CASL Compliance: What Every Canadian Business Must Know

CASL compliance is a key concern for every Canadian business owner and marketer who sends emails, texts, or other digital messages. The law can feel complex at first, but the CRTC’s recent webinar made one thing very clear: if you focus on consent, identification, and a working unsubscribe, you are already covering the core of compliance.

This article walks through the main points covered during the webinar, then answers common questions Canadian businesses ask about CASL.

What You MUST Know About CASL in 2026

• What CASL Actually Regulates?
• The Three Core Requirements in Section 6
• Why do you need consent?
• Express consent
• Implied consent
• Key Exceptions to the Consent Rule
• How Canadian Businesses Can Have CASL Compliance?
• CASL Q&A from the Webinar
• FAQ on CASL for Canadian Businesses

What CASL Actually Regulates?

CASL applies to “commercial electronic messages” (CEMs): messages that encourage participation in a commercial activity, sent to an electronic address. That includes:

• Email newsletters and promotions
• SMS/text campaigns
• Direct messages on social platforms, when they promote products, services, or business opportunities

To decide whether CASL applies, ask three questions:

• Is the message electronic?
• Is it going to an electronic address (email, SMS, messaging account)?
• Does it promote or encourage commercial activity, even partly?

If the answer is yes to all three, CASL applies and you must respect its requirements on consent, sender identification, and unsubscribe.

The Three Core Requirements in Section 6

The webinar focused heavily on section 6 of CASL, which sets out three basic requirements before sending a CEM:

1. Consent
   • You must have valid consent (express or implied) before sending a CEM.
   • You cannot send a CEM just to ask for consent; that message would itself require consent.
2. Identification
   • Each CEM must clearly identify:
     • Who is sending the message, and
     • If different, on whose behalf it is being sent.
     • You must also include contact information such as a mailing address plus a phone number, email address, or web address.
3. Unsubscribe mechanism
   • Every CEM must include a clear, easy way to unsubscribe.
   • It must be simple, free, and processed within 10 business days.
   • The unsubscribe mechanism must work for at least 60 days after the message is sent.

These three requirements apply broadly, with only limited exceptions. Even when consent is not required (for example, some transactional messages), identification and unsubscribe often still are.

Why do you need consent?

The CRTC made it clear: CASL is an opt‑in regime. Silence or inactivity is not consent.

Express consent

Express consent is the ideal form of consent under CASL. It means the person clearly agreed to receive your CEMs, either in writing or orally. To obtain valid express consent, you must:

• Explain why you are asking for consent and what type of messages you will send.
• Identify your business and provide contact details.
• Use a positive action (for example, an unchecked box, a form submission, or a verbal “yes”).

Pre‑checked boxes and default “yes” toggles do not count as express consent, because they assume agreement instead of capturing a clear choice.

Key points from the webinar:

• Express consent has no expiry date under CASL. You can keep sending CEMs until the person withdraws consent (by unsubscribing or otherwise).
• You carry the burden of proof. Keep records of when, how, and for what purpose express consent was obtained.

Implied consent

Implied consent arises from specific situations defined in CASL and is always time‑limited. The webinar broke this down into four main categories:

1. Existing business relationship (EBR) You have implied consent if, within the last two years, the recipient:
   • Purchased, leased, or bartered products, goods, or services from you
   • Accepted a business, investment, or gaming opportunity
   • Entered into a written contract with you Or, within the last six months, made an inquiry or application about your products or services.
   • Two‑year limit from the last transaction or the end of a contract
   • Six‑month limit from an inquiry or application
2. Existing non‑business relationship (ENBR) This applies mainly to non‑profits and similar organizations. Implied consent may exist where the recipient:
   • Donated or gave a gift
   • Performed volunteer work
   • Is, or was, a member of a club, association, or voluntary organization
3. In these cases, implied consent usually lasts for two years from the date of the last donation, volunteer activity, or the end of the membership.
4. Conspicuous publication You may have implied consent if:
   • The person’s email address or number is publicly visible (for example, on a website or in a directory).
   • There is no statement saying it cannot be used to send unsolicited messages.
   • Your CEM is relevant to the recipient’s business role, functions, or duties.
5. Example: Emailing a purchasing manager about industrial equipment may fit, while emailing that same person about a personal vacation package likely would not.
6. Disclosure Implied consent can arise if someone directly gives you their email (for example, on a business card at a trade show) without indicating they do not want CEMs and your messages relate to their professional role.

The CRTC strongly recommends that businesses use implied consent as a bridge to express consent: track expiry dates, and ask for express consent while the implied consent is still valid.

Key Exceptions to the Consent Rule

The webinar also covered messages that can be sent without consent, as long as they still follow identification and unsubscribe rules (unless fully exempt). Examples include messages that:

• Provide a quote or estimate requested by the recipient
• Facilitate, complete, or confirm a transaction the person already agreed to
• Provide warranty, recall, safety, or security information about a product or service the person uses
• Provide factual information about ongoing use of a product, service, or subscription (such as account statements or service changes)

There are also special rules and exemptions for certain types of messages from charities and political actors when the primary purpose is fundraising or soliciting contributions.

How Canadian Businesses Can Have CASL Compliance?

During the webinar, the enforcement officer emphasized practical steps businesses can take to stay compliant:

• Map your messages: identify which communications are CEMs and which are transactional or informational.
• Classify consent: label contacts as express, implied (with expiry date), or non‑CEM only.
• Standardize consent capture: use clear, plain‑language forms with unticked checkboxes and explicit descriptions of what people are signing up for.
• Keep detailed records: document consent type, date, method, and source.
• Review templates: ensure every CEM includes identification and a functioning unsubscribe link.
• Train your team: make sure marketing, sales, and customer service staff understand when CASL applies and how to handle consent.

An email marketing platform built with CASL in mind can help automate these elements and reduce risk for small and medium businesses.

CASL Q&A from the Webinar

Is downloading a database and sending an introductory email CASL‑compliant?

Usually no, and only in very specific cases could it be. You must first determine whether each message is a CEM. If it is, you need valid consent for every address on that list.

If the database comes from a public directory, implied consent might apply only if:

• There is no statement prohibiting unsolicited messages, and
• Your message is clearly related to the person’s business role or duties.

In most situations, mass‑emailing a purchased or scraped list with a cold introduction will not meet CASL’s consent requirements.

Does CASL apply if I email contacts in the United States or other countries?

Yes, CASL generally applies when a computer system in Canada is used to send or access the message. So if you send your CEMs from Canada, CASL still matters, even if the recipients are outside the country.

There is a narrow exemption when you reasonably believe the message will be accessed in certain foreign jurisdictions that have similar anti‑spam laws, and your message fully complies with those local laws. However, the recommended approach from the webinar was to treat CASL as your baseline and apply it consistently.

Is B2B cold emailing allowed under CASL?

B2B does not mean “exempt.” There is a limited carve‑out for messages exchanged between employees, representatives, or consultants of organizations that already have a relationship, where the message relates to the activities of the receiving organization.

Simply finding someone’s business email and sending a sales pitch does not create that relationship. For most B2B cold emailing, you still need valid express or implied consent.

How does CASL treat fundraising emails from charities and political parties?

The webinar confirmed:

• CEMs sent by or on behalf of a registered charity, where the primary purpose is raising funds for that charity, are exempt from section 6.
• CEMs sent by or on behalf of a political party, organization, or candidate, where the primary purpose is soliciting a contribution, are also exempt.

When these conditions are met, the usual section 6 requirements (consent, identification, unsubscribe) do not apply. If the message goes beyond those purposes and promotes commercial activities, CASL may apply again.

Does CASL apply to purely informational or political emails?

If a message only shares news, opinions, or information and does not encourage participation in commercial activity, it is not considered a CEM under CASL. For example, a message that only explains a policy position or provides public safety information is typically outside section 6.

However, if you include promotions, paid events, or commercial offers alongside that information, it may become a CEM, and CASL requirements would apply.

FAQ on CASL for Canadian Businesses

Do I need consent to send a quote, invoice, or receipt?

Not always. If the message solely provides a quote requested by the recipient, or facilitates, completes, or confirms a transaction they already agreed to, CASL’s consent requirement usually does not apply. Identification and unsubscribe may still be required unless the message is fully exempt.

Can I email existing customers without express consent?

Yes, in many cases. If you have an existing business relationship from a recent purchase, contract, or subscription, you likely have implied consent for up to two years from the last transaction, or six months from an inquiry. You must track those periods and stop when they expire or if the person unsubscribes.

How quickly must I process unsubscribes?

Unsubscribe requests must be processed without delay and no later than 10 business days. You cannot charge a fee, require extra information beyond what is needed to identify the subscriber, or force them to log in to an account to unsubscribe.

What records should my business keep for CASL?

Keep:

• Copies or screenshots of consent forms and wording
• Logs showing when, how, and from which IP or device consent was captured
• Records of implied consent sources (transaction dates, inquiry dates, memberships)
• Unsubscribe logs and system screenshots showing how unsubscribes work

These records demonstrate due diligence if there is a complaint or investigation.

Can owners or directors be personally liable?

Yes. CASL allows the CRTC to hold officers, directors, and agents personally responsible if they directed, authorized, acquiesced in, or participated in violations, even if the corporation is also named. That’s why governance, policies, and internal training are so important.

Is CASL only about email spam?

No. While section 6 is about CEMs, CASL also regulates altering transmission data (section 7) and installing software without consent (section 8). The webinar touched on these briefly, but for most marketers, section 6 is where day‑to‑day compliance work happens.