How to run CASL-compliant email marketing in Canada: consent, identification and unsubscribe rules

What to take away

What CASL covers

Canada's Anti-Spam Legislation (CASL) is federal law. The government's anti-spam site describes it as covering unsolicited email and text messages, along with other practices such as installing programs without consent and harvesting electronic addresses. For marketers, the rule that matters is section 6 of the Act, which prohibits sending a commercial electronic message to an electronic address unless two conditions are met: the recipient has consented, whether expressly or by implication, and the message meets the content requirements in section 6(2).

Those content requirements are identification of the sender, information that lets the recipient contact the sender, and an unsubscribe mechanism. The rest of this article works through each in the order you would apply it to a campaign.

If your campaigns also reach US contacts, the cross-border planning guide explains how to hold both regimes in one consent model. Build to CASL, which is the stricter of the two.

Step 1: Establish consent before the first send

Express consent

Express consent means the recipient has agreed, verbally or in writing, to receive your messages. According to the government's guidance, the customer must have said, in effect, "Yes, please contact me", and you should give people a chance to say no. Express consent does not expire unless the recipient withdraws it, and it can be limited to specific message types, such as a newsletter.

When you ask for express consent, section 10(1) requires you to set out clearly and simply the purpose of the request and the prescribed information identifying you, and anyone you act for.

Implied consent

Implied consent exists only in defined situations. Under section 10(9), for commercial email it covers:

The time limits for relationships are specific. A business relationship generally covers a purchase, lease or similar transaction within the two years before the message, or an inquiry or application within the six months before it. A non-business relationship, such as a donation, volunteer work or membership, generally covers the two years before the message. For ongoing subscriptions, the period starts when the relationship ends.

The practical consequence is a clock on each record. A customer who bought 25 months ago, and has not otherwise engaged, is outside the implied consent window.

Who has to prove it

Section 13 puts the onus of proving consent on the person claiming it. A sender cannot rely on an assumption that the list was consented. Keep, for each address:

The government guidance also advises keeping complete records of consent, particularly when you rely on implied consent.

Step 2: Identify the sender in every message

Section 6(2) and the government's guidance require each message to include:

The contact information must remain valid for a minimum of 60 days after the message is sent. No part of the message may be false or misleading, and that includes the sender name and subject line.

Where an agency or platform sends for you, the message must identify both you and the sender. Check that your email templates carry the correct legal name and a mailing address that is staffed or monitored, and check that a change of address is reflected in every template, not only the main one.

Step 3: Build an unsubscribe that works

The unsubscribe rules are the part of CASL that tends to fail in practice, because they depend on systems working together.

For text messages, the government's guidance says CASL is technology neutral, so the same rules apply. It advises offering a "STOP" reply or another opt-out method and honouring it when used. It also says that offering a STOP option is not enough on its own: you must act on every opt-out.

Step 4: Check your list sources

Many problems start with an address you did not collect yourself. Ask these questions about any list:

Because the onus is on the sender, a purchased list with no consent evidence is a risk you carry. The Act also covers harvesting of electronic addresses without permission, so address collection tools need the same scrutiny.

Business-to-business sending follows the same rules. The conspicuous publication and disclosure routes in section 10(9) are available only where the message relates to the recipient's business role, and only if the address was not accompanied by a refusal of unsolicited messages.

Step 5: Know the consequences

Section 20(4) sets the maximum administrative monetary penalty at $1,000,000 for an individual and $10,000,000 for any other person. The federal anti-spam site states that enforcement of CASL is shared between agencies, and that the Office of the Privacy Commissioner of Canada has guidance on the CASL-related provisions of PIPEDA. Complaints go to the Spam Reporting Centre, where email sent without consent is the most common reason for complaint.

A CASL checklist for each campaign

Common questions

For how channel budgets are planned around these limits, see budget allocation by channel in Canada.

Official sources