If you send marketing emails to people in Canada, CASL applies. Its core rules are manageable once you know them.
At a glance
- Under CASL, commercial electronic messages need consent, identification information and a working unsubscribe mechanism.
- Express consent doesn’t expire, but people can withdraw it at any time.
- Implied consent from an existing business relationship has time limits: two years after a purchase and six months after an inquiry, according to CRTC guidance.
- Unsubscribe requests must be processed within 10 business days.
- Administrative penalties can reach $1 million per violation for individuals and $10 million for businesses.
Canada’s Anti-Spam Legislation (CASL) sets rules for commercial electronic messages, including marketing emails and texts. It’s stricter than many people expect, but the essentials are straightforward. This guide is general information, not legal advice; for your specific situation, see the CRTC’s guidance or a lawyer.
The three requirements
According to the Canadian Radio-television and Telecommunications Commission (CRTC), commercial electronic messages must have:
- Consent from the recipient.
- Identification information: who is sending the message, and on whose behalf, with contact details.
- An unsubscribe mechanism that works.
Express versus implied consent
Express consent is when someone clearly agrees to receive your messages, for example by ticking an unchecked box on a sign-up form that explains what they’ll receive. It doesn’t expire, but the person can withdraw it at any time.
Implied consent arises in certain situations, such as an existing business relationship. The CRTC’s guidance sets time limits:
| Situation | Implied consent lasts |
|---|---|
| Customer bought, leased or accepted an offer from you | Two years from that transaction |
| Someone made an inquiry or application | Six months from the inquiry |
Because implied consent runs out, many businesses ask for express consent at the first opportunity.
Careful
Pre-checked boxes, buried terms and buying email lists don’t give you valid express consent. Messaging people without consent puts your business at risk of penalties and damages your sender reputation.
Unsubscribes
Every commercial message needs a simple way to unsubscribe, and the CRTC says requests must be processed within 10 business days. Make it easy: a clear link that works without logging in.
Penalties
CASL’s administrative monetary penalties can reach $1 million per violation for individuals and $10 million for businesses. Enforcement typically focuses on serious or repeated problems, but compliance is far cheaper than a penalty.
Practical checklist
- Use clear sign-up forms with unchecked consent boxes.
- Record when, where and how each person consented.
- Track implied consent dates and ask for express consent before they expire.
- Include your business name, mailing address and contact information in every message.
- Make unsubscribing easy and process requests promptly.
Our guide to building an email list puts these rules into practice, and our guide to email deliverability covers the technical side of reaching inboxes.
Questions readers ask
Does CASL apply to emails sent from outside Canada?
CASL can apply to commercial electronic messages sent to or accessed by people in Canada, wherever the sender is. If you email Canadian customers, assume it applies.
Is a pre-checked box valid consent?
No. Express consent must be given through a positive action, such as ticking an unchecked box or typing an email address into a sign-up form that clearly explains what people are signing up for.
Do receipts and order updates need consent?
Some messages, such as those that complete or confirm a transaction a customer has agreed to, are treated differently. Check the CRTC’s guidance, and keep marketing content out of purely transactional emails.
How should I keep records of consent?
Record when and how each person gave consent, such as the form, date and wording. If questions ever come up, you’ll need to show consent was obtained.
This guide is general information, not legal advice. Platform rules and CASL guidance change, so check Google’s documentation and the CRTC’s guidance before you rely on it.