Using customer stories, names and photos in your marketing: the permission Canada requires

Section 74.02 of the Competition Act deals with testimonials directly. Publishing a testimonial about a product is reviewable conduct unless the person publishing it can show that the testimonial was previously made or published by the person who gave it, or that it was approved and permission to make or publish it was given in writing by that person. In either case the published testimonial has to accord with what was made or approved.

For most small businesses the practical meaning is simple. A kind email, a message after a project or a comment made in a meeting is unpublished praise, and it needs the customer's written yes before it appears on a website. A public review the customer posted themselves is already published by them, though platform terms and professional rules may still limit reuse.

The federal Personal Information Protection and Electronic Documents Act requires the knowledge and consent of the individual for the collection, use or disclosure of their personal information. A customer's name, face and story are personal information, and marketing is a different purpose from delivering the service they bought.

The Act says consent is valid only if it is reasonable to expect the individual would understand the nature, purpose and consequences of what they are agreeing to. Its principles say organizations should generally seek express consent when information is likely to be considered sensitive, and that consent may be withdrawn. The Privacy Commissioner's guidance adds that express consent is generally needed where a use falls outside the individual's reasonable expectations.

Quebec has its own private sector privacy law, and its regulator, the Commission d'accès à l'information, describes valid consent as manifest, free, informed and specific. Alberta and British Columbia also have provincial privacy statutes. A clear written release meets the common thread in all of them.

A consented, specific customer story is one of the most valuable things a service brand owns, and the release is what makes it an asset the business can keep using. Stories gathered informally have to come down the moment anyone objects.

Build the ask into the project. The end of a successful engagement is the natural time to request a story, with the draft wording attached for approval. Offer levels of visibility, from full name and photo to an anonymised account, and record what each customer chose.

Regulated professions often face tighter limits on testimonials than this general law sets, which the province specific guides on this site cover. For those practices, anonymised case descriptions and process stories usually do the work a testimonial would.