Email is still one of the most effective marketing channels a small business has, and in Canada it comes with clear rules. Canada’s Anti-Spam Legislation (CASL) governs commercial electronic messages, including marketing emails and texts. Get the basics right when you set up your list and you’ll rarely need to think about it again. Get them wrong and you’re exposed to some of the toughest penalties of any anti-spam law.
This guide covers what CASL requires in plain terms and gives you a practical setup checklist. It isn’t legal advice; check the official guidance or a lawyer for your situation.
What CASL covers
CASL applies to commercial electronic messages: emails, texts and similar messages that encourage someone to buy, sell or take part in a commercial activity. That includes newsletters with offers, promotions, product announcements and most marketing automations.
The three core requirements are consent, identification and an unsubscribe mechanism.
1. Consent: express or implied
Express consent
Someone has clearly agreed to receive your messages, for example by ticking an unticked box or signing up to your newsletter. Express consent doesn’t expire unless they withdraw it. It’s the strongest basis for a marketing list, and the one to aim for.
Implied consent
In certain situations consent is implied, most commonly through an existing business relationship. It’s time-limited:
- Up to two years after a purchase or similar business relationship.
- Just six months after an inquiry or application.
Implied consent is useful, but it runs out. If you rely on it, track the dates and ask for express consent before it expires.
What doesn’t count
- Pre-ticked boxes.
- Bought or rented email lists.
- Scraping addresses from websites or social profiles.
- Assuming that someone who emailed you once wants your newsletter forever.
2. Identification
Every commercial message must identify who’s sending it. Official guidance says to include:
- Your business name, and the name of anyone on whose behalf you’re sending.
- A current mailing address.
- A phone number, email address or website address.
Most email platforms put this in the footer automatically once you fill in your account details. Check that it’s correct.
3. Unsubscribe
Every commercial message needs a clear, working way to unsubscribe, at no cost to the recipient. Unsubscribe requests must be actioned within 10 business days. Email platforms handle this automatically; the risk is in lists exported to spreadsheets, CRMs or other tools that don’t sync unsubscribes.
Penalties
CASL allows administrative monetary penalties of up to $1 million per violation for individuals and up to $10 million per violation for businesses. Most small businesses will never be near that territory, but the size of the maximums tells you how seriously the law treats unsolicited messages.
Keep proof of consent
If a complaint is made, you need to show how you got consent. Keep records of:
- When and where each person signed up (form, date, page).
- What the sign-up form said at the time.
- The basis for any implied consent and when it expires.
Good email platforms record sign-up source and date automatically. If you import contacts, record where they came from.
A CASL-friendly setup checklist
- Choose a reputable email platform that handles unsubscribes, footers and consent records.
- Write a clear sign-up form: say what people will receive and how often, with an unticked consent box where it’s combined with another form.
- Keep marketing consent separate from contact or checkout forms. A contact enquiry isn’t a newsletter sign-up.
- Use double opt-in if you can. It isn’t required by CASL, but it confirms the address is real and gives you clean proof of consent.
- Fill in your identification details so every email footer is correct.
- Tag contacts by consent type: express, or implied with an expiry date.
- Before implied consent expires, send a polite request for express consent.
- Sync unsubscribes across every tool that sends email.
- Clean up old lists. If you can’t show consent for a group of addresses, don’t email them marketing.
- Update your privacy policy to reflect what you collect and why.
Connecting your website to your email list
Your website is usually where most sign-ups happen: newsletter forms, checkout opt-ins, downloadable guides. Connect forms directly to your email platform rather than collecting addresses in a spreadsheet, so consent records and tags are captured automatically. Our guide to website automations for small businesses covers newsletter and CRM connections.
If you run a Shopify store, use Shopify’s marketing consent setting at checkout, and keep it unticked by default. Our guide to setting up Shopify in Canada covers the rest of the Canadian setup.
Email that people actually want
CASL sets the legal floor. What keeps people subscribed is useful, consistent email: a clear reason to sign up, a predictable schedule, design that matches your brand and content that isn’t just discounts. Fewer, better emails usually outperform frequent ones.
Frequently asked questions
Does CASL apply to emails sent to businesses?
Generally, yes. CASL isn’t limited to consumers; commercial messages sent to business email addresses are covered too. There are limited exemptions, so check the official guidance if most of your marketing is business-to-business.
Do order confirmations and receipts need consent?
Some messages, such as a quote someone asked for or messages that complete a transaction they started, are treated differently from marketing and don’t need consent. Check the CRTC’s guidance on which requirements still apply, and keep marketing content out of these messages unless you have consent.
Can we email people whose business cards we collected at a trade show?
Be careful. Handing over a business card isn’t automatically consent to receive marketing. The safest approach is to send a single, personal follow-up about the conversation you had and ask whether they’d like to hear from you.
What about text messages?
CASL covers texts and other electronic messages too, so the same consent, identification and unsubscribe principles apply.
Get your email set up properly
Our creative services cover email setup, design and ongoing management, in CAD:
- Email Setup: $750
- Email Campaign: $200 per email
- Email Management: $750/month
- Advanced Email Management: $1,250/month
- Email + SMS Management: $1,500/month
Newsletter integration with your website is $300, listed with our other add-ons on the pricing page. Tell us what you want to send through Start a project.
Written by the CHRISPS studio in Cambridge, Ontario. CASL requirements are summarised from the Government of Canada’s published guidance at the time of writing. This isn’t legal advice.