CASL

CASL, Canada's Anti-Spam Legislation, is the federal law that has regulated commercial electronic messages since July 1, 2014. It requires consent before sending, sender identification and a working unsubscribe mechanism, and it is one of the strictest email marketing laws in the world.

Compliance & PrivacyUpdated September 30, 2026

In short

CASL is a consent-first law: to email someone in Canada commercially you need express or implied consent, plus clear identification and an unsubscribe that works.

Key points

  1. CASL applies to any commercial electronic message sent to or accessed from a computer in Canada, including B2B Cold Email [1][2].
  2. Unlike the CAN-SPAM Act, CASL requires Consent before sending, either express or implied [1][3].
  3. CASL is a messaging consent law, whereas California's CCPA / CPRA governs how personal information is collected and shared rather than whether you may send email.
  4. Implied consent includes an existing business relationship, such as a purchase in the past two years or an inquiry in the past six months, and conspicuous publication of a work address [1].
  5. Each message must identify the sender, include a mailing address plus a phone number, email or web address, and carry an unsubscribe mechanism [1][4].
  6. Unsubscribe requests must be honored within 10 business days, and the mechanism must stay valid for at least 60 days after sending [1].
  7. The CRTC can impose administrative penalties of up to 1 million dollars per violation for individuals and 10 million dollars for businesses [1][2].

How consent works under CASL

CASL starts from the opposite position to US law: no commercial electronic message without consent [1]. Express consent is an explicit opt-in that states the purpose and who is asking, and it lasts until withdrawn [3]. Implied consent is narrower and time-limited. It covers an existing business relationship, for example a purchase or contract in the past two years or an inquiry in the past six months. It also covers conspicuous publication: if a person has published their work email, for example on a company website, without a statement that they do not want unsolicited messages, and your message is relevant to their business role, you may have implied consent [1]. The burden of proving consent is on the sender, so record where and when it was obtained for every contact on a Lead List.

Content and unsubscribe rules

Every commercial electronic message, including one sent under implied consent, must carry three things [1][4]. First, identification of the sender and of anyone on whose behalf it is sent. Second, contact details: a mailing address and at least one of a phone number, an email address or a web address, valid for at least 60 days. This mirrors the Physical Address Requirement in other laws. Third, an Opt-Out mechanism that is easy to use at no cost and that you honor without delay, within 10 business days at most [1]. A message asking for consent is itself a commercial message, so you cannot email someone just to ask permission. A clean Suppression List and a clear Email Signature cover most of the day-to-day obligations.

Exemptions, penalties and B2B outreach

The regulations exempt some messages, including those sent within an organization and between organizations that already have a relationship, where the message concerns the recipient's activities [5]. Cold Outbound Sales to a new company generally does not fit that exemption, so B2B senders usually rely on conspicuous publication or a prior inquiry. Enforcement is shared: the CRTC handles most violations, and penalties can reach 1 million dollars per violation for individuals and 10 million dollars for businesses [1][2]. Directors and officers can be personally liable. Before emailing Canadian prospects, check that each address was published in a business context, that your message is relevant to the person's role, and that you are not relying only on Legitimate Interest thinking from the GDPR. This is general information, not legal advice.

Sources
  1. Frequently Asked Questions about Canada's Anti-Spam Legislation — CRTC
  2. Canada's anti-spam legislation — Innovation, Science and Economic Development Canada
  3. An Act to promote the efficiency and adaptability of the Canadian economy (S.C. 2010, c. 23) — Justice Laws Website
  4. Electronic Commerce Protection Regulations (CRTC) SOR/2012-36 — Justice Laws Website
  5. Electronic Commerce Protection Regulations SOR/2013-221 — Justice Laws Website
External sources open in a new tab.

Related terms

Consent

Consent is a clear, recorded yes that a person can take back at any time; some laws require it for marketing email, while others allow outreach without it.

CAN-SPAM Act

CAN-SPAM lets you send commercial email in the US without prior consent, as long as you are honest about who you are, include an address, and honor opt-outs quickly.

GDPR

GDPR requires a lawful basis, transparency, and respect for individual rights whenever you process personal data about people in the EU, including business contacts.

Opt-Out

Every commercial email needs an easy way to say stop, and once someone does, you must stop emailing them within the legal deadline and keep them suppressed.

Physical Address Requirement

Put a real, current postal address in every commercial email; a registered PO box or private mailbox is acceptable in the US.

PECR

Under PECR you can email UK companies without consent, but sole traders and some partnerships are treated like individuals and usually need consent or a soft opt-in.

Mentioned in
Publicly Available DataSuppression List

Outreach without the busywork.

PineLead finds new B2B prospects every day, qualifies them against your criteria and writes the first email in your voice. You approve — PineLead sends.

Start free with 100 credits →