Skip navigation

BLOGAction Bulletin: Canada’s Anti-Spam Law (CASL)

by Randall CraigFiled in: Blog, Make It Happen Tipsheet, MarketingTagged as: , , , , , ,

There is no doubt that SPAM – unwanted commercial electronic messages – is a major problem.  It consumes internet bandwidth, clogs our inboxes, and saps productivity.  The solution – spam filters – often makes the problem worse by wrongly filtering legitimate communications into the junk mail folder.

Another solution, legislation, has existed on the books for some time: CAN-SPAM in the United States is a great example.  Canada’s Anti-Spam Law, or CASL, is another.  CASL is one of the world’s most stringent and comprehensive anti-spam laws on the books, and will likely be duplicated in one form or another in many other jurisdictions.

Within CASL, there is an important lesson for every marketer, whether in Canada or elsewhere.  Which is more important to your organization: a smaller list of engaged users, or a larger list of people who are annoyed whenever you send them material they never asked for. Too often our pride in the size of our list gets in the way of the quality of the names that are on it.  CASL – and similar legislation – forces you to improve the quality of your list. Quality trumps Quantity any day.

Some details:

1) The definition of a Commercial Electronic Message (CEM): Any electronic message that encourages participation in a commercial activity, regardless of whether there is an expectation of profit.  This definition also includes Social Media.

2) Non-compliance exposes you to significant financial penalties: for businesses, $10 million (from the CRTC) and $10 million (from the Competition Bureau).  For individuals, the numbers are $1 million and $750,000.  In addition, you are now open to civil lawsuits, but these are capped at “only” $1,000,000.

3) The burden of proof is on you to prove consent.  This means that you will need to have a system to prove and track the relationship, including when a person has subscribed, and what they agree to.

4) Consent:  The law states that you cannot send a CEM without consent. There are two types of consent:

  • Express consent – they actively gave us permission to send
  • Implied consent – reasonable to conclude permission is granted, based on prior relationship

5) Every message must contain an unsubscribe link, which, when clicked, must be completed within 10 days.  The message must also include real-world contact information.  This information must be valid for 60 days.

Unfortunately, most organizations have marketing lists that are STILL not 100% CASL-compliant, many years after the law has been enacted.  The lists may include names collected without permission, names collected with permission, but where what is sent was not requested, names that were purchased from a list, or (hopefully not) names that were “scraped” from the web, or harvested from websites online.  The list may also include former clients/members/alumni from many years ago.

Can you send a particular email?  Here is a short strategy that can help:

1) Is the CEM exempt?  Certain types of communications are exempt, including certain emails to current clients and transaction emails (eg containing receipts for a transaction).  There is a partial exemption for send-to-a-friend emails; if you do use this technique, then you must disclose the name of the sender (and yourself) within the email.

2) Rely on Implied Consent.  If it is reasonable to assume that someone has asked for the information, and they didn’t tell you not to send it, then you may rely on Implied Consent and send it.  An example: someone gives you their business card for the purpose of being informed about upcoming events that relate to their business role.  You cannot contact them in a CEM for any other purpose (for example a newsletter, a sales offer), but you can send them a CEM for a relevant upcoming event.

3) Ask for Express Consent:  This is an explicit permission to send a CEM; it must be documented as to date, time, purpose, and manner of consent.  Note that a pre-checked box on an opt-in form is NOT acceptable: the person must explicitly check the box.  The request must also be “unbundled” from the general terms of sale.  This means that you cannot put a sentence on a web form that says “by attending this event (or by purchasing this book) you agree to receive email from us”.

4) Make sure that your current web forms are all CASL-compliant, and that your systems capture all of the relevant information in case of dispute.  If you are changing your system or email providers, make sure that you are able to retain proof of compliance.

5) Review all outgoing CEMs:  Are they compliant?  (Working Unsubscribe link + contact details.)

6) Ask for express consent from existing and new clients: two years after they cease being clients, you will not be able to rely on implied consent to contact them via a CEM.

Finally, depending on your business model and structure, there may be other factors that you will need to consider.  What if your partners send a CEM to their list, using your name?  Or downstream affiliates do so?  Or international partners?  While the email will clearly be coming from them, you still put yourself and your organization at risk.


Look closely at how email marketing fits into your plans, focusing specifically on permissions, but explicit and implied.  Are you compliant?

Fine print:  Some of the concepts in this Tipsheet have been simplified; there are a number of details, nuances, exceptions, and additional requirements in the legislation and regulations that you will want to review.  Please remember that I am not a lawyer, and you should not consider this Tipsheet to be legal advice, or even suitable for your purposes.  Before making any decisions or acting, please get definitive advice from your own legal counsel.


Does this topic resonate? Reach out to Randall: he can present it to your group.  (More presentation topics)
Download Randall’s professional credentials: Speaker credentials one-sheet or Management Advisory credentials.

Content Authenticity Statement: 100% original content: no AI was used in creating this content.

@RandallCraig (Follow me for daily insights) Professional credentials site.



Randall Craig

Contact us for more on Randall’s topics, availability, and audience fit.

Back to top