CASL and email marketing

CASL, Canada's Anti-Spam Legislation, says that before you send a commercial email to someone, you generally need their consent, and every commercial email must identify you and include a working unsubscribe link. Consent can be express (the person actively agreed) or, in specific situations, implied (for example, a recent purchase or enquiry). If you collect emails with clear opt-in checkboxes, record when and how people agreed, and include your details and an unsubscribe in every send, you are covering the core of CASL for email marketing.

Below is the plain-English version of what that means for a small business. It is a practical overview, not legal advice. For anything unusual, or if email is a large part of your revenue, confirm the details with a lawyer who works with CASL.

What counts as a commercial electronic message

CASL applies to commercial electronic messages: emails, texts and messages on social platforms or messengers that encourage someone to buy, hire, or take part in a commercial activity. A newsletter with offers, a promotion, an announcement of a new service, an invitation to book: all commercial.

Some messages fall outside or have exemptions, for example:

• Replies to someone who asked you for information or a quote.
• Messages that complete a transaction they started: receipts, booking confirmations, warranty information, delivery updates.
• Messages within a family or personal relationship.

The moment you add promotional content to one of those, it becomes commercial. That is the most common trap.

The three requirements

For a commercial email to a person in Canada, CASL generally requires:

1. Consent, either express or implied.
2. Identification: your business name and, where you send on behalf of someone else, theirs too, plus a mailing address and at least one way to contact you (phone, email or web address).
3. An unsubscribe mechanism that is easy to use, works for at least 60 days after the message is sent, and is honoured within 10 business days.

Most email platforms handle the unsubscribe link automatically. The consent part depends on you.

Express consent

Express consent means the person actively agreed to receive your commercial messages. To be valid, your request for consent should:

• Explain the purpose: what kind of messages they will receive.
• Identify who is asking: your business name and contact information.
• Mention that they can unsubscribe at any time.
• Require an action: an unticked checkbox they tick, or a sign-up field clearly for the newsletter.

Express consent does not expire until the person withdraws it. That makes it the most valuable kind to collect.

A simple sign-up line can read: "Yes, send me occasional emails from [Business name] with seasonal tips and offers. I can unsubscribe at any time." With an empty checkbox in front of it.

Implied consent

Implied consent covers situations where a relationship already exists. The most common for small businesses:

• Existing business relationship through a purchase: the person bought from you, or entered a contract with you, within the last two years.
• Existing business relationship through an inquiry: the person asked about your products or services within the last six months.
• Conspicuous publication: their address is published (for example, on their company website) without a statement that they do not want commercial messages, and your message relates to their role.

Implied consent has a clock. Once the window passes without a new purchase or express consent, you should stop sending commercial messages. A good habit is to use the implied-consent period to invite people to give express consent.

Keeping proof

Under CASL, the sender is generally expected to be able to show consent if challenged. In practice, record for each contact:

• The date consent was given.
• How it was given (website form, checkout checkbox, paper form at an event).
• The wording they agreed to.
• For implied consent, the date of the purchase or inquiry.

A CRM is the natural place for this. When I set up a CRM, I add consent fields and dates so marketing lists can be filtered properly instead of guessing.

Seven common mistakes

1. Importing every contact from your inbox into a newsletter tool. Many of them never agreed.
2. Buying lists. The consent was given to someone else, if at all.
3. Pre-ticked boxes at checkout or in contact forms.
4. Hiding consent in terms and conditions. It should be separate and clear.
5. Forgetting implied consent expires. A customer from three years ago with no repeat purchase is likely outside the window.
6. Adding promotions to transactional emails without consent for marketing.
7. Slow unsubscribes. Manually removing people once a month can break the 10-business-day rule.

Fixing an old list you are not sure about

Many businesses have years of addresses collected without clear consent. Deleting everything feels wasteful; sending to everyone is risky. A middle path that many owners take:

• Separate contacts with documented express consent. Those can stay.
• Identify customers who bought within the last two years and recent enquiries within six months. They are likely within implied consent, so use that window to invite them to opt in.
• For everyone else, stop commercial sends. Note that under CASL, an email asking for consent is itself considered a commercial message, so you generally cannot email people without consent just to ask.
• From now on, collect consent properly at every touchpoint.

Your list will shrink. It will also open, click and buy at a higher rate, and fewer people will mark you as spam.

Quebec, privacy and email

CASL is federal and applies across Canada. Privacy laws also apply to the personal information you collect: PIPEDA in most provinces, and provincial laws in Quebec, Alberta and British Columbia. In Quebec, Law 25 adds requirements on transparency and consent, and Quebec customers should receive your communications in French at least as readily as in other languages. My article on Quebec Law 25 covers the privacy side.

Texts are covered by CASL too, with a few extra practical points; see SMS marketing in Canada.

A CASL-friendly setup in practice

• Every sign-up form has an unticked consent checkbox with clear wording.
• The form sends consent date and source to your email platform or CRM.
• Customers who buy get a separate invitation to join the list.
• Every campaign includes your business name, mailing address, contact details and an unsubscribe link.
• Unsubscribes sync automatically across all your tools.
• Twice a year, you review contacts with implied consent and remove those whose window has passed.

I build email marketing setups with these rules baked in, from forms to templates to automation. Email and SMS work is quoted individually after a short call. If you want to know what a newsletter program costs overall, see how much email marketing costs.