Canada's Anti-Spam Legislation is stricter than the American CAN-SPAM Act and carries meaningful penalties. Most businesses we audit are technically in breach without realising it. This is a plain-English summary, not legal advice — for anything consequential, talk to a lawyer.
What CASL covers
Commercial electronic messages sent to recipients in Canada — email, SMS and social messaging. Three requirements: you need consent, you must identify yourself, and you must provide a working unsubscribe.
Express vs implied consent
Express consent is someone actively opting in — ticking an unchecked box, filling a signup form. It doesn't expire, and you must keep a record of when and how it was given.
Implied consent is narrower than most people assume. It exists where there's an existing business relationship — a purchase or contract within the last two years, or an enquiry within the last six months. It also exists where someone has conspicuously published their business email without a "no marketing" notice, and your message relates to their role. Implied consent expires; express consent doesn't.
Every message must include
- Your business name (and any name you're sending on behalf of)
- A mailing address
- A phone number, email or web address
- A clear unsubscribe mechanism that works for at least 60 days and is actioned within 10 business days
Penalties
Administrative monetary penalties reach up to $1 million for individuals and $10 million for organisations. Enforcement has focused on egregious cases, but the exposure is real — and directors can be held personally liable.
What this means practically
Don't buy lists. There's no consent attached, and you can't inherit someone else's.
Keep consent records. Under CASL the burden of proof is on the sender, so your platform should log the timestamp, source and IP for every subscriber.
Track implied consent expiry. If your only basis is a purchase two years ago, that basis has lapsed. Run a re-permission campaign before it does.
B2B cold email is possible but narrow. The published-address exemption is real, and it requires the address to be conspicuously published without a marketing opt-out, and your message to be relevant to that person's role. Scraping a thousand generic info@ addresses does not qualify.
Quebec adds another layer
Law 25 imposes consent, transparency and data-handling obligations on organisations holding personal information about Quebec residents — stricter than the rest of Canada. If you have Quebec subscribers, your privacy policy, consent capture and cookie handling all need to reflect it.
The upside nobody mentions
CASL compliance makes your email work better. A list built on genuine express consent has higher engagement, better deliverability and fewer spam complaints than a purchased one — which matters more than ever now that inbox providers enforce authentication and complaint thresholds aggressively. The legal requirement and the effective strategy happen to point the same way.
Quick answers
Can I email people who gave me a business card?
Handing you a card at a business event generally implies consent for messages relevant to their role, but keep a record of when and where, since implied consent expires.
Do I need consent for transactional emails?
Purely transactional messages — receipts, delivery updates, warranty information — are exempt. The moment you add a promotion, CASL applies.