CASL Explained: Email and SMS Marketing Rules for Canadian Businesses
Email and text messages are some of the most effective ways to bring customers back. In Canada, they are also regulated by Canada’s Anti-Spam Legislation, usually called CASL. This guide explains the main rules in plain language and gives you a practical checklist for setting up compliant marketing.
This article is general information, not legal advice. For questions about your specific situation, speak to a lawyer or refer to the official guidance from the CRTC.
What CASL covers
CASL applies to commercial electronic messages, or CEMs. These are messages that encourage someone to buy, sell or take part in a commercial activity, sent by email, text message, instant message or similar electronic channels to or from computers and devices in Canada. Newsletters with offers, promotional emails and marketing texts are all CEMs.
The three core requirements
- Consent: you need the recipient’s express or implied consent before you send.
- Identification: each message must identify who is sending it and include contact information, such as a mailing address and a phone number, email address or website.
- Unsubscribe: each message must include a simple, free way to unsubscribe, and requests must be processed within 10 business days.
Express consent vs implied consent
Express consent is when someone actively agrees to receive your messages, for example by ticking an unchecked box next to a clear statement. When you ask for express consent, you need to explain why you are asking, who is asking and that they can unsubscribe at any time. Express consent does not expire until the person withdraws it.
Implied consent applies in specific situations, most commonly an existing business relationship. Generally, this includes a customer who made a purchase from you within the past two years, or someone who made an enquiry within the past six months. Implied consent expires, so it is worth asking these contacts for express consent while you can.
Messages that do not need consent
Some messages are exempt from the consent requirement, such as a quote the person asked for, an order confirmation, warranty or safety information, and factual updates about a product or service they already use. These messages should still include your identification and an unsubscribe option where CASL requires it.
A practical setup checklist
- Use an unchecked opt-in checkbox with clear wording on forms and at checkout.
- Record when, where and how each contact gave consent.
- Add your business name, mailing address and an unsubscribe link to every marketing email.
- Process unsubscribes automatically, well within 10 business days.
- Track the expiry dates of implied consent.
- Never buy or rent email lists.
- Use the same approach for SMS: clear opt-in, identification and an easy way to opt out, such as replying STOP.
Penalties for breaking CASL
CASL is enforced by the Canadian Radio-television and Telecommunications Commission (CRTC). Administrative monetary penalties can reach up to $1 million per violation for individuals and up to $10 million per violation for businesses, so it is worth getting your forms and processes right from the start.
Make compliance part of your marketing system
Frequently asked questions
Does CASL apply if my business is outside Canada?
CASL can apply to messages sent to people in Canada, even if the sender is located elsewhere. If you market to Canadians, it is safest to follow CASL.
Is a pre-checked consent box allowed?
No. Express consent must be an action the person takes, such as ticking an unchecked box. A pre-checked box does not count as express consent.
Do I need consent to email business contacts?
Often, yes. Some limited exceptions exist, for example when an email address is conspicuously published and your message relates to the person’s role, but the safest approach is to obtain express consent.
The good news is that compliant marketing usually performs better. People who chose to hear from you are more likely to open, click and buy. When we build ecommerce marketing and automated follow-up workflows, consent capture, records and unsubscribes are set up as part of the system rather than added later.