For those of you who have consulted with a legal team regarding this new law, do you know if only updating your company's privacy policy is enough to make your company compliant with CASL? From what I have been able to understand about this law, I believe it does not due to the language around express opt-in, which differentiates this law from CAN-SPAM....but just looking to confirm what I think I already know.