Skip to main content

    CASL Consent: Express vs Implied, and When It Expires

    The two kinds of consent Canada's anti-spam law recognizes, how long each one lasts, and consent wording you can copy.

    Last reviewed . Anti-spam rules change, so check the official sources linked below before you rely on a detail.

    Express or implied: the short answer

    Express consent is a clear yes from the person, and it lasts until they unsubscribe. Implied consent comes from a relationship, such as a purchase in the last two years or an inquiry in the last six months, and it runs out. Either one lets you send commercial messages. Only one of them is still there next year.

    Consent is the part of CASL that trips most people up, mostly because "they gave me their email" feels like permission. Sometimes it is. Sometimes it is permission with an expiry date. Sometimes it is a business card at a trade show, which is permission to talk about the thing you talked about at the trade show.

    What express consent requires

    When you ask for express consent, section 10(1) of the Act and section 4 of the CRTC regulations (SOR/2012-36) say the request must clearly and simply include:

    • What you are asking consent for, such as monthly newsletters or promotional texts.
    • Your name or business name, and the name of anyone else you are asking on behalf of.
    • A mailing address, plus one of: a phone number that reaches a person or voicemail, an email address, or a web address.
    • A statement that the person can withdraw consent.

    Consent can be given in writing or orally, and the regulations say it must be sought separately for each kind of act the law covers. Ask for it on its own, not tucked into your terms of service, so there is no doubt about what the person agreed to. Oral consent is valid, but you will want a record, because proving it is your job.

    CRTC guidance is clear that the person has to take a positive step. A checkbox they tick counts. A checkbox you ticked for them, which they have to notice and untick, does not.

    Consent wording you can copy

    Put this on a sign-up form, booking form, quote request or checkout. Swap the brackets for your details. Keep the box unticked.

    [ ] Yes, send me [what you will send, e.g. "monthly tips and offers"] from [Business name] by [email / text].

[Business name], [mailing address]. Questions: [phone that reaches a person or voicemail, or email, or website].
You can unsubscribe at any time using the link in every message, or by contacting us.

(Leave the box unticked by default. Store the date, the form it came from and this exact wording with the contact.)

    Implied consent, and the clock it comes with

    Section 10(9) of the Act lists when consent is implied. The one most businesses rely on is an existing business relationship:

    What creates an existing business relationship, and how far back it can be (CASL section 10(10)).
    What happenedWindow before you send
    They bought or leased a product, service or property from youTwo years
    They accepted a business, investment or gaming opportunity from youTwo years
    You bartered with themTwo years
    You have a written contract with themWhile it is in force, and two years after it expires
    They made an inquiry or application about any of the aboveSix months

    The window is counted back from the day you send. So a customer who bought on March 3, 2025 can get marketing until March 3, 2027. If they buy again, the clock starts again from the new purchase. For subscriptions, memberships and other ongoing relationships, the period starts when the relationship ends, not when it began (section 10(14)).

    Registered charities, political parties and clubs get a similar two-year existing non-business relationship for donors, volunteers and members (section 10(13)).

    Want the date worked out for you? The consent checker does the arithmetic.

    Business cards and published addresses

    Two more kinds of implied consent apply to people in their work role:

    • They gave you the address, for example a business card or an email signature, and did not say they did not want messages.
    • They published it conspicuously, for example on their company website, without a note saying they do not want unsolicited commercial messages.

    In both cases your message has to be relevant to their business, role, functions or duties. Pitching office cleaning to the office manager whose email is on the contact page: plausible. Pitching a timeshare to the same person: not relevant, and not covered. Rule of thumb: if you would struggle to explain why this person in this job would want this message, so would the CRTC.

    Referrals and business-to-business messages

    Referrals. Section 4 of SOR/2013-221 lets you send one message to someone you were referred to, if the person who referred them has a relationship with both of you. That first message must give the referrer's full name and say it is being sent because of the referral. After that one, you need consent like everyone else.

    Business to business. Section 3(a)(ii) of the same regulation exempts messages between people at two organizations that already have a relationship, when the message concerns the activities of the organization receiving it. It does not cover cold outreach to businesses you have never dealt with.

    Five consent traps small businesses walk into

    1. Emailing to ask for consent. The Act counts a request for consent as a commercial message. If you do not already have consent, you cannot email to ask for it.
    2. Importing the whole inbox. Everyone who ever emailed you is not a subscriber. Some are customers with a two-year window, some were inquiries with six months, and some are your accountant.
    3. Buying a list. A purchased list does not give you implied consent. Consent gathered by someone else can only be used under strict conditions in the regulations.
    4. Pre-ticked boxes and bundled terms. "By booking you agree to receive marketing" asks for no positive step toward marketing, which CRTC guidance says express consent needs. Ask separately, with an empty box.
    5. Forgetting the clock. Implied consent quietly expires. Your email tool will not tell you. That is why the best time to ask for express consent is while the customer is still happy.

    Keep proof, because the burden is yours

    Section 13 of the Act puts the onus of proving consent on the person who says they have it. For each contact, keep:

    • How they consented: the form, the checkbox wording, or a note of what was said and when.
    • The date, and for implied consent, the purchase or inquiry date that starts the clock.
    • What they agreed to receive.
    • When they unsubscribed, if they did.

    CRTC guidance also says that once someone gives express consent, you should send them a confirmation. A short "you're subscribed" email does the job, and it doubles as a record.

    Most email platforms store the sign-up date and source. Booking tools, invoicing tools and CRMs often do not pass that along, which is how good lists go fuzzy.

    Questions about CASL consent

    How long does implied consent last under CASL?

    It depends on how you got it. A purchase, lease, barter or contract gives you two years from the purchase or from the end of the contract. An inquiry or application gives you six months from the date of the inquiry. Express consent does not expire until the person withdraws it.

    Does express consent under CASL expire?

    No. Express consent lasts until the person unsubscribes or otherwise withdraws it. You still have to keep proof of how and when you got it, because the sender has the burden of proving consent.

    Is a pre-checked box valid consent under CASL?

    No. CRTC guidance says express consent needs a positive action from the person, such as ticking an empty box or typing their email into a sign-up field. A box that is ticked by default, which the person has to untick, does not count.

    Can I email someone to ask for their consent?

    Only if you already have consent to email them. The Act treats a message asking for consent as a commercial electronic message itself. That is why you should ask for express consent while implied consent is still valid.

    Is a business card enough for CASL consent?

    It can give you implied consent, if the person handed over the address without saying they did not want messages and your email is relevant to their business role. It is not express consent, and it does not cover unrelated promotions.

    Official sources

    Checked on November 11, 2026: CASL sections 1, 10 and 13, SOR/2012-36 section 4, and SOR/2013-221 sections 3 and 4.

    Want your forms to collect consent properly?

    We add the right checkbox to your booking, quote and contact forms and pass the consent date into your email or CRM tool, so nobody has to remember.

    See AI and workflow automation

    Continue the CASL Guide

    CASL Consent Checker and Compliance Checklist

    Answer two questions to see whether you can email or text someone, and until when. Plus a 13-point checklist tied to the law.

    What Every Commercial Email and Text Needs Under CASL

    Sender details, mailing address, contact and an unsubscribe honoured within 10 business days, with email footer and text templates.

    CASL Fines and Penalties: What the Law Says and What Has Happened

    Penalties up to $1 million for individuals and $10 million for businesses, how amounts are set, real CRTC cases and director liability.