CASL: The Canadian Law Your Marketing Emails Have to Follow 

Canada's Anti-Spam Legislation, universally known as CASL, is among the strictest laws of its kind in the world, and it applies to activities most businesses consider entirely routine: sending a promotional email, texting customers about an offer, or emailing a purchased list of prospects. Administrative penalties can reach $1 million per violation for individuals and $10 million per violation for organizations, and the CRTC has levied substantial penalties against businesses of ordinary size, not only large-scale spammers. 

Despite this, CASL compliance in many small businesses consists of an unsubscribe link and good intentions. The requirements are more specific than that, and they are manageable once understood. 

What CASL covers 

CASL applies to commercial electronic messages, meaning any email, text message, or direct social media message that encourages participation in a commercial activity, sent to an electronic address. If a message promotes your products, services, or business, it is almost certainly covered, whether it goes to one recipient or ten thousand. 

The three requirements of every commercial message 

1. Consent. You must have the recipient's consent before sending, and the burden of proving it rests on you, not the recipient. 
2. Identification. The message must clearly identify your business and include your mailing address along with a phone number, email address, or web address. 
3. An unsubscribe mechanism. Every message needs a functioning unsubscribe option at no cost to the recipient, and requests must be honoured within ten business days. 

Consent is where businesses go wrong 

CASL recognizes two forms of consent, and the distinction determines what you may send and for how long. 

Express consent means the person actively agreed to receive commercial messages from you — a checked box, a completed signup form, a documented verbal agreement. Express consent does not expire, but a pre-checked box does not qualify; the recipient must take the positive action themselves. 

Implied consent arises from an existing relationship, and it expires. The most common forms: a customer who purchased from you provides implied consent for two years from the purchase; a person who inquired about your services provides it for six months from the inquiry. A conspicuously published business email address can also create implied consent, but only where the message relates to the recipient's business role. 

The expiry is the trap. A customer list assembled over a decade contains, in CASL terms, a mixture of valid express consents, live implied consents, and expired ones — and a list purchased or scraped from the internet contains none at all. Sending to expired or absent consent is a violation regardless of how professional the message looks. 

A practical compliance checklist 

• Record consent with evidence. For each contact, your list should show how consent was obtained, when, and in what form. Reputable email marketing platforms record this automatically when signups flow through their forms. 
• Convert implied consent to express while it is valid. A message to recent customers inviting them to subscribe converts an expiring consent into a permanent one. 
• Purge or re-permission old lists. Contacts with no purchase or inquiry inside the implied-consent windows, and no express consent on record, should not receive commercial messages. 
• Audit your templates. Confirm every outgoing template carries your business identification, mailing address, and a working unsubscribe link, including messages sent by sales staff through automation tools, not only newsletters. 
• Honour unsubscribes everywhere. An unsubscribe processed by your newsletter platform but ignored by your CRM's automated follow-ups is a violation. The suppression list must apply across every system that sends. 
• Mind the adjacent rules. CASL also governs the installation of software on other people's devices and prohibits misleading sender information and subject lines. 

Where IT fits 

CASL compliance is usually framed as a marketing responsibility, but its failures are frequently technical: consent records scattered across disconnected systems, suppression lists that don't synchronize, and automated sequences nobody audited after setup. Bringing your CRM, email platform, and website forms into one coherent, documented flow is as much an IT project as a legal one, and it is considerably easier than defending an investigation. 

Superion helps BC businesses integrate and manage the systems their customer communications run on, as part of our managed IT services. Contact us if your consent records live in more places than anyone can count.