Under Canadian rules the sender must be able to demonstrate consent, which means a record of who consented, when, how, and to what. Implied consent also expires on defined timelines, so the record has to capture the basis rather than only the address.

Why the record matters

The burden of proof sits with the sender. If a complaint arises, being confident that somebody signed up is not the same as being able to show it.

Most small businesses have addresses and no record of where any of them came from. That is the gap, and it becomes a problem at exactly the moment it is hardest to fix.

The record is also practically useful beyond compliance. It tells you which sources produce engaged subscribers, and it is what makes a list cleanup possible rather than guesswork.

The two kinds of consent

Express consent

Somebody actively agreed to receive commercial messages. It does not expire on its own, which makes it the stronger basis.

It has to be genuinely active. A pre-ticked box or consent bundled into agreement with terms is generally not express consent.

Implied consent

Arising from a relationship rather than an explicit agreement. The common cases are an existing business relationship, such as a purchase or a contract, and an enquiry made to you.

Crucially it expires. Broadly, a purchase or a written contract supports implied consent for two years from the transaction, and an enquiry supports it for six months from the enquiry. After that the basis is gone and continuing to send is no longer supported by it.

The expiry is the part most businesses do not know about, and it is why a list of customers from five years ago cannot simply be mailed on the basis that they were once customers.

What a record should contain

The wording point is worth noting. Keeping a copy of the consent language used on your form, with dates for when it changed, is what lets you demonstrate what somebody actually agreed to in a given year.

How to actually keep it

The practical question, since nobody is going to maintain a separate ledger.

Most email platforms record the source and date of each subscriber automatically, which covers form signups without any extra work. Confirming that your platform does this, and that the field is populated, is the single most useful step.

For addresses collected elsewhere, the record has to be created deliberately. A note on the customer record saying where it came from and when is enough, and it takes seconds at the point of collection.

For verbal consent, noting it at the time is the whole requirement, and it is the type most likely to go unrecorded.

The addresses you cannot account for

Every established business has some, and the honest answer is uncomfortable.

An address you cannot establish a basis for should not receive commercial messages. That is a smaller list and a defensible one.

Asking those people to confirm is the obvious response, and it comes with a trap worth knowing: a message requesting consent is itself a commercial electronic message. You cannot email somebody to ask them to opt in unless you already have a basis to contact them.

Which means the confirmation request works while implied consent is still live, and not after it has expired. That is an argument for converting customers to express consent during the window rather than waiting until the basis is gone.

Continuing to send on the basis that nobody has complained is not a strategy, and it is precisely the situation where a single complaint becomes difficult.

Where the requirements also apply

The rules cover commercial electronic messages broadly rather than only email newsletters.

That includes text messages and certain messages sent through other electronic channels. It also covers messages that are partly promotional rather than only advertisements.

There are exceptions for certain kinds of message, including some transactional and relationship-based communications, and the boundaries are specific enough that assuming is unwise.

Where a message is genuinely transactional, such as a booking confirmation or an invoice, that is generally a different category from a marketing message, and keeping the two clearly separate is both simpler and safer.

The retention question

Records should be kept for long enough to be useful if questioned, which means beyond the point somebody unsubscribes rather than deleted at that moment.

Keeping a record that somebody unsubscribed, and when, is itself the proof that you honoured it. Deleting them entirely removes your own evidence.

How long to retain is a judgement, and the reasonable position is a period that would cover any realistic complaint window.

The practical starting point

Check whether your email platform is recording source and date. Start noting the basis for anything collected outside a form. Identify the addresses you cannot account for and either confirm them or stop sending to them.

That is an afternoon, and it converts a list that might be a problem into one you can demonstrate. This is a general description rather than legal advice, and the specifics of your situation are worth checking properly, alongside the pages the site itself needs, as covered in the legal pages a small business site needs.

Frequently asked questions

Who has to prove consent?

The sender. Being confident somebody signed up is not the same as being able to demonstrate it, and most small businesses have addresses with no record of where they came from.

What is the difference between express and implied consent?

Express consent is an active agreement and does not expire on its own. Implied consent arises from a relationship: broadly two years from a purchase or contract, and six months from an enquiry.

What should a consent record contain?

The address, the date, how consent was obtained, what they agreed to receive, the wording they saw, and any later change including an unsubscribe and its date.

How do I keep these records?

Most email platforms record source and date automatically for form signups. For addresses collected elsewhere, a note on the customer record at the point of collection is enough.

What about addresses I cannot account for?

They should not receive commercial messages. A consent request is itself a commercial message, so you can only ask while implied consent is still live, not after it has expired.

Do the rules cover more than email?

They cover commercial electronic messages broadly, including text messages, and messages that are only partly promotional. Some transactional messages fall into different categories.

West Coast Media Solutions Inc. provides web design, web development, hosting, digital marketing, and business consulting to organisations across Canada, drawing on more than twenty-five years in the field.

List with no record of where any of it came from?

We check what your platform is already capturing and help you build a basis for the rest before it matters.

Start a Conversation