CASL: Canada's anti-spam law for senders

Canada’s Anti-Spam Legislation (CASL, S.C. 2010, c. 23, in force since July 1, 2014) is an opt-in regime, and a stricter one than most senders expect. The default is express consent; the “implied consent” exception is real but narrow and on a clock. The Canadian Radio-television and Telecommunications Commission (CRTC) enforces it through Administrative Monetary Penalties, with backstops from ISED and the Office of the Privacy Commissioner.

This is general information, not legal advice. Consult Canadian counsel for your situation. The obligations below come from ISED and CRTC primary guidance.

The 60-second version

• Express opt-in by default. A commercial electronic message (CEM) generally requires consent before you send it.
• Implied consent exists but only in defined cases, and it expires on a statutory timeline.
• A request for consent sent by electronic message is itself a CEM - you cannot email someone to ask for permission to email them.
• Every CEM must identify you (name, mailing address, and a phone/email/URL) and carry a functional unsubscribe.
• Honor unsubscribes within 10 business days; keep the mechanism live for at least 60 days.
• No B2B exemption (registered-charity fundraising is the notable carve-out).
• The sender carries the burden of proof - keep consent records.
• Penalties: up to CAD $1,000,000 (individual) and CAD $10,000,000 (business) per violation.

Express vs implied consent

This is the heart of CASL. The two are not interchangeable, and only one expires.

Express consent

The recipient must take a proactive action - signing up, ticking an (unchecked) box, agreeing verbally. Critically, a message sent to ask for consent is itself a CEM and cannot be sent without an existing basis. Express consent does not expire: it remains valid until the recipient unsubscribes.

Implied consent

Implied consent is allowed only in defined circumstances:

Basis	Condition	Expiry
Existing business relationship - purchase	The recipient purchased goods or services from you	2 years from the purchase/transaction
Existing business relationship - inquiry	The recipient made an inquiry or application to you	6 months from the inquiry
Conspicuously published address	The recipient published their address (e.g., on a website) without a “no marketing” statement, and your message is relevant to their role or function	While the conditions hold

When the clock runs out, implied consent is gone and you need express consent to keep sending.

Sender identification

Every CEM must include:

• Your name, or the name of the person on whose behalf the message is sent.
• A mailing address.
• At least one of: a telephone number, email address, or web address for contact.
• Content that is consistent with the consent you obtained.

Unsubscribe

Requirement	Detail
Mechanism	Every CEM must include a functional unsubscribe that is easy to use and free of charge.
Timeframe	Honor an unsubscribe request within 10 business days.
Availability	The mechanism must remain functional for at least 60 days after the message is sent.

Note the contrast with the United States: same 10-business-day honor window, but a 60-day (not 30-day) availability requirement.

B2B and the charity carve-out

CASL applies to business-to-business email on the same terms as B2C - the same consent and identification obligations. The notable exception is that CEMs sent to a registered charity for the primary purpose of fundraising are exempt (s. 3(g) of the Governor-in-Council Regulations). There is no general “we’re both businesses” exemption.

Record-keeping: the due-diligence defense

CASL puts the burden of proving consent on the sender, which makes records the practical core of compliance. Keep records demonstrating consent for the full duration of your contact with each person (the statute sets no minimum period). The CRTC’s guidance points to:

• CEM policies and procedures
• Unsubscribe request logs
• Evidence of express consent (forms, audio recordings)
• Consent logs and CEM campaign records
• Training documentation

These records support the due-diligence defense in an enforcement proceeding.

Penalties

Item	Detail
Individual	Up to CAD $1,000,000 per violation
Business	Up to CAD $10,000,000 per violation
Director/officer liability	Directors and officers who directed, authorized, or acquiesced in a violation can be personally liable
Mechanism	CRTC issues Administrative Monetary Penalties (AMPs)

Common confusion

• “Implied consent is a default I can rely on.” Only in the defined cases above, and it expires (2 years / 6 months).
• “I’ll email to ask if they want my emails.” That request is itself a CEM and needs a basis.
• “B2B doesn’t count.” It does - same rules, minus only the charity-fundraising carve-out.
• “The recipient has to prove they didn’t consent.” No - the sender must prove consent. Records are your defense.

What Egressif does, and what stays with you

CASL is won or lost on records and prompt suppression, which is exactly the layer Egressif operates. We provide authenticated, identifiable sending (your name and contact stand behind a domain you control), a functional unsubscribe, suppression on receipt so an opt-out is enforced well inside the 10-business-day window and the mechanism stays live past 60 days, and durable logs of unsubscribe events and sends. Those logs are the raw material of a due-diligence defense. What stays with you is the consent itself - holding valid express or in-window implied consent, and keeping the evidence of it - which is a legal call for you and your counsel, not something infrastructure can manufacture.