CASL — Canadian Anti-Spam Legislation for marketing
Comprehensive guide to express consent, identification, unsubscribe — and the fines for getting it wrong
The Canadian Anti-Spam Legislation (CASL, in force since 1 July 2014) is one of the world's strictest anti-spam laws. It applies to all 'commercial electronic messages' (CEMs) sent to Canadian recipients — email, SMS, social media DMs, even some app push notifications. Violations carry fines up to $10M per incident (organisation) or $1M (individual). This guide covers what you can and can't do.
What CASL covers (CEMs)
Commercial Electronic Message (CEM) = any electronic message encouraging participation in commercial activity. Includes email, SMS, instant messages, social media DMs, some app push notifications. Exempted: messages to family/personal relationships, certain B2B, transactional messages (e.g. delivery confirmations, password resets), responses to inquiries.
Express vs implied consent
Express consent: explicit opt-in (no pre-checked boxes), with clear purpose, mechanism to withdraw. Valid until withdrawn. Implied consent: existing business relationship (purchases in past 2 years, inquiries in past 6 months), conspicuously published address relevant to person's role. Implied consent expires after 2 years from last activity.
Required content of CEMs
Every CEM must include: (1) sender identification (legal name + 'on behalf of' if applicable), (2) sender contact info (mailing address valid for at least 60 days, phone number, email, or web URL), (3) clear and visible unsubscribe mechanism that works for at least 60 days after the message is sent, processes unsubscribes within 10 business days.
Records and audit trail
Maintain consent records for 3 years minimum: source of consent, date, type (express/implied), method of obtaining. CRTC investigations require providing this evidence. Cost of CASL violations: organisations up to $10M per violation, individuals up to $1M, plus private right of action (class actions) from individuals.
Practical compliance checklist
1) Audit current contact list, segregate by consent type and source date. 2) Re-confirm implied consents older than 18 months. 3) Add CASL-compliant footer to every CEM. 4) Implement unsubscribe processing within 10 business days. 5) Train marketing team. 6) Use CASL-compliant marketing platform (consent tracking, audit logs).
Frequently asked questions
Are B2B messages exempt from CASL?
Some B2B exemptions: messages to a sole employee whose role is identifiable for the message, messages to an organisation engaged with you (existing business relationship). But marketing to general B2B contacts still subject to CASL.
Transactional emails subject to CASL?
No — purely transactional (order confirmation, password reset, billing) are exempt. But marketing content piggybacked onto transactional emails IS subject to CASL.
What's a 'commercial electronic message'?
Any message encouraging commercial activity: sales, promotions, deals, product launches, newsletters with sales pitches. Even free webinars with subsequent sales pitches qualify.
3-year consent record retention — what to keep?
Source (web form URL, signup event, etc.), exact timestamp, consent type (express/implied), wording used at consent moment, IP address, double opt-in confirmation.
What about Quebec Law 25 + CASL?
Both apply simultaneously to Quebec. CASL is anti-spam (sender identification, consent for marketing). Law 25 is privacy (broader: data collection, processing, retention). Compliance with both required.
Related solutions & industries
Put this guide into practice with concrete 4b2b solutions and industry-specific examples.