CASL: Canada’s Anti-Spam Law for Marketing Email Explained

CASL, Canada’s anti-spam law, says you need the recipient’s consent before you send a commercial email or text, and every message must name you, give your contact details and include an unsubscribe that works within 10 business days. It applies to business-to-business email as well as messages to consumers, and if anyone challenges you, it is up to you to prove you had consent. This guide covers what counts as consent, who is exempt, what each message must contain and the records worth keeping.

This is general information about the law, not legal advice. For a specific situation, speak with a lawyer.

What is CASL?

CASL is the short name for Canada’s anti-spam legislation, a federal law in force since 2014. Its main rule for marketers is section 6 of the Act: you may not send a commercial electronic message (an email, a text, an instant message or a social media direct message that promotes a product, service or business opportunity) unless the person has consented and the message meets set content rules. The full text is on the Justice Laws website, and the government’s overview lives on the Canada’s anti-spam legislation page.

The law also covers installing software on someone’s computer without consent and altering transmission data, but for most small businesses the email and text rules are the part that matters day to day. The CRTC enforces the messaging rules and can issue administrative monetary penalties.

Does CASL apply to B2B email?

Yes. A promotional email to another business address is still a commercial electronic message, so it needs consent like any other. There is a narrow exclusion for messages between employees of two organizations that already have a relationship, when the message is about the receiving organization’s activities. Prospecting emails to companies you have never dealt with do not fall under that exclusion.

Express consent and implied consent

CASL recognizes two kinds of consent. Express consent is a clear yes that the person gave you, and it does not expire unless they withdraw it. Implied consent comes from a relationship or a situation the law describes, and most forms of it run out after a set period.

How to ask for express consent

The regulations say a request for consent must be sought separately for each purpose and must include:

• the purpose, stated clearly (for example, “to send you our monthly offers and news”);
• the name of the business seeking consent, and the business it is on behalf of, if different;
• a mailing address plus a phone number, email address or web address;
• a statement that the person can withdraw consent at any time.

An unticked checkbox the person ticks themselves, next to that wording, is the usual way to do it on a website form. A pre-ticked box, or consent hidden inside your general terms, is weak evidence.

When consent is implied

Under section 10 of the Act, consent is implied in a few situations, including:

• A purchase or contract. The person bought or leased something from you, or accepted a business opportunity, within the two years before your message.
• An inquiry. The person asked you about your products or services within the six months before your message.
• A published address. The person conspicuously published their email address, did not say they want no unsolicited messages, and your message is relevant to their business role.
• An address handed to you. The person gave you their address directly, without saying they want no messages, and your message relates to their business role.

Implied consent is useful, but it has a clock on it. A customer who bought once three years ago and never gave express consent is no longer someone you can email under the purchase rule. That is why most email programs ask existing customers for express consent while the implied period is still running.

Is cold emailing illegal in Canada?

Sending a promotional email to someone who has not consented, and who does not fall under an exemption, breaks CASL. So a cold campaign to a bought list of strangers is not allowed, and a purchased list does not carry consent with it. The published-address rule allows some business outreach: if a company publishes a buyer’s work email on its website with no “no solicitations” note, a relevant message about that person’s job can rely on implied consent. Read that rule narrowly. It does not cover addresses scraped in bulk or messages unrelated to the person’s role.

There is also a referral exception. One first message may go to someone a mutual contact referred you to, as long as the message names the person who made the referral and says it is sent because of that referral.

Who is exempt from CASL?

The Act and its regulations exclude certain messages from the consent rule. The main ones for businesses and organizations are:

• messages to family members or people you have a personal relationship with;
• a message to a business that consists only of an inquiry or application about its business;
• messages within an organization, and between organizations that have a relationship, about the receiving organization’s activities;
• a reply to a request, inquiry or complaint, or a message the person asked for;
• messages sent by or for a registered charity whose main purpose is raising funds for the charity;
• messages sent by or for a political party, organization or candidate to seek a contribution.

Some messages also need no consent but still need the identification details and unsubscribe, for example a quote the person asked for, or a confirmation of a purchase. Transactional messages like receipts and delivery notices are easier to defend when they do not carry heavy promotion.

What every commercial email must include

Every commercial message you send under CASL must include three things, set out clearly and prominently:

• the name of the business sending it, and the name of the business it is sent on behalf of, if different;
• a mailing address, plus a phone number, email address or web address where the reader can reach you;
• an unsubscribe method that is easy to use and costs the reader nothing.

The contact details and the unsubscribe link must keep working for at least 60 days after the message is sent. Most email platforms add a footer with your business name, mailing address and unsubscribe link; check that the address is a real mailing address and that the link opens a page that works on a phone.

How fast must an unsubscribe be honoured?

Without delay, and in any case no later than 10 business days after the person asks, with no further action required from them. Do not ask people to log in, confirm by email or explain why they are leaving before the unsubscribe takes effect. If you send email from more than one system (for example your newsletter platform and your CRM), make sure an unsubscribe in one stops messages from the other.

What records should you keep?

Section 13 of the Act puts the burden of proof on the sender: if you say you had consent, you have to prove it. Keep, for every contact on your list:

• the date and time consent was given and the exact form, page or conversation it came from;
• the consent wording the person saw at the time;
• for implied consent, the purchase or inquiry date, so you know when it runs out;
• unsubscribe requests and the date each one took effect.

Keep old versions of your forms and wording, since a record of a checkbox means little without the sentence it sat beside. A CRM that stores the consent source and date on each contact makes this far easier than a spreadsheet.

What are the penalties under CASL?

The maximum administrative monetary penalty is $1,000,000 for an individual and $10,000,000 for a business, per violation. The CRTC weighs factors such as the purpose of the penalty, the nature and scope of the violation, past history and the ability to pay, so real penalties vary widely. Directors and officers can also be held liable for violations by their company if they directed or took part in them.

How to report spam in Canada

Canadians can report spam and other electronic threats to the Spam Reporting Centre, linked from the government’s CASL page. Reports help the enforcement agencies see patterns; they do not produce a personal reply.

A CASL checklist for your email program

• Every signup form asks for consent with an unticked box and states the purpose, your name, contact details and the right to withdraw.
• Each contact record stores the consent type, date and source.
• Implied-consent contacts carry an expiry date, and you ask them for express consent before it passes.
• No bought or scraped lists.
• Every message names the sender, gives a mailing address and has a working one-click unsubscribe.
• Unsubscribes take effect across every sending system well within 10 business days.
• Text messages follow the same rules as email.

Our email marketing team builds consent capture, list records and unsubscribe handling into every program we run, so campaigns reach people who asked to hear from you. For the contact records themselves, see our guide to what a CRM is and when a small business needs one.

Frequently asked questions

Is cold emailing illegal in Canada?

A promotional email to someone who has not consented and is not covered by an exemption breaks CASL, so cold campaigns to bought or scraped lists are not allowed. A relevant message to a business address the person published themselves, with no note refusing solicitations, can rely on implied consent.

Who is exempt from CASL?

Messages to family and personal contacts, inquiries to a business about its business, messages within an organization or between related organizations, replies to requests, registered charity fundraising messages and political fundraising messages are excluded from the consent rule.

Does CASL apply to B2B email?

Yes. A promotional email to another business needs consent like any other commercial message. The narrow exclusion covers employees of two organizations that already have a relationship, writing about the receiving organization's activities.

Does a purchase give implied consent for two years?

Yes. A purchase, lease or accepted business opportunity creates implied consent for two years from that transaction. An inquiry creates implied consent for six months. Ask for express consent before the period ends.

Can I email an address published on a website?

Only when the address was conspicuously published by the person or their organization, the page does not say they refuse unsolicited messages, and your message relates to their business role or duties.

How fast must an unsubscribe be honoured under CASL?

Without delay and no later than 10 business days after the request, with no extra steps for the person. The unsubscribe link and your contact details must also keep working for at least 60 days after you send.

What must a CASL-compliant email include?

Your business name, the name of any business you send for, a mailing address plus a phone number, email or web address, and an unsubscribe method that is easy to use and free.

Does CASL apply to text messages?

Yes. CASL covers commercial electronic messages of every kind, including texts and direct messages, so the same consent, identification and unsubscribe rules apply.

What is a CASL certification?

CASL does not create a certificate or licence a business must hold. The law sets rules for consent and message content, and compliance comes from how you collect consent, keep records and handle unsubscribes. Our email marketing team builds those into every program.

How can I report spam emails in Canada?

Report spam to the Spam Reporting Centre, linked from the Government of Canada's anti-spam legislation page.

What are the penalties for breaking CASL?

The maximum administrative monetary penalty is $1,000,000 for an individual and $10,000,000 for a business, per violation, and directors can be liable when they took part in a violation.

Who has to prove consent under CASL?

The sender. Section 13 puts the onus of proving consent on the person who claims to have it, so keep the date, source and wording of every consent.