Canada’s Anti-Spam Legislation (CASL) governs commercial electronic messages — emails, text messages and direct messages that encourage participation in a commercial activity. Unlike many other countries, Canada uses an opt-in model: you need consent before you send. Penalties can reach $1 million per violation for individuals and $10 million for businesses, so it is worth getting right.
Three requirements for every commercial message
- Consent — express or implied.
- Identification — who is sending the message, with a mailing address and a phone number, email or web address.
- An unsubscribe mechanism — simple, free, valid for at least 60 days after sending, and honoured within 10 business days.
Express consent
Express consent does not expire unless the person withdraws it. To be valid, your request must:
- Explain the purpose (for example “monthly newsletter and product offers”).
- Identify who is asking for consent.
- State that the person can withdraw consent at any time.
The person must actively opt in. Pre-checked boxes do not count, and consent for marketing cannot be bundled into accepting your general terms.
Sample wording: “☐ Yes, send me the [Company] newsletter with privacy tips and product updates. You can unsubscribe at any time. [Company], [address], [email].”
Implied consent
Implied consent is time-limited and narrower. Common situations:
- Existing business relationship: a purchase or contract within the last 2 years, or an inquiry or application within the last 6 months.
- Conspicuous publication: someone publishes their business email (for example on their website) without saying they don’t want messages, and your message is relevant to their role.
- Disclosure: someone gives you their business email without saying they don’t want messages, and your message relates to their role.
Best practice: use the implied-consent window to ask for express consent, so you don’t lose contacts when the clock runs out.
Messages that don’t need consent
Some messages are exempt from the consent requirement but must still include identification and an unsubscribe mechanism — for example responding to a request for a quote, providing warranty or safety information, or factual updates about an ongoing subscription or account. Others are fully exempt, such as messages between people with a personal or family relationship, or certain business-to-business messages between organizations that already have a relationship.
Keep proof of consent
If challenged, the burden is on you to prove consent. For every contact, record:
- How and when consent was obtained (form, page, date and time).
- The exact wording shown to the person.
- For implied consent: the date of the purchase or inquiry that started the clock.
- Unsubscribe requests and the date they were processed.
CASL compliance checklist
- Audit your mailing lists and remove contacts without documented consent.
- Replace pre-checked boxes with unchecked opt-ins.
- Add identification details and a one-click unsubscribe link to every email template.
- Automate expiry tracking for implied consent.
- Never buy or rent email lists.
- Train anyone who sends sales emails or texts, not just marketing.
CASL works alongside privacy law: the personal information on your mailing lists is also covered by PIPEDA, and your privacy policy should explain how people can opt out.
Frequently asked questions
Does CASL apply to emails I send to other businesses?
Yes, CASL applies to business email addresses too, although implied consent and some B2B exemptions may apply.
Does CASL apply if my company is outside Canada?
CASL applies to commercial electronic messages accessed from a computer system in Canada, so foreign senders emailing Canadians are generally covered.
Get a second pair of eyes
Secure Pathways helps small and mid-sized businesses turn privacy requirements into a clear, manageable routine — from privacy audits and policy templates to consent management and breach readiness. If you are not sure where you stand on CASL compliance, get in touch for a complimentary consultation.
This article is general information, not legal advice. Privacy rules change and depend on your industry and province — confirm your obligations with a qualified professional.
