A clear guide to consent, commercial electronic messages and unsubscribe rules, plus built-in tools that help Canadian organizations market with confidence.
CASL generally requires consent before sending a commercial electronic message, clear identification of the sender and a working unsubscribe mechanism. This practical overview is educational and is not legal advice.
Express consent is given directly and generally remains valid until withdrawn. Implied consent can apply in specific circumstances, such as an existing business relationship, but it is usually time-limited. Keep records showing when, how and why consent applies.
Identify your organization and anyone on whose behalf the message is sent. Include current contact information and avoid false or misleading sender details, subject lines and content.
Every commercial message needs a clear, no-cost unsubscribe mechanism that remains functional for at least 60 days. Requests must be acted on within 10 business days.
Cyberimpact centralizes the evidence and safeguards your team needs to manage compliant email programs more consistently.
Use this framework to reduce risk before a message leaves your account.
State what people are agreeing to, name your organization, provide contact information and do not use pre-checked consent boxes.
Confirm the consent basis, identify all senders, include valid contact information and test the unsubscribe link.
Process opt-outs within 10 business days and retain consent, campaign and unsubscribe records in case you need to demonstrate compliance.
Canada's Anti-Spam Legislation regulates commercial electronic messages and related activities. For email marketers, its core requirements are consent, sender identification and a functioning unsubscribe mechanism.
Express consent is actively given by the recipient and generally continues until withdrawn. Implied consent exists only in circumstances defined by CASL and is commonly limited in time, such as two years after certain business transactions or six months after an inquiry.
An inquiry or application can create implied consent for a limited period, commonly six months, when the message relates to that inquiry. Confirm the facts of your situation and keep a record of the request and date.
An existing business relationship may create time-limited implied consent, but it is not permanent permission. Track the relationship and its dates, and seek express consent when appropriate.
A publicly listed address or a voluntarily provided business card does not provide blanket permission. Limited implied consent may apply when there is no statement against unsolicited messages and the email is relevant to the person's business role. Assess each case carefully.
Clearly identify the sender, provide prescribed contact information, include a clear no-cost unsubscribe mechanism, keep it functional for at least 60 days and process unsubscribe requests within 10 business days.
Explore detailed guidance on Canadian privacy, consent and email marketing compliance.
