CASL Compliance: A Plain-English Guide for Canadian Businesses

If you send marketing emails or promotional texts to people in Canada, CASL is your law, and it is one of the strictest anti-spam regimes in the world. A lot of business owners hear “anti-spam” and picture the obvious junk that clutters an inbox. CASL is broader than that. It governs the everyday newsletter, the “we miss you” text, the promo blast before a long weekend. Get it wrong and the penalties are serious. Get it right and it barely slows you down.

This is a plain-English walk through what the law asks of you. It is not legal advice, and if you are dealing with a specific complaint you should talk to a lawyer. But most owners just want to know how to run their marketing without stepping on a rake, and that part is genuinely learnable.

The one idea that makes CASL make sense

Most email laws around the world are built on opt-out. You can message people until they tell you to stop. CASL flips that. It is built on opt-in. In general, you need consent before you send a commercial electronic message, not after.

Once that clicks, the rest of the rules fall into place. Everything CASL asks for is really about three questions: did this person agree to hear from you, do they know who you are, and can they leave easily. Consent, identification, unsubscribe. Hold those three in your head and you are most of the way there.

Consent: express and implied

CASL recognizes two kinds of consent, and the difference matters.

Express consent is when someone actively agrees to receive your messages. They tick a box that is not pre-checked, they type their email into a signup form, they tell you at the counter “yes, add me to the list.” Express consent does not expire on its own. It is the strongest footing you can be on, and it is what you should be building toward for your whole list.

Implied consent is weaker and it comes with a clock. The two common sources are an existing business relationship and an existing non-business relationship. If someone bought from you, implied consent generally runs for two years from that purchase. If someone made an inquiry, it generally runs for six months. There is also the case of a business email address published publicly without a “no marketing” note, where the message relates to that person’s role. When the window closes, implied consent is gone, and you need express consent to keep messaging.

The practical takeaway: you can start a relationship on implied consent, but you should be converting people to express consent while the clock is still running. A single, well-timed “confirm you want to keep hearing from us” campaign can do a lot of that work.

Identification: say who you are

Every commercial message has to make clear who sent it. That means your business name, and a way to reach you that stays valid for at least 60 days after you send, such as a mailing address plus a phone number, email, or web address. If you are sending on behalf of someone else, both parties need to be identified.

This is the easy part. A proper footer handles it. The mistake owners make is sending from a personal-looking address with no business identity at all, which fails the test and also just looks unprofessional.

Unsubscribe: make leaving easy

Every commercial message needs a working unsubscribe mechanism. It has to be simple, it has to be free, and you have to honour the request without delay, and no later than 10 business days. The link cannot lead to a form that demands a password or a pile of personal details. One click or one reply should do it.

Here is where a lot of small operations quietly break the law: someone replies “please remove me,” and it sits in an inbox nobody checks, and the next blast goes out anyway. That is a violation even though nobody meant any harm. If you cannot reliably process unsubscribes, you are not ready to be sending in the first place.

What CASL does not cover as tightly

Not every message is a commercial electronic message. A receipt, a warranty notice, a shipping update, a reply to someone’s direct request for a quote, these are largely outside the marketing rules. But be careful: the moment you bolt a promotion onto a transactional message, you have pulled it back under CASL. The “your order shipped, and by the way here’s 20% off your next one” email is a marketing message wearing a receipt’s clothes.

The penalties are real

The maximum administrative monetary penalty is $10 million per violation for a business. In practice the CRTC, which enforces CASL, negotiates settlements and has issued penalties ranging from tens of thousands to seven figures. Directors and officers can be held personally liable in some cases. There was a private right of action, which would have let individuals sue, that was suspended before it took effect, so today enforcement runs mainly through the regulator. That is not a reason to relax. It is a reason to keep clean records, because the regulator’s first question in any complaint is “show me the consent.”

Record-keeping is the quiet hero

If it ever comes to a complaint, your defence is your paperwork. You want to be able to show, for each contact, when and how you got consent, what they agreed to, and that you honoured any unsubscribe. Doing that by hand across a spreadsheet is where good intentions go to die. This is exactly the kind of thing software should handle for you: every contact carrying its own consent status, source, and expiry, so you are never guessing whether a given person is safe to email.

A short checklist

• Build your list on express consent wherever you can, and convert implied consent before the clock runs out.
• Put a clear identification footer on every commercial message.
• Give a one-step unsubscribe and process it within days, not weeks.
• Keep records of consent for every contact.
• Treat transactional-plus-promotion messages as marketing.

None of this is exotic. It is mostly discipline, plus a system that remembers what you agreed to with each person so you don’t have to. If your current setup can’t tell you, contact by contact, who consented and when, that is the gap worth closing first.