CASL — Canada's Anti-Spam Legislation — governs commercial electronic messages sent to Canadian recipients. It applies based on where the recipient is, not where you are, so a business anywhere in the world with Canadian subscribers is in scope.
It is stricter than CAN-SPAM and in some respects stricter than the GDPR, because it requires consent before sending and defines the acceptable forms of consent narrowly.
Consent comes in two forms
Express consent is someone actively agreeing to receive commercial email from you. An unticked box that they ticked, a form they completed knowing what they were signing up for, a verbal agreement you recorded. It does not expire, and the burden of proving it is on you.
The request for express consent must state, at the time of asking: the purpose, your organisation's name (and the name of anyone you are asking on behalf of), your mailing address, and one of a phone number, email address or web address. That is more than most signup forms carry, and it is the requirement most senders fail.
Implied consent arises from a relationship and it expires. The two situations that matter:
- Existing business relationship — a purchase, contract, or written enquiry. Consent is implied for two years from a purchase or contract, and six months from an enquiry.
- Conspicuously published address — a business address published publicly without a statement refusing commercial email, where your message relates to that person's role. This is narrower than it sounds and is not a licence for cold outreach at scale.
The expiry is the part people miss. Implied consent from a purchase runs out two years after the purchase, and continuing to email after that is a violation regardless of how engaged the person is.
What every message must contain
- Identification of the sender, and of anyone the message is sent on behalf of.
- Contact information — a mailing address plus a phone number, email address or web address — that stays valid for 60 days after the message is sent.
- An unsubscribe mechanism that is clearly set out, can be readily performed, and works for at least 60 days.
- Unsubscribes honoured within 10 business days, without requiring any further action from the recipient.
Ten business days is the legal ceiling. Google and Yahoo's bulk sender requirements require two days, so implement the faster one.
The penalties
Administrative monetary penalties run up to $1 million for an individual and $10 million for a business per violation. CASL also includes director and officer liability, meaning individuals in a company can be held personally responsible, and vicarious liability for the acts of employees acting within the scope of their employment.
Enforcement has produced penalties in the hundreds of thousands of dollars, most commonly for sending without provable consent and for unsubscribe mechanisms that did not work.
What this means practically
Track consent type and date on every subscriber. Not just "consented" — express or implied, and if implied, the date and the triggering event, so you can compute the expiry. This is the single most important operational change CASL requires, and it cannot be reconstructed after the fact. See how to keep email consent records.
Put the full identification on your signup form. Organisation name, mailing address, and a contact method. Most forms have none of this.
Age out implied consent automatically. A subscriber whose implied consent came from a purchase 25 months ago should stop receiving commercial email unless they have since given express consent. Build this as a rule, not as a periodic manual review.
Convert implied to express while you can. Someone in their two-year window can be asked to confirm. After it expires you cannot ask, because the asking is itself a commercial electronic message.
Do not buy lists. No consent, no defence, and the penalty structure makes it an unusually poor gamble. See why purchased email lists always fail.
If you send internationally, meeting CASL's standard puts you comfortably past CAN-SPAM and close to GDPR requirements, which is a reasonable argument for adopting it as your baseline rather than maintaining three regimes. This is general information rather than legal advice; take specific questions to a Canadian lawyer.
Frequently asked questions
Does CASL apply to businesses outside Canada?
Yes. It applies based on where the recipient is. If you send commercial email to people in Canada, you are in scope regardless of where your business is located.
How long does implied consent last under CASL?
Two years from a purchase or contract, and six months from an enquiry or application. Express consent does not expire. Track the type and date on every subscriber so implied consent can age out automatically.
Is double opt-in required by CASL?
Not explicitly. CASL requires provable express consent, and a confirmed opt-in is the cleanest way to produce that proof, which is why it is the usual recommendation for Canadian lists.
What are the penalties for CASL violations?
Up to $1 million for an individual and $10 million for a business per violation, with director and officer liability. Enforcement actions have most often targeted sending without provable consent and unsubscribe mechanisms that failed to work.
