What CASL Requires of a Small Business

What it covers

Commercial electronic messages sent to or from Canada. That includes email, text messages and some social messaging.

Commercial means encouraging participation in a commercial activity, which is broader than advertising. A message promoting a service, offering a discount, or asking for a review can all qualify.

It applies to a sole trader sending twenty messages as much as to a company sending twenty thousand. There is no small business exemption.

What follows is a general description rather than legal advice, and anything unusual is worth checking properly.

The three requirements

Consent, either express or implied, before sending.

Identification, so the recipient knows who is writing and how to reach you.

An unsubscribe mechanism that works, is easy to use, and is honoured promptly.

All three apply to every commercial message, and the third has a specific timeframe attached.

Express against implied consent

The distinction that causes most of the confusion.

Express consent is somebody actively agreeing: ticking a box that was not pre-ticked, signing up, or saying yes when asked. It does not expire.

Implied consent arises from an existing relationship: somebody who bought from you, or made an enquiry. It expires, and the periods are specific.

An existing business relationship, such as a purchase or a contract, generally supports implied consent for a period after it. An enquiry supports a shorter period.

Which means a customer from four years ago who has not been in touch since is not somebody you can email under implied consent, and a list built entirely from old customers may be substantially out of date in that sense.

The published address exception

Frequently misunderstood in both directions.

If somebody has published their address without a statement saying they do not want unsolicited messages, and your message is relevant to their role or business, that can support sending.

The relevance requirement is real. A published address for a plumbing business supports a message about plumbing supplies, not about anything you happen to sell.

This is a narrower permission than the phrase publicly available suggests, and using it as a basis for general outreach is where businesses get into difficulty.

A worked example

A supplier who emailed every business in a trade directory with an introduction to their products.

Some of those addresses were published and relevant, which was defensible. Many were general enquiry addresses at businesses in unrelated trades, which was not.

The message also had no unsubscribe link, because it was a personal introduction rather than a newsletter, which is not a distinction the rules make.

They received several complaints, one of which reached the regulator.

The outcome was a warning and a change of practice rather than a penalty, and the process took months of attention.

What they should have done was straightforward: send to relevant published addresses only, identify themselves fully, and include an unsubscribe on every message including the first.

Identification, specifically

• Your business name, as you actually trade.
• A mailing address, which is required rather than optional.
• A phone number, email or web address.
• Who you are sending on behalf of, if that differs.

The mailing address requirement catches home-based businesses, who reasonably do not want to publish where they live. A registered office, a mailbox service or a business address is the usual answer.

Unsubscribe, and the timeframe

The requirement with a specific number attached.

Every commercial message needs a mechanism to unsubscribe, working for at least sixty days after sending, and requests must be honoured within ten business days.

It must be easy: one or two steps, not a login, not a phone call, not an email to a specific person.

Any proper email service handles all of this automatically, which is one of several reasons for using one rather than sending from a mailbox.

Where you do send individually, an unsubscribe line still applies if the message is commercial.

The counter-case

Messages that are not covered.

Purely transactional messages: a quote somebody asked for, an invoice, a delivery notification, a reply to an enquiry. Those are not commercial electronic messages in the relevant sense.

Messages to somebody with whom you have a personal or family relationship.

Certain messages responding to a request, and some between businesses with an existing relationship, subject to conditions.

The line is fuzzier than it looks. A quote is fine; a quote with a paragraph promoting three other services is arguably not, and the safe answer is to include the unsubscribe anyway.

Keeping records

The practical obligation that outlasts everything else.

You need to be able to show consent, which means recording when somebody agreed, how, and to what.

For express consent, the signup record. For implied, the transaction or enquiry that supports it, with its date, since that date determines when it expires.

The burden is on the sender to demonstrate consent, not on anybody else to disprove it, which is why remembering is not sufficient.

A proper email service records most of this automatically, and a spreadsheet works for a small list provided somebody maintains it.

Penalties, in proportion

Worth knowing without being alarmist about it.

The maximum penalties under the legislation are substantial, and they are aimed at serious and repeated conduct rather than a small business that got a detail wrong.

What actually happens to most small businesses is a complaint, an enquiry, and an expectation that practice changes.

The real cost is usually attention and correspondence rather than a penalty, and both are avoidable with the basics in place.

Which is the sensible framing: this is not something to be frightened of, and it is something to get right, because the fixes are all straightforward and the alternative is a distraction you do not need.

What to do this week

1. Check every marketing message has an unsubscribe.
2. Check your identification block includes a mailing address.
3. Check how your list was built, and whether you can evidence consent.
4. Remove anybody whose implied consent has expired, or seek express consent from them.
5. Move bulk sending to a proper service if it is not there already.

The fourth is the one most small lists fail, because implied consent expires quietly and nothing prompts a review.

How to build a list that meets this from the start is covered in the first hundred subscribers.

Frequently asked questions

West Coast Media Solutions Inc. provides web design, web development, hosting, digital marketing, and business consulting to organisations across Canada, drawing on more than twenty-five years in the field.