Canada's anti-spam legislation requires three things in every commercial electronic message: consent before sending, clear identification of who you are, and a working unsubscribe honoured within ten business days. Unlike American rules, consent must exist before the first message rather than being assumed until someone objects.
What it covers
Commercial electronic messages, which is broader than most people assume: email, text messages, and messages sent through social platforms, where the message encourages participation in commercial activity.
Two points that catch people out. It applies to business-to-business messages exactly as it applies to consumer ones, so "it is just a business email" is not a distinction the law makes. And it applies based on where the recipient is, so a sender outside Canada emailing someone in Canada is within scope.
The legislation has been in force since 2014 and is enforced by the CRTC.
The three requirements
1. Consent, before the first message
Express consent is someone actively agreeing to receive messages from you. It does not expire, though it can be withdrawn at any time. When requesting it you should identify yourself, say what you will send, and explain how to unsubscribe. A pre-ticked box is not agreement.
Implied consent arises in limited circumstances and expires. An existing business relationship, such as a purchase or contract, generally supports implied consent for two years from that transaction. An enquiry from someone generally supports six months. Business contact information published conspicuously without a statement refusing such messages can support implied consent where the message is relevant to that person's role.
The two-year expiry catches businesses out routinely. A customer who bought from you two years and one day ago is no longer covered.
2. Identification
The recipient must be able to tell who sent it and how to reach you. In practice that means a sender name matching the business, a physical mailing address, and at least one further contact method such as a telephone number or website.
The mailing address requirement surprises people and it is not optional.
3. A working unsubscribe
Every message needs one, it must be simple to use, and requests must be honoured within ten business days. The mechanism must remain functional for at least sixty days after the message was sent.
Unsubscribes should move a contact to a permanent suppression list rather than pausing them from one campaign.
The burden of proof
This is the part that determines whether compliance is real or theoretical: the sender must be able to prove consent. If you cannot demonstrate it, you did not have it.
So consent records matter as much as consent itself. Record what was agreed, when, by what method, and what the person was told at the time. A platform that stores this against each contact turns a potential investigation into an export.
Penalties, and what actually happens
The statutory maximums are large: up to one million dollars for an individual and ten million for an organisation, with provisions extending liability to directors and officers, and to a business for the actions of employees or contractors.
The maximums are not what most small businesses face. Reported enforcement has more commonly involved penalties in the thousands to tens of thousands, frequently resolved through undertakings where a business cooperates and demonstrates good faith. The violations are rarely exotic: purchased or scraped lists, missing unsubscribe mechanisms, and sender names not matching the business behind the offer.
A private right of action was written into the legislation but has not been brought into force.
What this means practically
- Do not buy lists. There is no consent attached to a purchased list, and it is the most commonly penalised behaviour.
- Use double opt-in where you can. It confirms genuine interest and documents consent in one step.
- Track implied consent expiry and suppress or re-consent contacts before the window closes.
- Check your platform actually processes unsubscribes rather than assuming.
- Include the mailing address. Frequently omitted and straightforwardly required.
- Train anyone who sends, since liability extends to what employees and contractors do.
- Audit periodically. Lists decay, and old contacts accumulate without documented consent.
None of this prevents legitimate marketing. It prevents sending to people who never asked, which is also the practice that produces poor results, as covered in building an email list.
Frequently asked questions
What does CASL require?
Three things in every commercial electronic message: consent obtained before sending, clear identification including a physical mailing address and a further contact method, and a functioning unsubscribe mechanism honoured within ten business days.
Does CASL apply to business-to-business email?
Yes, identically to consumer messages. The legislation makes no distinction, so describing something as a business email is not a defence. It also applies based on where the recipient is, so senders outside Canada are covered when writing to Canadian recipients.
What is implied consent under CASL?
Consent arising from limited circumstances rather than explicit agreement, and it expires. An existing business relationship such as a purchase generally supports two years from that transaction, an enquiry supports six months, and conspicuously published business contact information can support relevant role-related messages.
Who has to prove consent existed?
The sender. If you cannot demonstrate consent, the law treats it as absent, which makes consent records as important as consent itself. Records should capture what was agreed, when, by what method, and what the person was told at the time.
What are the penalties under CASL?
Statutory maximums reach one million dollars for individuals and ten million for organisations, with liability extending to directors and officers. Reported enforcement against smaller businesses has more commonly involved thousands to tens of thousands, often resolved through undertakings.
Can I email someone whose address I found on their company website?
Publicly published business contact information without a statement refusing such messages can support implied consent, provided the message is relevant to that person's role. The message must still carry proper identification and a functioning unsubscribe.
West Coast Media Solutions Inc. builds and hosts websites for businesses across Canada and operates a premium domain marketplace, both relevant interests to declare. Nothing here is legal advice; where obligations are described, confirm current requirements against the regulator or your own counsel.
Want a second opinion?
We build and host websites for businesses across Canada, and we will show you what your current arrangement is costing you.
Start a Conversation