CASL, Explained

CASLCanada's Anti Spam Legislation, which governs what you send rather than what you collect is Canada's Anti Spam Legislation. It came into force on 1 July 2014, the CRTCCanadian Radio television and Telecommunications Commission, which enforces CASL enforces it, and despite the name it is not only about junk mail. It governs the commercial messages you send electronically: email, text messages, and direct messages on social platforms. If your business sends a newsletter, a promo code, or a follow up nudging someone to book, it applies to you.

Like PIPEDAPersonal Information Protection and Electronic Documents Act, Canada's federal privacy law, it has no employee threshold. A one person shop sending a monthly newsletter is covered on the same terms as a national retailer.

Jump to the checklist Five things to confirm about your own sending, if you just want the short version.

What it covers, and what it does not

The line people blur is between collecting an address and using it. What your signup form collects, and what you do with that information afterwards, is PIPEDAPersonal Information Protection and Electronic Documents Act, Canada's federal privacy law's business. The message you send to that address is CASLCanada's Anti Spam Legislation, which governs what you send rather than what you collect's. One form can touch both laws, which is why a pre ticked box causes a problem under each.

CASLCanada's Anti Spam Legislation, which governs what you send rather than what you collect reaches a message when one of its purposes is to encourage someone to take part in a commercial activity. That is a wide net. A receipt that closes with a discount code for next time is a commercial message. A message that only does the transactional job, like a receipt, a shipping notice or a warranty update, can go out without consent, but it still has to identify you and carry an unsubscribe.

The three things every commercial message needs

1. Consent. Express or implied, and you carry the burden of proving it. If the CRTCCanadian Radio television and Telecommunications Commission, which enforces CASL asks, "we think they signed up" is not an answer. A record is.
2. Identification. Who is sending it and on whose behalf, with a mailing address and one other way to reach you, like a phone number, an email address or a web page.
3. A working unsubscribe. It has to be easy to use, it has to keep working for at least 60 days after you send, and you have to act on it within 10 business days.

Does it have to be a link?

No. The unsubscribe has to work through the same channel the message came in on, or another electronic one if that is not practical, and it has to be quick and easy to use. A line like "Reply remove and we will take you off the list" meets that for an email, the same way "Reply STOP" does for a text, which is the example the CRTCCanadian Radio television and Telecommunications Commission, which enforces CASL itself gives.

What makes a reply work is the part behind it. Someone has to read that inbox, the address has to keep working for 60 days, and the removal has to happen within 10 business days. And a reply that says "please stop emailing me" counts even if it skips your keyword. Once you send at any volume, a link that removes the address automatically is simply harder to get wrong.

Express consent, and what it looks like on a form

Express consent is a clear yes. On a website that usually means an unticked checkbox next to plain words about what someone is signing up for and who is asking. A pre ticked box does not count, and the CRTCCanadian Radio television and Telecommunications Commission, which enforces CASL says so directly. Neither does silence, or a signup buried in your terms of service.

Express consent does not expire. It lasts until the person withdraws it, which is why a clean signup record is worth more than a big list.

One trap worth knowing: you cannot send an email asking for consent. The request is itself a commercial message, so it needs consent before it goes out. Asking has to happen somewhere else, like your website, your checkout or in person.

Implied consent, and why it runs out

CASLCanada's Anti Spam Legislation, which governs what you send rather than what you collect also allows implied consent in a few defined situations, and most of them come with a clock.

The clock is where most small lists quietly drift out of line. A customer from three years ago who never ticked a box is no longer someone you have consent for. The fix is not to stop emailing them. It is to ask for express consent while the implied consent is still live.

Business to business

Messages between organizations that already have a relationship, sent to someone about their own organization's work, are exempt from the consent, identification and unsubscribe rules. The key words are already have a relationship. Cold outreach to a business you have never dealt with is still a commercial message and still needs a basis for consent.

How often can you send?

CASLCanada's Anti Spam Legislation, which governs what you send rather than what you collect puts no limit on frequency. Weekly, daily or twice a year are all fine on paper, because the law asks whether you have consent for each message, not how many there are. Every message needs the same three things, and every message has to stop once someone unsubscribes.

Frequency matters in two other ways. Implied consent runs on the clocks above, so a list you email once a year can quietly age out between sends. And the CRTCCanadian Radio television and Telecommunications Commission, which enforces CASL's investigations lean heavily on complaints to its Spam Reporting Centre, so a list that feels like too much is how a business ends up in front of the regulator. Our advice is to say how often you will send at the point someone signs up, and then send that often.

What CASL says about cookies

This is the part that surprises people who have been told Canada requires a cookie banner. CASLCanada's Anti Spam Legislation, which governs what you send rather than what you collect does govern installing software on someone's computer without their consent. But section 10(8) deems a person to have consented to cookies, HTML and JavaScript when their conduct makes it reasonable to believe they did, and ordinary browsing is that conduct. CASL is not the source of any Canadian banner rule. If your tracking needs consent, that question sits with PIPEDAPersonal Information Protection and Electronic Documents Act, Canada's federal privacy law, and with Law 25 if you have customers in Quebec.

The penalties, and what actually happens

The maximum is $1 million per violation for an individual and $10 million per violation for a business, and directors and officers can be personally liable if they directed it or went along with it. Those are the numbers you will see quoted.

The reality is more measured. In its May 2021 enforcement summary, the CRTCCanadian Radio television and Telecommunications Commission, which enforces CASL put the penalties payable across the whole program since 2014 at just over $1.4 million. Actions since then have tended to be undertakings in the tens to low hundreds of thousands, like the $120,000 undertaking Hudson's Bay Company gave in 2024.

It is also not standing still. The CRTCCanadian Radio television and Telecommunications Commission, which enforces CASL's enforcement summary published in July 2026, covering October 2025 to March 2026, reported 11 warning letters, 96 notices to produce and 189,908 submissions to its Spam Reporting Centre, and said it intends to take stronger enforcement measures now that the law is well established.

CASLCanada's Anti Spam Legislation, which governs what you send rather than what you collect was also written with a private right of action that would have let anyone who received a non compliant message sue. That part was suspended in 2017 and has never come into force.

A check you can run today

• Your signup checkbox starts unticked

  With plain words next to it about what someone is signing up for, and separate from the contact form's submit.

• Every marketing email says who sent it

  Your business name, a mailing address, and one other way to reach you.

• The unsubscribe works

  No login, no maze. Click it yourself from a test address and confirm you stop getting mail.

• You know where each address came from

  The date and the form or purchase behind it. That record is your proof of consent.

• Older customers get asked, not assumed

  Anyone past the two year mark with no express signup should get a request while you still can.

We are not lawyers, and this is our reading of the Act and the CRTCCanadian Radio television and Telecommunications Commission, which enforces CASL's published guidance, not advice about your own list. If your sending is complicated, a lawyer is the right person to ask.

In an audit, CASLCanada's Anti Spam Legislation, which governs what you send rather than what you collect shows up as a line in the table of rules that apply to you, and we look at how your forms ask for a signup. What happens in your email tool afterwards is yours to run, and the check above covers most of it.