CASL Fines and Penalties: What the Law Says and What Has Happened

"$10 million" is the number that ends up in sales decks. It is real, and it is a ceiling. Section 20(2) of the Act says the purpose of a penalty is to promote compliance, not to punish. That is cold comfort if you are the one paying $200,000, but it does explain why amounts track the size of the problem.

Section 20(3) lists what has to be considered when setting the amount:

• The purpose of the penalty, which is compliance.
• The nature and scope of the violation.
• Any history of earlier violations, undertakings or consent agreements.
• Any financial benefit from the violation.
• The person's ability to pay.
• Whether they voluntarily compensated anyone affected.
• Any other relevant factor.

A case can also end in an undertaking, where the business agrees to pay an amount and fix its practices. Two of the four cases below ended that way. There is a three-year limitation period, counted from when the subject matter became known to the person designated to investigate (section 23).

• The business that sent, or caused or permitted the sending. The prohibition in section 6 covers all three, so hiring someone else to send does not move the problem.
• Employers, for employees and agents. A business is liable for violations by its employees acting in the scope of their job, and by agents acting within their authority (sections 32 and 53).
• Directors and officers. They are liable if they directed, authorized, assented to, acquiesced in or participated in the violation (sections 31 and 52).

The main defence is due diligence: showing you took reasonable steps to prevent the violation (sections 33 and 54). In practice, that looks like consent records, a tested unsubscribe, and someone who knows which automations are running.

CASL was drafted with a private right of action in sections 47 to 51, which would have let people take senders to court. It never came into force. The consolidated Act now lists those sections as repealed before coming into force under the Statutes Repeal Act, in the version in effect from January 1, 2026.

So if you see a page warning that CASL class actions are "coming soon", it is out of date. The risk is CRTC enforcement, not a lawsuit from a customer.

A CASL violation is not an offence (section 30). Separate offences exist for obstructing an investigation, giving false or misleading information to an investigator, or ignoring a preservation demand or notice to produce (sections 42 and 43). Those carry court fines of up to $10,000 for a first offence by an individual and $100,000 for anyone else, rising to $25,000 and $250,000 for later offences (section 46).

• Only send marketing to people you can show consent for. The consent checker sorts out the dates.
• Test your unsubscribe link every few months, from a real inbox, all the way through.
• Make sure one unsubscribe reaches every tool that sends: newsletter, CRM, booking reminders and texts.
• Keep consent records. The burden of proof is on the sender.
• If the CRTC writes to you, take it seriously. Gap received a warning letter in 2018, three years before its $200,000 payment.