Quick answer: CASL is Canada’s Anti-Spam Legislation, the law governing commercial email sent to Canadians. Before you send a commercial electronic message you must do three things: obtain consent, identify yourself, and include a working unsubscribe mechanism. Unlike the US, CASL is an opt-in regime, and penalties reach $1 million per violation for an individual and $10 million for a business (CRTC).
If you email anyone in Canada for business reasons, CASL applies — and it is one of the strictest anti-spam laws in the world. It is stricter than America’s CAN-SPAM because it requires consent before you send, not just an opt-out afterwards. Here is what the CRTC actually requires, in plain English.
Disclosure: Bluey Email, mentioned near the end, is my own product. This article is general information, not legal advice — consult a qualified lawyer for your situation.
What is CASL?
CASL stands for Canada’s Anti-Spam Legislation. It came into force on 1 July 2014 and is enforced by the Canadian Radio-television and Telecommunications Commission (CRTC), together with the Competition Bureau and the Office of the Privacy Commissioner. The law regulates “commercial electronic messages” (CEMs) — any electronic message that encourages participation in a commercial activity, which includes most marketing email. The CRTC sums up the sender’s obligations in one sentence: senders of CEMs need to “(1) obtain consent, (2) provide identification information, and (3) provide an unsubscribe mechanism.”
The three requirements for every message
Get these three things right and you are most of the way to compliance:
- Consent — you must have obtained consent (express or implied, explained below) before you send the message.
- Identification — the message must clearly identify who sent it and include contact information that stays valid for at least 60 days after sending.
- Unsubscribe — every message must contain a working unsubscribe mechanism, and you must action opt-outs without delay, and in any case within 10 business days.
Express vs implied consent
CASL recognises two kinds of consent. Express consent is when a person clearly agrees to receive your messages, in writing or orally. As the CRTC puts it, it “must be obtained through an opt-in mechanism, as opposed to opt-out. The end user must take a positive action to indicate their consent.” Pre-checked boxes are explicitly banned: “You cannot use a pre-checked box to request consent from a consumer as it assumes consent. Silence or inaction on the part of the end user also cannot be construed as providing express consent.” The upside is that express consent does not expire — though the recipient can withdraw it at any time.
Implied consent is narrower and time-limited. It applies where there is an existing business or non-business relationship — for example, someone who bought from you within the previous two years — or where a person has conspicuously published their address (say a business email on a website) without a statement that they do not want unsolicited messages. One rule trips up a lot of marketers: CASL specifically prohibits sending an email to ask for consent. That request is itself a commercial electronic message, so you cannot email a cold contact to say “can we email you?”
What are the penalties?
They are severe. The CRTC can issue an administrative monetary penalty, and “the maximum amount of an AMP, per violation, for an individual is $1 million. For a business, it is $10 million.” The onus is on the sender to prove consent, so record-keeping matters: keep documented evidence of when and how each subscriber opted in. Because implied consent expires and express consent must be provable, a clean, permission-based list is not just good practice under CASL — it is your legal defence.
How does CASL compare to CAN-SPAM and GDPR?
| CASL (Canada) | CAN-SPAM (US) | GDPR (EU/UK) | |
|---|---|---|---|
| Consent model | Opt-in (express or implied) | Opt-out | Opt-in (lawful basis) |
| Unsubscribe | Required; honour within 10 business days | Required; within 10 business days | Required; easy withdrawal any time |
| Max penalty | $10M CAD per violation (business) | Up to $53,088 per email | €20M or 4% of global turnover |
If you mail across borders, comply with the strictest rule that applies. For most senders that means the opt-in standard shared by CASL and GDPR, which also clears the US CAN-SPAM bar. Our GDPR guide covers the European rules, and building a compliant list from the start is exactly what double opt-in and how to build an email list are for. Note that CASL, like CAN-SPAM, focuses on commercial messages; purely transactional messages face lighter obligations.
Any reputable platform handles the mechanics for you. Bluey Email, like other compliant tools, provides opt-in signup forms, a one-click unsubscribe in every send, and suppression handling — but the consent itself and the honest record of it are always the sender’s responsibility.
Frequently asked questions
Does CASL apply to businesses outside Canada? Yes. CASL applies to commercial electronic messages accessed by a computer system in Canada, so a sender anywhere in the world must comply when mailing recipients in Canada.
Can I email someone to ask for their consent? No. A request for consent is itself a commercial electronic message, so sending it without existing consent is a violation. Collect consent through your website, at point of sale, or other channels instead.
Does express consent under CASL expire? No, express consent does not expire — but the recipient can withdraw it at any time, and you must stop sending within 10 business days. Implied consent, by contrast, is time-limited.
How much can a CASL violation cost? Up to $1 million per violation for an individual and up to $10 million per violation for a business, as administrative monetary penalties issued by the CRTC.
References
- CRTC — Frequently Asked Questions about Canada’s Anti-Spam Legislation: https://crtc.gc.ca/eng/com500/faq500.htm
- Government of Canada — Canada’s Anti-Spam Legislation: https://ised-isde.canada.ca/site/canada-anti-spam-legislation/en/canadas-anti-spam-legislation
— Shivam