Canada's Anti-Spam Legislation (CASL) generally requires consent for commercial electronic messages, subject to specific exemptions. Document which rule permits each Canadian campaign.
Maximum administrative penalty per violation, CAD (business)
Source: CASL
Maximum administrative penalty per violation, CAD (individual)
Source: CASL
Critical difference from US law:
CASL is opt-in, not opt-out. You generally cannot email someone in Canada without prior consent — express or implied.
How CASL Works
1. Consent Required Before Sending
Unlike CAN-SPAM (opt-out), you must have consent before sending. The burden is on the sender.
2. Implied Consent Expires
Track applicable relationship dates: qualifying purchases and inquiries have different windows; a current written contract can also qualify.
3. Massive Penalties
Administrative penalties can reach CAD $10 million for a business. The private right of action is suspended.
4. Broad Definition of "CEM"
Commercial Electronic Message (CEM) covers any message that encourages participation in commercial activity — very broad.
Express vs. Implied Consent
Express Consent
The recipient actively opted in to receive your communications.
- • Does NOT expire (unless withdrawn)
- • Must be clear and specific
- • Cannot be bundled with other consents
- • Must identify sender
- • Pre-checked boxes don't count
Implied Consent
Consent inferred from existing relationship or circumstances.
- • Relationship-based consent has defined time windows
- • Based on relationship or inquiry
- • Limited circumstances apply
- • Must track expiration dates
- • Retain evidence of the applicable conditions
When Implied Consent Applies
Existing Business Relationship (EBR)
2 yearsA qualifying purchase within two years or a written contract still in force or expired within two years can establish an existing business relationship.
Inquiry or Application
6 monthsThey contacted you asking about your products/services, submitted an application, or made an inquiry. Implied consent lasts 6 months.
Published Business Email
ConditionalThe recipient must have published or caused publication of the address, without a no-solicitation statement, and the message must relate to their role. Keep evidence. Mere availability in a list is insufficient.
Professional/Business Relationship
LimitedNon-business relationship that involves the exchange of contact information. Limited applicability for cold outreach.
Pro Tip
Required Message Elements
Every CEM under CASL must include:
- Sender Identification
Name of sender and (if different) person on whose behalf sent
- Contact Information
Mailing address plus either a telephone number, email address or web address
- Unsubscribe Mechanism
Must work for at least 60 days after message is sent
Unsubscribe processing:
You must process unsubscribe requests within 10 business days. The mechanism must be free to use and not require any information beyond email address.
The B2B "Exemption" Myth
The relationship-based B2B exemption and conspicuous-publication implied consent are distinct. A relationship between employees alone does not establish a relationship between organizations. For published addresses:
Do This
- Message is relevant to recipient's business role
- Email was conspicuously published for business purposes
- No statement indicates they don't want unsolicited emails
- You include proper identification and unsubscribe
- Message relates to their professional functions
Avoid This
- Assume all business emails are fair game
- Email scraped or purchased lists in Canada
- Ignore 'no solicitation' statements
- Send irrelevant commercial messages
- Email to request consent (that's still a CEM!)
Critical trap:
You cannot email someone just to ask for their consent. The email requesting consent is itself a CEM, which requires... consent. Catch-22.
Penalties: Up to $10 Million Per Violation
| Violator | Maximum Penalty |
|---|---|
| Business/Corporation | Up to $10 million CAD |
| Individual | Up to $1 million CAD |
Real CASL Enforcement:
- • CAD $200,000: Compu.Finder penalty imposed in CRTC decision 2017-368, reduced from the notice's proposed $1.1 million
- • Ongoing enforcement — CRTC actively investigates complaints
Private Right of Action
The Canadian government suspended these provisions before their planned July 2017 commencement. Do not describe CASL as currently granting that private lawsuit route. Regulatory enforcement remains active.
CASL Compliance Checklist
- Express consent documented, OR
- Implied consent valid (EBR <2 years, inquiry <6 months)
- Published email exception properly applied (if using)
- Sender identification included
- Mailing address plus telephone, email or web contact provided
- Unsubscribe mechanism works for 60 days
- Unsubscribe processed within 10 business days
- Message relevant to recipient's business role (if using published email)
- Consent records maintained with date, method, and proof
- Implied consent expiration dates tracked
- No "no solicitation" statement ignored
Official sources reviewed September 26, 2026: CASL identification regulations; CRTC consent and B2B exemption FAQ; CASL sections 10 and 11; Suspension of private right of action; Compu.Finder final decision.
Legal Disclaimer
This content is provided for educational purposes only and does not constitute legal advice. Regulations vary by jurisdiction and change frequently. We strongly recommend consulting with a qualified attorney or compliance professional regarding your specific situation before implementing any outreach program. Outbound Engine is designed with compliance in mind, but ultimate responsibility for legal compliance remains with the business.