CASL — Canada's Anti-Spam Legislation

If you send commercial email, text messages or other electronic messages to people in Canada, you need their consent before you send. Canada's Anti-Spam Legislation (CASL) governs these commercial electronic messages (CEMs).

Unlike the US CAN-SPAM Act, which is an opt-out law, CASL is an opt-in regime. Consent, express or implied, is required before sending, and the sender bears the burden of proving it.

This is not legal advice. Check penalties and thresholds against the primary source (below) and with counsel before relying on them. See Compliance.

What CASL regulates

CASL sets out four core prohibitions and obligations:

1. Commercial electronic messages: a sender must obtain prior consent from the recipient (express or implied), provide identification and contact information, and include a working unsubscribe mechanism.
2. Installing computer programs: installing software on someone's system requires express consent from the owner or an authorized user, and a clear and simple description of what the program does and why.
3. Message transmission data: routing information must not be altered so that a message is delivered to a destination other than the one specified (or in addition to it) without appropriate consent.
4. Aiding violations: organizations must not help others breach these requirements (liability for "aiding" under section 9).

What is a CEM?

A commercial electronic message is one where any one of its purposes is to encourage the recipient to take part in a commercial activity. Examples include offers to purchase, sell or lease products or services, business or investment opportunities, and promotion of a person's commercial activities. This is broader than the "primary purpose" test in CAN-SPAM: one commercial purpose among several is enough.

Covered and excluded messages

Consent

Express consent

• The person has clearly agreed to receive CEMs, in writing or orally, by taking an active step to opt in.
• Pre-checked boxes, silence or inactivity are not valid. A positive action is required.
• Express consent does not expire. It remains valid until the recipient withdraws it.
• The burden is on the sender to prove that consent was obtained.

Implied consent categories and time limits

Records and burden of proof

The sender must be able to demonstrate consent. Keep records of the electronic address, the date consent was obtained, the method (a form, verbally, a purchase and so on), and the context (purchase history, volunteer work, an exchange of business cards). The CRTC has issued an enforcement advisory specifically on keeping records of consent.

CEM content requirements

Every CEM must:

1. Identify the sender, and any person on whose behalf the message is sent. If it is impractical to include this in the body of the message, the information may be provided through a link to a web page that is clearly and prominently set out and free to access.
2. Provide contact information, including a valid mailing address (a P.O. box is acceptable). The contact information must remain valid for a minimum of 60 days after the message is sent.
3. Include an unsubscribe mechanism that can be "readily performed", meaning simple, quick and easy (for example, an unsubscribe link, or replying "STOP" or "Unsubscribe" by SMS). The mechanism must:
   • keep working for at least 60 days after the message is sent;
   • be processed without delay, and no later than 10 business days after the request.

Penalties and liability

A documented corporate compliance program (due diligence) reduces the risk. The Canadian Radio-television and Telecommunications Commission (CRTC) handles enforcement, and its site describes its compliance and enforcement processes and publishes its enforcement actions. Spam can be reported to the Spam Reporting Centre (fightspam.gc.ca).

Deliverability relevance

Because CASL's consent expires, it effectively requires the list-hygiene practices that also protect sender reputation. Mail only addresses with a recent relationship you can prove, and remove addresses as they age out (after 6 months for an inquiry, and 2 years for a purchase). Senders who respect those windows naturally avoid the stale, unengaged addresses that cause complaints and spam-trap hits. See Foundations of Email Deliverability.