CASL, Canada's Anti-Spam Legislation, is a law requiring consent before sending most commercial electronic messages to recipients in Canada, along with clear sender identification and an easy way to unsubscribe.
The Reverse of What US Stores Are Used To
What is CASL doing differently from the CAN-SPAM Act that most US-based store owners already know: it flips the default. CAN-SPAM assumes permission to email unless someone opts out. Canada anti-spam legislation assumes the opposite, that sending requires permission upfront, before the first message ever goes out. A store used to CAN-SPAM’s more permissive baseline can end up sending to Canadian subscribers without realizing an entirely different legal standard applies to them specifically, simply because the two laws share a similar surface-level purpose while working from opposite starting assumptions.
The Implied Consent Trap
CASL consent comes in two forms, and understanding the gap between them matters more than it first appears. Express consent is unambiguous: someone actively checked a box or submitted a form specifically agreeing to receive email. Implied consent is murkier, based on an existing business relationship such as a recent purchase, and it comes with an expiration date CASL sets explicitly, typically two years from the triggering transaction unless renewed. A store relying on implied consent without tracking when that window closes can end up continuing to email someone whose implied permission has technically already lapsed.
What CASL Actually Requires in Practice
CASL requirements break down into three parts: consent obtained before the first send, clear identification of who’s sending the message along with contact information, and a functioning unsubscribe mechanism processed within 10 business days. None of these are unusual on their own, but the consent requirement specifically is where CASL compliance most commonly breaks down for stores expanding into the Canadian market without adjusting their existing US-focused signup flow. Getting CASL compliance right from the start avoids the far more expensive process of fixing a non-compliant list after the fact.
Why This Law Gets Taken More Seriously Than Most
CASL carries some of the steepest maximum penalties of any commercial email law in North America, up to 10 million Canadian dollars for a corporation found in violation. That figure alone is a large part of why CASL compliance gets treated with more caution than CAN-SPAM by companies operating in both countries, even though the practical day-to-day requirements aren’t dramatically more complex. The gap isn’t really about difficulty, it’s about how much room for error the consent-first requirement leaves compared to CAN-SPAM’s more permissive opt-out model. A store that’s used to CAN-SPAM’s standard has to actively unlearn that default when a Canadian subscriber enters the picture, rather than assuming the same signup flow covers both.
Related terms:
Adflipr’s signup forms include consent checkboxes that help stores collect the express consent CASL requires before adding a new contact to a list.
