CASL Compliance: Canada’s Anti-Spam Law for Websites and Email

Short answer: under Canada's Anti-Spam Legislation (CASL), you cannot send a commercial email, text or direct message without the recipient's consent, and every one you send must identify you and include a working unsubscribe link that you honour within 10 business days. Consent is either express, which you ask for, or implied, which comes from a relationship like a recent purchase and expires. Penalties can reach $10 million per violation for a business.

For most small and mid-size businesses, CASL compliance comes down to three things: a properly built signup form, the right settings in your email platform, and records that prove consent. This guide walks through each.

What is CASL?

CASL is the federal law that regulates commercial electronic messages, along with the installation of software on other people's computers. Its anti-spam provisions came into force on July 1, 2014, and the software-installation provisions on January 15, 2015. The Canadian Radio-television and Telecommunications Commission (CRTC) enforces the messaging rules.

CASL is stricter than the US CAN-SPAM Act. CAN-SPAM generally lets you email people until they opt out. CASL requires consent before you send.

What counts as a commercial electronic message

A commercial electronic message (CEM) is an electronic message sent to an electronic address that encourages participation in a commercial activity. That includes newsletters with promotions, sale announcements, product launches, event invitations with a sales purpose, and many follow-up emails. It applies to email, text messages and direct messages on social platforms.

Some messages are exempt from the consent requirement, such as a quote or estimate the person requested, or messages that confirm a transaction, deliver warranty or safety information, or provide factual information about an ongoing subscription or account. The exemptions are specific, so do not assume an email is transactional just because it also contains an order number.

Express vs implied consent

Express consent

Express consent is a clear, positive yes. It does not expire unless the person withdraws it. When you ask for express consent, the CRTC's regulations require the request to:

• Be sought separately for each act, so consent to marketing emails is not bundled with agreement to your terms of service.
• State the purpose, for example “to receive our monthly newsletter and offers.”
• Identify who is seeking consent, including the business name, and on whose behalf if different.
• Include a mailing address and a phone number, email address or web address.
• State that the person can withdraw consent at any time.

Implied consent

Implied consent exists in specific circumstances set out in the Act. The most common are:

• An existing business relationship from a purchase or contract: valid for two years from the purchase, or, for an ongoing written contract, while it is in effect and for two years after it expires.
• An inquiry or application: valid for six months from the inquiry. Someone who fills in your contact form gives you six months, not a mailing list subscription.
• Conspicuous publication: a business email address published publicly without a statement that the person does not want unsolicited messages, where your message is relevant to their role.

Implied consent expires. Your email platform needs to know when each contact's implied consent started, so you can either convert them to express consent or stop emailing them in time.

What a CASL-compliant website signup form looks like

This is where your website does most of the CASL work. A compliant form:

• Uses an unticked checkbox, or a dedicated signup form, for marketing consent. The CRTC has said pre-checked boxes are not an acceptable way to get express consent; the person must take a positive action.
• Keeps marketing consent separate from accepting terms, completing a purchase or downloading a resource. A checkout can include the checkbox, but checking out must not depend on it.
• Says what the person is signing up for, in plain words next to the checkbox.
• Names your business and includes your contact information or a link to it.
• Mentions the right to unsubscribe at any time.
• Records the consent: the date, time, form, wording shown and, ideally, the page URL and IP address.

A simple example of compliant wording beside an unticked checkbox:

Yes, send me the monthly newsletter and occasional offers from Example Co., 123 Main St, Hamilton ON. You can unsubscribe at any time.

Double opt-in, where the person confirms by clicking a link in an email, is not required by CASL, but it gives you strong proof of consent and keeps your list clean.

What every commercial message must contain

• The name of the business sending the message, and of anyone on whose behalf it is sent.
• A mailing address, plus a phone number, email address or web address. This contact information must remain valid for at least 60 days after the message is sent.
• An unsubscribe mechanism that is readily performed, such as a one-click link, and that remains valid for at least 60 days after the message is sent.
• Unsubscribe requests honoured without delay, and in any event within 10 business days, without the person having to do anything more.

Most reputable email platforms handle the unsubscribe link and footer for you. Where businesses get into trouble is in the gaps: a separate CRM that keeps emailing unsubscribed contacts, an imported list, or a sales team sending one-to-one promotional emails from their own inboxes.

Keep records of consent

If a complaint is made, you have to prove you had consent. The Act puts the onus on the person alleging consent. Keep, for each contact:

• How and when consent was obtained (form, purchase, inquiry, in person).
• The exact consent wording shown at the time.
• For implied consent, the date the relationship or inquiry started.
• Unsubscribe and withdrawal dates.

Do not import purchased or scraped lists. You cannot show consent for those contacts, and they are a common source of CRTC complaints.

The software installation rules, briefly

CASL also prohibits installing a computer program on someone else's computer in the course of commercial activity without express consent, with additional disclosure required for programs that do things like collect personal information or change settings. For most business websites this is not an issue: ordinary web cookies, JavaScript and HTML on your pages are treated as consented to where the person's conduct makes it reasonable to believe they agree. If you distribute downloadable software, browser extensions or apps, get specific advice.

Penalties and enforcement

The CRTC can impose administrative monetary penalties of up to $1 million per violation for individuals and $10 million per violation for businesses. Officers and directors can be personally liable if they directed or authorized a violation, and businesses are liable for violations by their employees and agents unless they show due diligence.

A few enforcement actions show what the CRTC looks at:

• Compu-Finder (2015): the CRTC's first notice of violation under CASL carried a $1.1 million penalty for sending promotional emails without consent and with unsubscribe mechanisms that did not work properly. On review in 2017, the CRTC confirmed the violations but reduced the penalty to $200,000.
• Gap Inc. (2021): agreed to pay $200,000 over alleged messages sent without the necessary consent and messages without a working or easy-to-use unsubscribe mechanism.

The pattern is consistent: consent records and unsubscribe handling are where businesses get caught.

CASL compliance checklist

• Every marketing signup uses an unticked checkbox or a dedicated signup form.
• Consent wording states the purpose, names your business, gives contact details and mentions unsubscribing.
• Marketing consent is separate from terms of service, purchases and downloads.
• Your email platform stores the consent source, date and wording for every contact.
• Implied-consent contacts are tagged with a start date and an expiry (two years for purchases, six months for inquiries).
• Every commercial email includes your business name, mailing address and contact method.
• The unsubscribe link works, is easy to use, stays valid for at least 60 days, and is processed within 10 business days.
• Unsubscribes sync across every tool that sends email, including your CRM and sales team.
• No purchased, rented or scraped lists.
• Text message and social DM campaigns follow the same rules.

If your forms or email integrations need fixing, that is typically quick work. Our website maintenance plans cover form and integration fixes. Your signup forms also collect personal information, so they need to line up with your privacy policy; see our guide to PIPEDA and website privacy.

This isn't legal advice

This guide summarizes CASL, the CRTC's regulations and published enforcement actions as of October 2026. It is not legal advice, and the exemptions in particular have detail this guide does not cover. For legal questions, talk to a lawyer. For the website side, compliant signup forms, consent records and email platform integration, request a quote.