CASL Compliance: Canada's Anti-Spam Law in Plain English

Most business owners meet CASL the way they meet a speed bump: suddenly, and slightly too fast. Usually it is the first newsletter, or the moment someone suggests importing every email address in the inbox into Mailchimp. (Please do not do that. We will explain why.)

The law is shorter and more practical than its reputation. This guide sticks to what the Act and its two regulations actually say, with section numbers, and flags where common advice drifts. It is general information, not legal advice.

CASL is about commercial electronic messages. The Act defines an electronic message as one sent by any means of telecommunication, including text, sound, voice or image. A message is commercial if one of its purposes is to encourage someone to buy, sell, lease or invest, or to promote a business that does. One of its purposes. A helpful tips email with a "book now" button counts.

• Covered: marketing emails, newsletters with offers, promotional texts, direct messages to an account, automated follow-ups that pitch something.
• Covered, and often missed: an email or text asking for permission to send marketing. The Act treats that request as a commercial message too.
• Not covered by these rules: a live two-way phone call between people, a fax, or a voice recording sent to a phone. Calls have their own rules.

1. Consent. Express or implied, before you send (section 6(1)). If anyone asks, you prove it, not them (section 13).
2. Identification. Your business name, a mailing address, and a phone number, email or web address that still works 60 days later (section 6(2) and SOR/2012-36, section 2).
3. Unsubscribe. Free, easy, valid for at least 60 days, and honoured within 10 business days (section 11).

The details are in what every commercial email and text needs, with a footer template you can copy.

Some messages skip the consent step. They still need your identification details and an unsubscribe:

• A quote or estimate the person asked for.
• Confirming or completing a transaction they already agreed to, such as a receipt or booking confirmation.
• Warranty, recall, safety or security information about something they bought or use.
• Factual updates about their subscription, membership, account or loan.

Others sit outside the message rules entirely, under section 6(5) of the Act and section 3 of SOR/2013-221:

• Messages to family or to people you have a genuine personal relationship with.
• A reply to someone's request, inquiry or complaint.
• Messages between two organizations that already have a relationship, about the receiving organization's activities.
• Messages sent to meet a legal obligation or enforce a right.

Note the word "solely" hiding in the Act. A receipt with a 20% off coupon stapled to the bottom is no longer just a receipt. It is a receipt with ambitions.

CASL was written with a private right of action that would have let people sue senders directly. It never came into force. The consolidated Act now marks sections 47 to 51 as "repealed before coming into force" under the federal Statutes Repeal Act, in the version that took effect on January 1, 2026.

Plenty of articles still describe it as suspended or coming soon. It is gone. Enforcement comes from the CRTC, through administrative penalties of up to $1 million for an individual and $10 million for a business per violation. The fines guide has real cases and amounts.

1. Sort your contacts by how you got them. Opted in, customer, inquiry, business card, or "no idea". The last group does not get marketing.
2. Put a date on every implied contact. Last purchase or last inquiry. That date decides when you have to stop.
3. Turn implied into express while you still can. An unticked checkbox on the booking form, invoice or quote request. Once implied consent expires, you cannot email to ask.
4. Fix the footer. Business name, mailing address, a working contact and an unsubscribe. Test the unsubscribe yourself. Gap paid $200,000 partly over links that did not work.
5. Check your automations. Follow-up sequences, review requests and text reminders keep sending long after anyone remembers setting them up. Robots do not read the Act.