- What counts as a commercial electronic message
- Express consent
- Implied consent and its time limits
- What every message must include
- The unsubscribe rule
- Spam is more than email
- How Canadians report spam
- CASL and privacy law together
- CASL compared with the UK and Australia
- A CASL checklist for small businesses
- Frequently asked questions
Canada's anti-spam law, CASL, requires consent before you send commercial electronic messages such as marketing emails and texts. Consent can be express, with no time limit, or implied, usually from an existing customer relationship that lasts up to 2 years, or 6 months after an enquiry. Every message must identify you and include an unsubscribe that's actioned within 10 business days.
CASL took effect in 2014, and it's broader than an email rule. It also covers installing software without consent, false or misleading electronic messages and harvesting email addresses. For marketers, the consent rules are the part that matters day to day.
Here's how consent works, what every message needs, and the habits that keep you on the right side of it.
What counts as a commercial electronic message
CASL focuses on messages that encourage participation in a commercial activity, whether or not you expect a profit. If a message goes to an electronic address, by email, SMS, instant messaging or a similar platform, and it contains marketing, offers or promotional content, it's covered.
Express consent
Express consent means someone has agreed, verbally or in writing, to get commercial messages from you. It has no time limit unless the person withdraws it. ISED's plain test is whether they said something like yes, please contact me.
If you only got consent for one type of message, such as a newsletter, stick to that type.
Implied consent and its time limits
Implied consent is only recognized in certain situations. The main one is an existing business relationship, for example someone who has bought from you or sent an enquiry. It doesn't last forever:
| Relationship | Implied consent lasts |
|---|---|
| Customer relationship, such as a past order | Up to 2 years |
| Enquiry or application | 6 months |
| Express consent | No time limit, until withdrawn |
Charities and not-for-profits can also have implied consent in some cases, such as from donors, members or volunteers. And if someone has published their email address openly, you may rely on implied consent only if there's no note saying they don't want unsolicited messages, and your message is relevant to their business role.
Keep records either way. ISED says senders should be ready to provide proof of consent if asked. A simple log of the date, the source and the exact wording someone agreed to is enough for most small businesses.
What every message must include
- Your business name, and the name of anyone you're sending on behalf of.
- A current mailing address plus a phone number, email address or website.
- Contact details that stay valid for at least 60 days after you send.
- An unsubscribe mechanism that's easy to use.
The unsubscribe rule
Every unsubscribe request must be actioned within 10 business days or less, free for the recipient. ISED also recommends clear unsubscribe instructions and a mechanism people can use easily. In practice, that means one click or one reply, not a login.
Spam is more than email
ISED's legal definition of spam goes beyond unwanted email. It also includes:
- altering transmission data without authorization,
- installing computer programs without consent,
- false or misleading electronic representations, including websites,
- harvesting addresses, meaning collecting or using email or other electronic addresses without permission,
- collecting personal information by illegally accessing a computer system or device.
So scraping email addresses from websites to build a list isn't just bad practice. It's one of the things the law was written to stop.
How Canadians report spam
Canadians can report spam to the Spam Reporting Centre, and ISED says email sent without consent was the top reason for complaints, with text message spam on the rise. If your messages are generating complaints, that's the signal to review your consent records before anything else.
Quebec adds its own rules, covered in the French language rules in Quebec.
Want AI doing the heavy lifting in your marketing?
I build the systems that handle the boring 80 percent, so you get your week back. Done properly, with the human kept in.
CASL and privacy law together
CASL isn't the only rule. Businesses may also have obligations under PIPEDA, Canada's federal private sector privacy law, especially for how they handle personal information. You have to comply with both.
Phone marketing is covered separately in Canada's Do Not Call List rules.
CASL compared with the UK and Australia
| Canada (CASL) | UK (PECR) | Australia (Spam Act) | |
|---|---|---|---|
| Default | Consent needed | Consent needed for individuals | Consent needed |
| Existing customers | Implied consent, time-limited | Soft opt-in for similar products | Inferred consent from an ongoing relationship |
| Unsubscribe deadline | 10 business days | Act promptly | 5 working days |
If you market to more than one country, build your list to the strictest rule and you'll be covered everywhere. To keep a compliant list healthy, see why emails get marked as spam and how to grow an email list without ads.
A CASL checklist for small businesses
- Record when and how every contact gave consent, and what kind.
- Track implied consent dates, so you know when 2 years or 6 months run out.
- Before implied consent expires, ask for express consent in a message that's otherwise allowed.
- Check every template has your name, mailing address and a working contact method.
- Test your unsubscribe link and make sure removals happen within 10 business days.
- Never make a message false or misleading, including in the subject line.
ISED's own advice to businesses is to clearly identify yourself, give customers the chance to say no, and be truthful in what you advertise. My take: CASL rewards the same thing good marketing does. People who chose to hear from you are the ones who read, reply and come back.
Frequently asked questions
What is Canada's anti-spam law?
CASL is the law that requires consent before sending commercial electronic messages, such as marketing emails and texts, and sets rules on identification and unsubscribing.
How long does implied consent last under CASL?
Up to 2 years from a customer relationship, or 6 months after an enquiry or application. Express consent has no time limit.
How fast must I process an unsubscribe under CASL?
Within 10 business days or less, free for the person unsubscribing.
What must a CASL-compliant email include?
Your business name, a mailing address plus a phone, email or website, contact details valid for 60 days, and an unsubscribe mechanism.
Does CASL apply to text messages?
Yes. It covers commercial messages sent to electronic addresses, including email, SMS and instant messaging.
Can I email someone who gave me their business card?
Possibly, under implied consent, if there was no instruction not to contact them and your message is relevant to their role. Express consent is safer.
Does CASL replace privacy law?
No. Businesses may also have obligations under PIPEDA, Canada's federal private sector privacy law, and must comply with both.
