Canada's Anti-Spam Legislation (CASL) has applied to commercial email since July 1, 2014. It's one of the strictest email laws in the world, and many businesses still get it wrong. Here's what it asks of you.
What CASL covers
CASL applies to commercial electronic messages (CEMs) sent to or from computers in Canada. That includes email, text messages and direct social media messages that encourage someone to buy, sell or do business.
The three rules
- Consent. You need permission before you send.
- Identification. Every message says who sent it and how to reach you.
- Unsubscribe. Every message includes a working way to opt out.
Express vs implied consent
| Type | How you get it | How long it lasts |
|---|---|---|
| Express | The person actively opts in, like ticking an unchecked box | Until they unsubscribe |
| Implied: purchase or contract | They bought from you or signed a contract | 2 years from the purchase or contract |
| Implied: inquiry | They asked about your product or service | 6 months from the inquiry |
| Implied: published address | Their address is publicly listed with no "no spam" note, and your message relates to their role | While it stays published |
Implied consent expires. Aim to turn it into express consent before it runs out.
What a valid consent request includes
- Why you're asking for consent
- Your business name (and anyone you're asking on behalf of)
- Your mailing address plus a phone, email or web address
- A note that they can unsubscribe at any time
Pre-checked boxes don't count as express consent.
Unsubscribes
- Include an unsubscribe link in every commercial message.
- Keep it working for at least 60 days after you send.
- Process every request within 10 business days, and sooner is better.
Keep records
If the CRTC asks, you have to prove consent. For every contact, record when and how consent was given, the exact wording they saw and where they signed up. Store this in your email platform or CRM, not in a spreadsheet.
The cost of getting it wrong
Penalties go up to $10 million per violation for businesses and $1 million for individuals. Directors and officers can be held personally liable.
This guide is general information, not legal advice. For your specific situation, speak with a lawyer or check the CRTC's guidance.