Email marketing in Canada: a plain guide to CASL

Canada's Anti-Spam Legislation (CASL) applies to commercial electronic messages, including marketing emails, texts and some direct messages, sent to or from Canada. It's stricter than the US CAN-SPAM rules, because it requires consent before you send rather than just an unsubscribe link after. The good news is that the rules are clear once you know them. This is general information, not legal advice.

What counts as a commercial electronic message?

Any electronic message that encourages the recipient to take part in a commercial activity: buying a product or service, booking an appointment, visiting a store, or taking up an offer. A newsletter with a promotion in it counts. A purely transactional message, such as a receipt, a reply to someone's enquiry or a delivery notice, generally doesn't need consent, but it still must identify you.

The three requirements

1. Consent: you need permission to send commercial messages, either express or implied.
2. Identification: each message must identify your business and include a mailing address and either a phone number, email address or web address.
3. Unsubscribe: each message needs a free, simple way to unsubscribe that works for at least 60 days after sending. Requests must be honoured within 10 business days.

Express vs implied consent

Express consent is a clear, active yes, such as someone ticking an unticked box that says they'd like to receive your newsletter. It doesn't expire unless the person withdraws it. When you ask for it, you must say why you're asking, who you are, how to reach you, and that they can unsubscribe at any time.

Implied consent comes from an existing relationship. The most common examples are:

• A customer who bought from you in the past two years.
• Someone who made an enquiry or asked for a quote in the past six months.
• Someone who published their business email address without saying they don't want messages, when your message is relevant to their role.

Implied consent expires, so the smart move is to ask those contacts for express consent while you still have it.

What isn't consent?

• A pre-ticked box on a form.
• Burying consent in your terms and conditions.
• A list you bought or rented from someone else.
• An email address scraped from a website or directory.

Why does CASL matter?

The CRTC enforces CASL, and penalties can reach up to $1 million per violation for individuals and $10 million for businesses. Beyond fines, sending to people who didn't ask for your emails hurts your sender reputation, so even the people who did sign up start receiving your messages in spam folders.

Keep records

If a complaint is made, the burden is on you to show consent. For every contact, keep when they subscribed, how (which form or conversation), what they were told, and for implied consent, the date of the purchase or enquiry it relies on. Most email platforms record sign-up dates automatically if you use their forms.

What this means for your website

1. Use sign-up forms with an unticked consent checkbox and a short note of what people will receive.
2. Keep newsletter consent separate from contact forms, so asking for a quote doesn't silently add someone to your list.
3. Connect forms to an email platform that stores consent dates and handles unsubscribes automatically.
4. Add your business name and mailing address to every email template footer.
5. Link to your privacy policy wherever you collect email addresses.

Does CASL apply to text messages and social media?

Yes for texts. Direct messages on social platforms can also count when they promote your business. Public posts on your own social pages aren't messages sent to an electronic address, so they generally fall outside CASL.

A simple compliant routine

Collect express consent at checkout and on your website, send useful emails on a predictable schedule, honour unsubscribes immediately, and clean your list of people who haven't opened anything in a year. Our email marketing service sets up compliant forms, consent records and automations as part of every project.