Canada Level Law Simple

Digital Compliance

Can I Cold Email in Canada?

Sometimes, and Here Is How to Tell

By Tyler Hackbart 1 month ago 6 min read

The short answer is sometimes. The United States runs on opt out: under CAN-SPAM you can email a stranger as long as you let them leave. Canada runs on opt in. Under Canada's Anti Spam Legislation, which governs what you send rather than what you collect, a cold email that pitches anything is a commercial electronic message, and it needs a basis for consent before it is sent, not after.

That sounds like a wall, but there are a few real openings, and one of them covers a lot of ordinary business outreach. The work is knowing which one you are relying on and being able to show it.

Jump to the pre send check Six questions to answer before a cold email goes out.

The quick version

Common cold email situations under CASL
SituationCan you send it?
Their business email is published on their own website, with no note saying they do not want solicitations, and your message fits their role Yes. This is implied consent by publication
They gave you their address directly, like a business card at an event, without saying no, and your message fits their role Yes. Same idea, different route
Someone who knows you both suggested you get in touch One message, naming who referred you
You found them in a third party directory that says no unsolicited email No
You bought a list, or scraped addresses with software No
You want to email them to ask whether you can email them No. The ask is itself a commercial message

When a published address counts as consent

Canada's Anti Spam Legislation, which governs what you send rather than what you collect treats consent as implied when three things are all true. The person or their business published the address conspicuously, like on a contact page or a staff page. There is no statement next to it saying they do not want unsolicited commercial messages. And your message is relevant to their business, role, functions or duties.

Relevance is where most cold email goes wrong. Writing to the owner listed on a restaurant's website about that restaurant's online booking form fits their role. Writing to the same address about a personal investment product does not, even though the address is the same.

The Federal Court of Appeal went through this in CompuFinder v. Canada in 2020, upholding a $200,000 Canadian Radio television and Telecommunications Commission, which enforces CASL penalty against a company that sent training course promotions. Addresses taken from directories that carried a no solicitation notice did not count, and the court said a sender relying on publication should be ready to state the recipient's role and why the message fit it. The burden is on you, so keep a note of where each address came from and why you wrote to it.

Business to business is narrower than it sounds

Canada's Anti Spam Legislation, which governs what you send rather than what you collect does exempt messages between organizations, but only when the two organizations already have a relationship and the message is about the receiving organization's activities. In CompuFinder the court said that relationship has to be more than a small past purchase. A business you have never dealt with has no relationship with you, so the exemption does not reach a true cold email. Publication is the route that usually does.

Referrals

If someone who has a relationship with both you and the recipient refers you, you can send one message without consent. It has to give the full name of the person who referred you and say the message is being sent because of that referral. After that first message you need consent like anyone else, so the useful thing to do with it is ask.

Bought and scraped lists

A bought list rarely comes with consent you can prove for your own messages, and proving it is your job, not the seller's. Scraping is worse. Canada's Anti Spam Legislation, which governs what you send rather than what you collect amended Personal Information Protection and Electronic Documents Act, Canada's federal privacy law so that collecting email addresses with software built to harvest them, without consent, is not allowed, and neither is using addresses collected that way. If a list arrived in a spreadsheet and you cannot say where each row came from, do not send to it.

What every cold email still needs

Having a basis for consent only gets you permission to send. Each message still has to identify you, with your business name, a mailing address and one other way to reach you, and it still has to offer an unsubscribe.

For a one to one cold email the unsubscribe does not have to be a link. A plain line like "Not the right person, or not interested? Reply remove and I will not write again" works, as long as you act on it within 10 business days, and treat any reply asking you to stop the same way, keyword or not.

How often can you follow up?

Canada's Anti Spam Legislation, which governs what you send rather than what you collect sets no number. Each follow up is a new commercial message, so it needs the same basis as the first one, the same identification and the same unsubscribe. If the first email was allowed under publication, a follow up on the same subject usually is too.

What the law does set is the stopping point. Once someone says no, you stop, and 10 business days is the outer limit for acting on it, not a grace period for one more try. Past that, frequency is a judgment call, and complaints to the Canadian Radio television and Telecommunications Commission, which enforces CASL's Spam Reporting Centre are what start most investigations. Its July 2026 enforcement summary counted 189,908 submissions between October 2025 and March 2026.

Our own rule for cold outreach is three touches spread over a few weeks, then we stop. We only come back if we have something new and specific to say.

Direct messages and phone calls

A LinkedIn or Instagram message that pitches something is a commercial electronic message too, so everything above applies. A phone call is a different rulebook, the Canadian Radio television and Telecommunications Commission, which enforces CASL's telemarketing rules, and calls to businesses are exempt from the National Do Not Call List.

Before you hit send

  • You know which route you are relying on

    Published address, an address they gave you, a referral, or an existing relationship. If you cannot name one, do not send.

  • The address was published without a no solicitation note

    Check the page you took it from, not a directory that copied it.

  • The message fits their role

    You could say in one sentence why this person, in this job, would be the one to deal with it.

  • You wrote down where the address came from

    The page, the date, and the role. That note is your proof.

  • The email says who you are

    Business name, a mailing address, and one other way to reach you.

  • There is a clear way out

    A link, or a line inviting a reply to stop, and a plan for acting on it within 10 business days.

None of this is legal advice. It is our reading of Canada's Anti Spam Legislation, which governs what you send rather than what you collect, the Canadian Radio television and Telecommunications Commission, which enforces CASL's guidance and the CompuFinder decision, and if your outreach runs at real volume or into gray areas, a lawyer should look at it.

The honest version of cold email is also the one that works best: a real person, written to about their own business, with one specific reason to reply. The law and good outreach point the same way.

Want to know where your own site stands? See what the audit covers, or reach out and we'll get the ball rolling.

Reach out