On this page (8 sections)
CASL, Canada’s Anti-Spam Legislation, decides who you can email or text for business and what each message has to include. This CASL compliance checklist covers the parts most small businesses actually run into: getting consent, knowing when implied consent runs out, what every message needs, and how to handle unsubscribes. It’s written for owners, not lawyers.
This is not legal advice. It’s my plain-English summary of the Act, with links to the text so you can check each point. If your situation is unusual, talk to a lawyer.
Key takeaways
- You need consent before sending a commercial email or text. Express consent lasts until they withdraw it. Implied consent from an enquiry lasts 6 months, and from a purchase 2 years (CASL, s. 10).
- Every message must say who you are, how to reach you, and include an unsubscribe that works for at least 60 days.
- Unsubscribes take effect within 10 business days at most. Maximum penalties are $1M for an individual and $10M for a business.
Who CASL applies to
CASL took effect in 2014 and covers commercial electronic messages: emails, texts and direct social messages whose purpose is to encourage someone to buy, hire or do business with you (Government of Canada, fightspam.gc.ca). A booking reminder for an appointment someone already made is different from a promotion, but a lot of “follow-up” emails include a sales message, so treat them as commercial unless you’re sure.
People do complain. The Government of Canada reports 167,939 complaints to the Spam Reporting Centre between October 1, 2021 and March 31, 2022, and cites one study that found Canadian-based spam fell 37% within a year of the law coming in (fightspam.gc.ca).
Consent: express or implied
- Do I have express consent?Yes: send, until they withdraw
- If not, a purchase in 2 years?Yes: implied, until 2 years pass
- If not, an enquiry in 6 months?Yes: implied, until 6 months pass
- None of these?Don't send. Ask for consent another way.
Express consent is a clear yes, such as an unticked box they tick themselves, or a signup form that says what they’ll receive. When you ask, the Act says you must explain the purpose and identify who is asking (CASL, s. 10(1)). It lasts until they unsubscribe.
Implied consent comes from an existing business relationship. The two that matter most:
| Relationship | How long implied consent lasts |
|---|---|
| They bought from you (or leased, bartered) | 2 years from the purchase |
| They made an enquiry or application | 6 months from the enquiry |
That’s from section 10(10) of the Act. The practical point: implied consent expires. A list of everyone who ever enquired is not a list you can keep emailing forever. If you want to keep them, ask for express consent while the implied consent is still valid.
The checklist
Before you send
- Know which consent you have for each contact. Express, implied from a purchase, or implied from an enquiry.
- Record the date and source. When they signed up or enquired, and through which form.
- Check implied consent hasn't expired. 6 months from an enquiry, 2 years from a purchase.
- Use unticked opt-in boxes. Regulator guidance treats a pre-ticked box as not being a clear yes. I couldn't open the CRTC guidance pages, so check them before you rely on a different setup.
- Be very careful with bought or rented email lists. Consent doesn't pass from one business to another automatically, and you still have to be able to show it for each person. If you're unsure, ask a lawyer first.
In every message
- Say who it's from. Your name and business name, and the business you're sending for if that's different.
- Say how to reach you. The Act requires contact information; the CRTC regulations set what that must include, so check them.
- Include an unsubscribe. A link or reply address that works, at no cost to them.
- Keep the unsubscribe working for 60 days. After the message is sent.
After someone unsubscribes
- Remove them without delay. No later than 10 business days.
- Remove them everywhere. Your email tool, your CRM, and any automation that texts them.
- Keep a record. When they asked and when you acted.
The identification and unsubscribe rules are in sections 6 and 11 of the Act. Printable checklists live on the resources page.
Fines and why records matter
Section 20 of the Act sets the maximum administrative penalty per violation at $1,000,000 for an individual and $10,000,000 for any other person, such as a corporation (CASL, s. 20). Small businesses rarely see numbers like that, but the bigger day-to-day risk is simpler: if you’re asked to show consent and you can’t, you’re in a weak spot.
That’s why the record matters more than the policy. A CRM or email tool that stores the signup date, source and consent type for each contact does most of this for you.
An example, so you can picture it
This is an illustration, not a client story.
A landscaping company has 600 email addresses from five years of quotes and jobs. Before a spring promotion, the owner sorts them: customers from the last two years (implied consent from a purchase), people who asked for a quote in the last six months (implied consent from an enquiry), and everyone else. The first two groups get the promotion with a line inviting them to stay on the list. The third group doesn’t get it. Next season, the quote form gets an unticked “send me seasonal tips” box, so new leads can give express consent from the start.
Common mistakes
- Treating every old lead as fair game. Enquiry consent ends after six months.
- Unsubscribe that goes nowhere. Test the link yourself, on a phone.
- Automations that ignore unsubscribes. If your texts and emails run from different tools, an unsubscribe in one must stop both.
- No proof of consent. Keep the date and source for every contact.
- Forgetting it applies to AI-sent messages. A message drafted or sent by software is still your message. See AI lead follow-up.
Where this fits
Consent sits underneath every follow-up system. Once it’s in place, you can follow up properly without worrying about it: start with speed to lead and the templates in lead follow-up emails. If you’d like someone to look at your whole follow-up setup, that’s part of the Growth Diagnostic, or book a call.
Sources
- Canada’s Anti-Spam Legislation (S.C. 2010, c. 23), sections 6, 10, 11 and 20. Justice Laws Website
- Government of Canada. “Canada’s Anti-Spam Legislation.” fightspam.gc.ca
Questions people ask
What is CASL?
CASL is Canada's Anti-Spam Legislation. It covers commercial electronic messages, such as marketing emails and texts, sent to or from Canada. In short, you need consent, you must identify yourself, and every message needs a working unsubscribe.
What is implied consent under CASL?
Implied consent is consent the law assumes from a relationship, without a tick box. The common cases for small businesses are a purchase within the past two years and an enquiry or application within the past six months. When that window ends, so does the consent.
How fast do I have to process an unsubscribe?
Without delay, and no later than 10 business days after the request. The unsubscribe link or address in your message must keep working for at least 60 days after you send it.
What are the fines for breaking CASL?
The Act sets a maximum administrative penalty of $1,000,000 per violation for an individual and $10,000,000 for any other person, such as a company. Real penalties depend on the facts, but the ceiling is high enough to take seriously.
Is this checklist legal advice?
No. It's a practical summary of the parts of the Act a small business runs into most. For anything unusual, such as buying lists, sending on behalf of others or messages to other countries, talk to a lawyer.