CASL Explained: Canada’s Anti-Spam Law for Small Businesses

A plain-English guide to Canada’s Anti-Spam Legislation (CASL): consent, identification, unsubscribe rules, record keeping and penalties.

In short: CASL requires consent before you send commercial email to people in Canada, identification (your name and mailing address) in every message, and a working unsubscribe honoured within 10 business days. Keep proof of how each person joined. It applies to any business emailing Canadians, wherever the business is.

If you send marketing emails to people in Canada, Canada's Anti-Spam Legislation (CASL) applies to you — even if your business is outside Canada. CASL is one of the strictest email laws in the world, but following it is straightforward once you understand three ideas: consent, identification and unsubscribe.

This guide is general information, not legal advice. For your specific situation, check the CRTC's guidance or speak to a lawyer.

What CASL covers

CASL applies to commercial electronic messages (CEMs): emails, texts and direct messages that encourage someone to buy, try or take part in something commercial — offers, promotions, product news, event invitations and similar. A message only needs one commercial element to count.

You need consent before you send a commercial email. CASL recognises two kinds.

Express consent

The person actively agreed to receive your emails — for example by ticking an unticked box or filling in a sign-up form that clearly says what they're signing up for. Express consent doesn't expire until they withdraw it.

When you ask, you must say:

what you're asking consent for (e.g. "news and offers by email"),
who is asking (your business name and contact information),
that they can unsubscribe at any time.

Pre-ticked boxes don't count as express consent.

Implied consent

In some situations consent is implied for a limited time, for example:

An existing business relationship: the person bought from you in the past two years, or made an inquiry in the past six months.
Conspicuous publication: they published their business email address publicly, without a "no marketing" note, and your message is relevant to their business role.

Implied consent expires, so the smart move is to turn it into express consent: invite recent customers to join your list properly.

Rule 2: Identify yourself

Every commercial email must include:

your business name (and the name of anyone you're sending on behalf of),
your mailing address, and
a phone number, email address or web address where you can be reached.

Rule 3: Make unsubscribing easy

Include a working unsubscribe link in every commercial email.
It must be free and simple — no logging in, no long forms.
Process unsubscribes within 10 business days (ideally instantly).
The unsubscribe link must keep working for at least 60 days after you send.

Keep records

If anyone challenges you, you must prove you had consent. Keep a record of how and when each person joined (the form, date, and if possible the IP address or source).

Penalties

CASL violations can bring administrative monetary penalties of up to $1 million per violation for individuals and $10 million for businesses. Directors and officers can be held personally liable. Most small businesses never come close — but it's a strong reason to do things properly.

A quick CASL checklist

☐ Every subscriber gave express consent, or you're tracking implied-consent expiry dates.
☐ Sign-up forms state who you are, what they'll get and that they can unsubscribe.
☐ No pre-ticked boxes.
☐ Every email shows your business name, mailing address and contact info.
☐ Every email has a one-click unsubscribe link.
☐ Unsubscribes take effect immediately.
☐ You keep a record of consent for every contact.
☐ You never buy, rent or scrape lists.

Real-world scenarios

A customer bought from your online store 14 months ago. You have implied consent (purchase within two years) — you can email them until 24 months after the purchase. Invite them to join your list properly before it expires.

Someone asked a question through your contact form four months ago. You have implied consent for six months from the inquiry. After that, you need express consent.

You collected business cards at a trade show. A business card handed to you is generally treated as implied consent for messages relevant to the person's business role — but asking them to join your list is the safest path.

You bought a list of "opted-in" contacts from a list broker. Don't. The consent was given to someone else, not to you, and you can't prove it.

A customer unsubscribed but then made a new purchase. The unsubscribe stands for marketing emails. You can send transactional messages about their order, but not promotions — unless they opt in again.

A clear example:

"Yes, I'd like to receive emails from [Business name] with news, offers and events. You can unsubscribe at any time. [Business name], [mailing address], [email or phone]."

Use an unticked checkbox (or an email field where submitting the form is clearly the act of subscribing), and record the date, time and source.

What about your existing contacts?

If you've been emailing people without clear consent records:

Separate contacts with clear express consent from the rest.
For the rest, check whether implied consent still applies (recent purchases or inquiries) and note the expiry dates.
Send a single, polite "Would you like to keep hearing from us?" email to contacts where implied consent still applies, asking them to confirm.
Stop marketing to anyone without a valid basis.

It feels like losing subscribers, but it removes legal risk and usually improves results.

How Reepio helps with CASL

Reepio adds your business address and an unsubscribe link to every marketing email, applies unsubscribes instantly, records the consent source for imported and form contacts, supports double opt-in and never lets you email suppressed contacts. Start free — and see also our CAN-SPAM checklist if you email people in the US.

Frequently asked questions

Does CASL apply to businesses outside Canada?

Yes. CASL applies to commercial electronic messages sent to or accessed from computers in Canada, so a US business emailing Canadian subscribers must follow it.

Is a pre-ticked checkbox valid consent under CASL?

No. Express consent requires a positive action, such as ticking an unticked box or entering an email address into a form that clearly explains what the person is signing up for.

How long does implied consent last?

For an existing business relationship, implied consent lasts two years from a purchase or contract, or six months from an inquiry. Express consent lasts until the person unsubscribes.

Are transactional emails covered by CASL?

Messages such as receipts, order confirmations and account notices that only provide information the person needs about an existing transaction are generally exempt from the consent requirement, but they must not include promotional content that changes their nature.