The tag most agent databases are missing is not a marketing field. It is a legal one: what is your consent basis for this contact, and when does it run out.
Key takeaways
Most agent databases are not organized. They are accumulated. A few hundred past clients, a few thousand open-house sign-ins, a folder of leads bought two years ago, all of it tagged, if it is tagged at all, by pipeline stage: buyer, seller, past client, sphere. That tagging scheme answers a marketing question. It does not answer the question that actually determines whether you are allowed to email any of those people, which is a legal one: what is your consent basis for this specific contact, and when does it run out.
Canada's Anti-Spam Legislation (CASL) prohibits sending a commercial electronic message — an email, a text, a social DM with a sales purpose — unless the recipient has consented, “whether the consent is express or implied”. That single clause is why “past client” is not, on its own, a usable tag. A past client's consent is real, but it is implied, and implied consent has an expiry date. The tag that actually protects you is not the relationship label. It is the consent record behind it.
Under the Act's implied-consent rule, you may treat a contact as having consented to a commercial electronic message if it follows a purchase, lease, or an interest in land ‘within the two-year period’ before the message is sent, or an ‘inquiry or application’ ‘within the six-month period’ before the message is sent. Two different clocks, two different trigger events. A closed transaction buys you two years of implied consent from the closing date. A lead who filled out a form but never transacted buys you six months from the date of that inquiry — not two years, and not indefinitely.
So the first tag every contact needs is not “buyer” or “seller.” It is consent type (express or implied) and consent start date (the closing date, or the inquiry date). Everything else — lifecycle stage, source, property type — is useful for marketing. Only this pair is what stands between you and a violation, and violations under CASL carry administrative monetary penalties up to $1,000,000 for an individual and $10,000,000 for a corporation or brokerage, per contravention, at the high end of the scale.
A second, Ontario-specific reason to rebuild your tags around consent rather than stage: the old “customer” bucket many agents still use — someone you've helped without a signed representation agreement — does not describe a relationship TRESA still recognizes. RECO's own bulletin states it flatly: “There is no equivalent to a customer or a customer agreement under TRESA.” Since December 1, 2023, a person is either a client under a representation agreement or a self-represented party. Any customer agreement that survived past March 30, 2024 automatically expired on that date. A tag scheme that still sorts contacts into buyer / seller / customer / past client is filing people under a category that no longer exists in law — and it is quietly hiding the one distinction, client versus self-represented party, that actually changes what you owe them.
The trap runs the other way too. RECO's companion bulletin lists the specific conduct that creates an implied representation agreement with no signature at all: “advising potential sellers what their home may be worth or soliciting confidential information from a consumer about their motivation to buy or sell a property”, along with exchanging confidential information, giving advice, or negotiating on someone's behalf. If a database tag says “prospect — send home value alerts,” and you personally answer that prospect's questions about their own home's worth, you may have just created a representation relationship your tag never accounted for.
Federal privacy law adds a second layer, and it cuts the other way from what most agents assume: it is not primarily about locking data down, it is about not collecting more of it than you need. PIPEDA's ten fair information principles include “limiting collection” and “limiting use, disclosure and retention” alongside consent and accountability. A tag field for a contact's income bracket, marital status inferred from a Facebook profile, or a note about their divorce is not a marketing convenience — under the collection-limiting principle, it is data you have no stated purpose for holding, which is itself the exposure, independent of whether you ever misuse it.
RECO's own confidentiality bulletin adds a professional layer on top: information gained while representing a client “must be protected,” and disclosure to a third party needs the client's written consent, with the brokerage responsible for who inside the office has access to client files, computer passwords, and email accounts. RECO's bulletin is explicit that it does not itself set rules for CRMs or cloud storage — it defers that question entirely to federal privacy law. A tagging system is not just a marketing tool at that point; it is the access-control record RECO expects to exist.
Put together, a tag structure that actually protects you needs at minimum: (1) consent type — express or implied; (2) consent start date — the closing date or inquiry date the clock runs from; (3) relationship status — client under a representation agreement, or self-represented party, never “customer”; and (4) source — where the contact came from, which doubles as your evidence trail if your consent basis is ever questioned. Everything else — farm area, price range, pet ownership — is a marketing nicety you can add once the four fields that keep you compliant are in place.
Picture a buyer who inquired about a listing through your website in January, never transacted, and is still sitting in your database in September. Under the six-month inquiry window, that implied consent lapsed in July. If your only tag for that person is “lead — buyer,” nothing in your system tells you the clock has run out, and your next monthly newsletter goes out to them anyway. If the tag instead reads “implied, inquiry 2026-01-14,” a simple filter — anything implied and older than six months — flags the contact before you send, not after a complaint does.
The same logic runs the other way for a closed transaction. A seller who closed in March 2025 is still inside the two-year implied-consent window today, and will remain so until March 2027 — but only for messages that relate to the relationship the transaction created. The date field is what makes that distinction checkable in seconds instead of requiring you to remember, contact by contact, which closings happened when.
Related: a full database clean-up project, the implied-consent two-year clock, defined, and whether PIPEDA applies to a solo agent.
Neither CASL nor PIPEDA names a required tool. What matters is that you can show, for any contact you message, what your consent basis is and when it started — a well-kept spreadsheet with those two fields meets that bar as well as a CRM does; a CRM with a hundred fields and no consent column does not.
It lapses. Under section 10(10)(b), implied consent from an inquiry runs for six months from the date of the inquiry. After that, sending a commercial electronic message needs express consent, or the contact needs to be dropped from electronic sends entirely, though nothing stops you from reaching them by phone or mail, which CASL does not govern.
No — and conflating them is exactly the failure mode RECO's bulletins warn about. A client is under a representation agreement and is owed fiduciary duties; a self-represented party is not, and Ontario has had no “customer” middle tier since TRESA took effect. The tag should record which one a contact actually is, not which one is administratively convenient.
A short call is enough to map your consent status, your tagging structure, and the touch cadence that fits your book.
