Why It Matters
CASL applies if you send commercial email to anyone in Canada, regardless of where your business is located. The penalties are stiff — up to $10 million per violation for companies and $1 million for individuals. Unlike CAN-SPAM, CASL is an opt-in law, meaning you need consent before you send, not just an opt-out after.
How It Works
CASL recognizes two types of consent: express and implied. Express consent is when someone actively opts in — they check a box, submit a form, or verbally agree. This consent doesn't expire. Implied consent is based on an existing relationship (a recent purchase, an active membership) and lasts 2 years from the last transaction or until the relationship ends.
Every commercial electronic message must include: the sender's identity, contact information, and an unsubscribe mechanism that remains functional for at least 60 days. You also need to keep records of how and when each contact gave consent.
Quick Tips
- Never use pre-checked consent boxes. CASL requires affirmative action — the subscriber has to actively opt in.
- Keep consent records (timestamp, method, specific wording) for every subscriber. If challenged, the burden of proof is on you.
- If you have Canadian contacts from before CASL (July 2014), you need express consent to continue emailing them. Implied consent from old relationships has long expired.