — which is what actually protects your sending reputation. Transactional mail does not carry it, because s.6(6) exempts it.
Your customer is told they are talking to an AI, before they type
The notice sits above the send button on every published site, not in a disclaimer after the fact. The reply itself also says an AI wrote it and that a person will confirm details.
The AI will not quote a price or promise a time
Hard rules in the reply engine, tested against adversarial messages 30 times per rule on every audit run — because a rule that holds 29 times out of 30 is not a rule.
What is still yours
Any vendor telling you they absorb your CASL obligation is telling you something false, and you would discover it at the worst possible moment. The obligation follows the sender, and the sender is you.
- Having consent before a message goes out. Under CASL you are the sender; we are the tool. Someone who filled in your contact form has given implied consent to a reply — a list you bought has not.
- Not importing lists of people who never asked to hear from you.
- The content of anything you write yourself, as opposed to what the AI drafts under its rules.
- Telling us if you are subject to rules that need a formal written data-processing agreement, so we can sign one.
Common questions
- Is it legal to have AI text my customers in Canada?
- Yes, with consent. CASL governs commercial electronic messages regardless of whether a human or software composed them, and it treats you — the business — as the sender. Someone who submits an enquiry through your website has given implied consent to a reply about that enquiry. A purchased list has not. Quietworkk enforces the mechanical parts in code: STOP is honoured inside the send function so no feature can skip it, an opt-out instruction is attached to every business-initiated text, and opt-out records survive even the deletion of the account that created them.
- Does using an AI receptionist put my CASL obligations onto the vendor?
- No, and be wary of any vendor who says it does. Under CASL the sender is the business on whose behalf the message goes out. Software can make compliance the default — enforced opt-outs, automatic identification, retained consent records — but it cannot take on your legal obligation. Quietworkk's terms say this plainly rather than burying it.
- Do my customers have to be told they are talking to an AI?
- There is no Canadian statute that requires it in these words today, but misleading someone about who they are dealing with creates exposure under general misrepresentation rules, and it costs you trust the moment they work it out. Quietworkk tells them before they type: the notice sits above the send button on every published site, and the AI is instructed never to claim to be a person.
- Where is my customers' data stored, and does PIPEDA allow that?
- Several of our processors hold data outside Canada, principally in the United States — the database, hosting, the AI model, SMS and email delivery. PIPEDA permits transferring personal information across borders for processing, provided the organisation remains accountable for it and tells people it happens. Our privacy policy names every processor and what each one handles. Anyone can ask for a copy of their data or have it erased, and an account owner can delete everything themselves from Settings — immediately, not within thirty days.
- What happens to opt-outs if I close my Quietworkk account?
- They are kept. Everything else goes — your business details, your website, every enquiry your customers sent you — but records of people who asked to stop receiving messages are retained, because erasing one party's data cannot undo another party's withdrawal of consent. This is enforced by the database rather than by policy: the foreign key detaches those rows instead of deleting them.
The detail lives in our Privacy Policy — which names every processor and what each one handles — and in the Terms, where section 7 commits to telling you within 72 hours if we are ever breached in a way that puts you or your customers at real risk.
Put your AI to work today.
Create your account and describe your business in a chat — your AI starts answering enquiries in minutes, and builds your website and a custom agent right alongside it.