CASL and email marketing: a practical compliance checklist for Canadian businesses

Canada’s Anti-Spam Legislation (CASL) doesn’t stop you from sending marketing email. It sets three conditions every promotional email has to meet: you need the recipient’s consent, you have to identify yourself, and you have to give them a working way to unsubscribe. Most of the work happens before the first send, in your signup form, your email template and your records.

This guide covers what each rule requires, with checklists you can use while setting up a newsletter, and what to do with a contact list when you don’t know how the addresses were collected. It’s general information about Canadian federal law, not legal advice. If your situation is unusual, check it with a lawyer.

Which emails CASL covers

CASL applies to a “commercial electronic message”, which the Act describes as a message that, among other things, encourages participation in a commercial activity (CASL, s. 1(2)). Newsletters with offers, product announcements, event promotions and sale emails all qualify. The CRTC’s FAQ notes that a logo or link in an email signature doesn’t on its own make a message commercial, but a line promoting a product or service does.

Three points catch people out:

• An email asking for consent counts too. A message that requests consent to send commercial messages is itself a commercial electronic message (s. 1(3)). You can’t email a cold list to ask whether they’d like your newsletter.
• Transactional emails are partly exempt. A message that only provides a quote, confirms a transaction, or gives warranty, recall or safety information doesn’t need consent, but it still needs identification and an unsubscribe mechanism (s. 6(6)). Add a promotion to that receipt and the exemption no longer fits, because it covers messages that do solely those things.
• It isn’t only about Canadian senders. The Act applies when a computer system in Canada is used to send or access the message (s. 12(1)), and the CRTC says messages sent to Canadians from other countries must comply.

Consent: express or implied

Express consent

Express consent means the person actively agreed to receive your messages, in writing or orally. It has no expiry date: it lasts until they withdraw it (CRTC implied consent guidance).

It has to come from an opt-in. The CRTC’s position is that a pre-checked box can’t be used, because silence or inaction isn’t consent (CRTC FAQ; Information Bulletin 2012-549). An empty box the person ticks, or typing an email address into a field whose purpose is clearly stated, are both given as acceptable examples. The request also can’t be buried in your general terms and conditions: someone must be able to accept your terms while declining marketing email (Information Bulletin 2012-548, para. 16).

Implied consent, and when it runs out

Implied consent exists only in the situations the Act lists (s. 10(9) to 10(14)). Most are time-limited, and the clock is counted back from the day you send each message.

The CRTC’s FAQ gives a useful warning on the edge cases. An abandoned online shopping cart is not a purchase, and while some merchants treat it as an inquiry, the CRTC recommends asking for express consent at checkout instead. Its general advice: if you’re unsure, ask for express consent.

Implied consent is useful, but it decays. A customer who bought from you in 2024 and hasn’t bought since will drop out of implied consent on a known date. Use that window to ask for express consent.

What a consent request has to say

Whether it’s a web form, a paper card at the counter or a question at checkout, a request for express consent must clearly and simply set out (s. 10(1); Electronic Commerce Protection Regulations (CRTC), s. 4):

• the purpose: what you’ll be sending
• the name you do business under, and the name of anyone else the consent is being sought for
• a mailing address, plus a phone number, email address or web address
• a statement that the person can withdraw their consent

A mailing address can be a street address, PO box, rural route or general delivery address. If you run your business from home, the CRTC says you don’t have to publish your home address, as long as you can be reached at the one you give (CRTC FAQ).

Checklist: a compliant signup form

Use this when you set up or review a newsletter form, a checkout opt-in or an event registration form.

• The consent box is unticked by default, or the form’s only purpose is the newsletter and says so.
• Marketing consent is separate from accepting terms, booking or buying. Someone can complete the purchase without opting in.
• The wording says what they’ll receive (for example, a monthly newsletter with offers and events), not a vague “updates”.
• Your business name is shown, and any partner you’re collecting consent for is named.
• Your mailing address and an email, phone number or web address appear on or next to the form.
• The form says they can unsubscribe or withdraw consent at any time.
• Your system saves the date and time, the form or location, and the wording they agreed to. The CRTC gives a database record of “date, time, purpose, and manner” as an acceptable way to prove written consent (Bulletin 2012-548, para. 26).
• A confirmation email goes out after signup. The CRTC says one should be sent (Bulletin 2012-549, para. 8), and it gives the new subscriber a record too.
• If staff collect consent in person or by phone, there’s a script and a way to record it. For oral consent, the CRTC points to independent verification or a complete, unedited recording (Bulletin 2012-548, para. 23).

Example wording only, to adapt with your own details and check against your situation:

☐ Yes, send me the [Business name] newsletter by email: monthly news, offers and event invitations. You can withdraw your consent at any time using the unsubscribe link in every email or by contacting us.

[Business name], [mailing address], [email address or phone number]

Checklist: a compliant email template

Set these up once in your template so every send carries them.

• Who it’s from. The name you do business under, and if you’re sending for someone else (an agency sending for a client, for example), both names and which is which (Regulations, s. 2).
• How to reach you. A mailing address, plus a phone number, email address or web address. These must stay valid for at least 60 days after each message is sent (s. 6(3)).
• An unsubscribe link that works without fuss. It must be free to use, set out clearly and prominently, and “readily performed” (Regulations, s. 3). The CRTC’s example of a non-compliant process makes the recipient search a page for the right link and log in to an account before they can opt out (CRTC FAQ). A link to a page where they can unsubscribe from everything, or choose some types of email, is the CRTC’s example of what works.
• The link stays live for at least 60 days after the email goes out (s. 11(2)). Keep this in mind if you change platforms.
• Unsubscribes take effect within 10 business days, without the person having to do anything else (s. 11(3)). The CRTC says this applies however someone asks you to stop, including by replying or phoning, not only through the link (implied consent guidance).

Example footer only:

You’re receiving this because you signed up at [website]. [Business name], [mailing address], [email address]. Unsubscribe or change which emails you get: [link]

Your email platform probably handles the link itself. The gaps tend to be elsewhere: a CRM that still holds the address, a staff member who re-imports an old spreadsheet, or a second tool used for one campaign. Make sure an unsubscribe in one place reaches all of them.

Keep records: the burden of proof is yours

If the CRTC asks, it’s up to you to prove you had consent (s. 13). That applies to implied consent too: you have to show the purchase, inquiry or membership happened, and when. The CRTC’s implied consent guidance suggests keeping records such as your email policies and procedures, every unsubscribe request and what you did about it, evidence of express consent, consent logs, campaign records and staff training documents.

In practice, for each contact you want to be able to answer:

• What kind of consent do we have: express or implied?
• Where and how did we get it (which form, which store, which event)?
• When? And for implied consent, when does it expire?
• What wording did they see?
• Have they unsubscribed, and when did we act on it?

What to do with an existing list of unknown consent

Many businesses that start a newsletter already have addresses somewhere: past customers in the accounting system, contacts from a trade show, an old spreadsheet from a previous platform. Sort them before you send anything.

1. Proven express consent. You can show the form, date and wording. Keep them, and store the proof with the record.
2. Implied consent you can date. A purchase in the last two years, an inquiry in the last six months, a current membership. You can email them until it expires. Use that time to invite them to opt in, so they move into the first group. That invitation is a commercial message, so it needs your identification and an unsubscribe link.
3. Everyone else. No record, a date you can’t confirm, a purchase more than two years ago, a list someone gave or sold you. Don’t email them, including to ask for consent. The CRTC is direct about it: the only way to get express consent by email is if you already have implied consent to send that message (implied consent guidance). Let them opt in on their own terms instead: a signup form on your website, a consent box at checkout or a sign-up sheet in store. Leave them off the email list until they do.

Two more checks while you clean up:

• Bought lists. The CRTC says buying a list on its own is not buying a business, so the buyer can’t rely on consents the seller collected. If you acquire a whole business and its customer list comes with it, consent can transfer, and the onus of proving it transfers with it (implied consent guidance).
• Old unsubscribes. Bring your suppression list across when you move platforms, so nobody who opted out years ago starts getting email again.

Penalties and who enforces CASL

The CRTC can issue administrative monetary penalties of up to $1 million per violation for an individual and $10 million for a business (s. 20(4); CRTC FAQ). Those are maximums, and the Act lists factors that set the actual amount. Directors and officers can be personally liable if they directed, authorized or took part in a violation.

The Act originally included a private right of action that would have let individuals take senders to court. Its start date of July 1, 2017 was suspended by the federal government in June 2017 (Canada Gazette, SI/2017-31), and it never came into force. The current consolidated Act now shows those sections as repealed before coming into force (CASL, ss. 47 to 51). Enforcement is by the regulators, not through private lawsuits under CASL.

If you’ve been reading US advice

Many email platforms and guides are written for the US CAN-SPAM Act, which doesn’t require permission before you send commercial email; it relies on people opting out afterwards (US Federal Trade Commission). CASL works the other way round: consent first. A template or list practice that’s fine in the US can still fall short in Canada, so check your settings against the checklists above rather than the platform’s defaults.

CASL also sits alongside privacy law. The CRTC notes you may have separate obligations under the federal privacy law, PIPEDA, for how you collect and use email addresses (implied consent guidance).

Setting up consent-based signup forms, templates and list reviews is part of our email marketing work, but the checklists above are written so you can apply them yourself on any platform.