A text campaign paused mid-launch while a customer list got checked

The situation

The plan was simple, and it had worked for plenty of small businesses before: send a round of text messages to loyal customers announcing a weekend sale, and use the response to decide whether text marketing was worth doing regularly. Parminder worked full time as a commercial cleaner, and his wife Kiran worked as a bookkeeper for a local accounting firm. On evenings and weekends, the two of them ran a small home goods and gift business out of a rented unit in Port Colborne, selling at a storefront a few days a week and at regional markets the rest of the time.

The business had started small, almost as a hobby, but over about eighteen months it had grown into something with real numbers behind it, landing around one hundred thousand dollars in annual revenue. On the advice of a family member years earlier, when the business was first registered, ownership had been structured through a family trust that Parminder's parents had set up, with Parminder and Kiran as trustees managing the operation day to day. It was a sensible structure for a small family enterprise, and it had never caused any complications until the text campaign did.

Kiran, comfortable with spreadsheets from her day job, had spent a slow week in early summer pulling together a contact list for the campaign. She combined names and numbers from three sources: an email sign-up sheet kept at the storefront counter, phone numbers collected from customers who had called in with questions, and a handwritten list from market events where customers had jotted down their numbers for a draw entry. All three felt, to Kiran and Parminder, like customers who wanted to hear from the business. The text went out to just over four hundred numbers on a Thursday afternoon.

By Friday morning, the business had received a reply that was not a customer inquiry. It came from a man named Qing, who identified himself as the owner of a much larger home goods retailer in the region, and whose personal cellphone number had apparently ended up on the market draw-entry list through a mix-up months earlier. Qing's message was polite but pointed: he had not agreed to receive marketing texts, he ran legal compliance for businesses far larger than theirs as part of his own company's operations, and he wanted to know exactly how his number had been obtained and used.

What the review found

Parminder and Kiran came to our office within days, worried less about Qing's specific number and more about what else might be sitting in the same list, unnoticed, waiting for someone else to complain. The review we ran confirmed the worry was well founded, though not in the way either of them expected going in.

Commercial text and email marketing in Canada is governed by federal rules requiring meaningful consent before a business sends promotional messages, along with a clear, working way for recipients to opt out of future contact. Consent can be given in more than one way, and the difference matters more than most small businesses assume. A customer who fills out a sign-up form has given express consent, which lasts until the customer withdraws it — but only if the form itself did the required work: a clear statement of what the customer is agreeing to receive, who is asking and on whose behalf, how to reach the business, and how to withdraw consent later, with the customer actively opting in rather than finding a box already ticked, and the business able to prove afterward that it actually got that consent. A customer who has an existing business relationship with a company — a recent purchase, an active inquiry — may, in narrower circumstances, be considered to have implied consent, but only for a limited period and only for communications reasonably connected to that relationship. A business that cannot show which kind of consent it had for a given contact, or that mixes the two together on one list, is exposed either way, because it cannot point to a clean answer if asked.

Our audit of the four hundred numbers found three distinct categories mixed together on a single spreadsheet, with no field recording where any given entry had come from or why. The email sign-up sheet kept at the counter had a checkbox specifically for marketing consent, and about two hundred and ten of the numbers came from customers who had ticked it — genuine express consent, properly documented and easy to defend. The phone-inquiry numbers, roughly one hundred and thirty of them, had never been asked about marketing at all; they existed only because a customer had called with a product question and someone had jotted the number down for follow-up on that specific question. The market draw-entry list, just under seventy numbers including Qing's, had been collected for one stated purpose only — entry into a prize draw — with no marketing consent attached to it in any form.

That last category was the clear problem, and arguably the phone-inquiry numbers were a smaller version of the same issue. A number collected for one specific, limited purpose cannot be reused for a different purpose, marketing included, without separate consent obtained for that new purpose, no matter how harmless the reuse feels to the business doing it. The draw-entry list should never have been merged into the campaign at all, and Qing's number was simply the one that happened to belong to someone with both the standing and the resources to notice and say so.

What we did

1. Paused the campaign immediately — before drafting any response to Qing at all, we had Parminder and Kiran stop any further texts and hold the full list, because continuing to send messages while the consent basis was actively in dispute would have made the exposure worse with every additional message, not smaller, and would have undercut any good-faith argument the business later wanted to make.
2. Audited the full contact list by source — we had Kiran walk us through exactly where every number on the spreadsheet had come from, sorting all four hundred entries into the three categories described above, because the business's real exposure depended entirely on how many contacts fell into the unconsented group, not on how large the total list looked at a glance.
3. Identified and isolated the improperly used numbers — the roughly seventy draw-entry numbers, including Qing's, were pulled out of the active campaign list entirely and flagged separately in the spreadsheet with a locked note explaining why, so they could not accidentally be re-included in a future send by someone who had not been part of this conversation, before a proper fresh consent request had gone out to that group on its own separate terms.
4. Responded to Qing directly and candidly — rather than dispute what had happened, minimize it, or wait to see whether he would actually follow through on a complaint, we had the business acknowledge the mistake in writing, explain plainly and specifically how the draw-entry mix-up occurred, and confirm the number had already been removed from the active list before he had even asked for that confirmation. Owning the error early took much of the sting out of what could easily have become an adversarial opening exchange.
5. Assessed the realistic exposure honestly — Qing's message made clear, more than once, that his company had the resources and the in-house legal capacity to pursue a formal complaint if it chose to, a point he did not strictly need to make and made anyway as leverage. We walked Parminder and Kiran through what a worst-case escalation could realistically look like, so they were negotiating from an accurate picture of their position rather than from fear alone.
6. Negotiated a resolution rather than litigating a threat — we opened a direct, low-key conversation with Qing proposing a written acknowledgment, a small goodwill gesture, and a firm, documented commitment to a corrected consent process going forward. Given the size mismatch between the two businesses, settling the matter directly and quickly was a far cheaper and faster path for Parminder and Kiran than defending a formal complaint on its merits, whatever those merits would ultimately have turned out to be once tested.
7. Rebuilt the consent process for future campaigns — we set the business up with a single-purpose sign-up form that clearly separates marketing consent from any other reason a customer might hand over their number, replacing the old counter sheet that had let three different purposes blur into one. Every new form now carries a working, tested opt-out link on the message itself, not buried in a website nobody visits, so the same kind of list-mixing has no way to happen again.
8. Put a written policy in place for the trustees — since the business operated through a family trust rather than a straightforward sole proprietorship, we drafted a short internal policy for Parminder and Kiran as trustees, setting out how customer data may be collected, stored, tagged by source, and reused for a new purpose only with fresh consent. The point was to give the next decision about a new marketing channel a documented standard to follow instead of instinct alone.

The outcome

Qing's company did not pursue a formal complaint. In exchange for a written apology, a modest goodwill payment in the low hundreds of dollars, and documented proof that the draw-entry numbers had been permanently removed from marketing use, he agreed to close the matter. It was not a costless resolution, and Parminder and Kiran were candid with us afterward that the whole episode had shaken their confidence in a business they had built almost entirely on instinct up to that point.

The compromise reflected the real imbalance in the dispute rather than an ideal legal outcome. Qing had made clear, without ever quite threatening it outright, that his company's resources made a drawn-out complaint an easy thing for him to pursue and a genuinely expensive thing for a family side business to defend, regardless of how the underlying facts might eventually have sorted out on the merits. Recognizing that imbalance early, and negotiating from it directly rather than digging in on principle, kept a manageable problem from becoming an unmanageable one that could have consumed months of the business's time and a meaningful share of its modest revenue.

The text campaign resumed about six weeks later, this time using only the properly consented list of roughly two hundred and ten customers, with a working, tested opt-out link on every message sent. It performed well enough that Parminder and Kiran decided to keep doing it quarterly, and the phone-inquiry list was rebuilt from scratch with an explicit marketing question added at the point of collection rather than assumed. The family trust structure itself was never actually the source of the dispute, but reviewing it alongside the consent problem gave the trustees a clearer sense of what records the business needed to keep going forward, for marketing and for everything else the trust would eventually be asked to account for.

What you can learn from this