If your store has even a handful of customers in Canada, CASL laws apply to your emails, regardless of where your business is based. CASL, short for Canada’s Anti-Spam Legislation, is generally considered one of the stricter sets of email rules in the world, and getting the basics wrong can carry real financial risk.
Quick answer: CASL requires proper consent, clear sender identification, and an easy unsubscribe on every commercial email sent to Canada. It applies based on the recipient’s location, not yours. This is a practical overview, not legal advice.
Understand What Counts as a Commercial Electronic Message
CASL regulates what it calls commercial electronic messages, or CEMs, a broad category covering any electronic message that encourages participation in a commercial activity. Marketing emails, promotional newsletters, and sale announcements all fall under this part of casl law. Purely transactional messages, like order confirmations or shipping updates with no promotional content, are generally treated differently, though they still need basic sender identification.
A few message types are commonly treated as exempt from the full consent requirement, though they still need to meet basic identification and unsubscribe rules:
- Transactional confirmations, such as receipts, shipping updates, and order status changes
- Warranty information, product recalls, and safety notices
- Factual updates about an existing account, subscription, or membership the recipient already has
One common misconception worth correcting directly: CASL applies to B2B email too. Sending to a business contact instead of a consumer does not exempt you from consent requirements, even though the message is going to a work address.
Get the Right Kind of Consent
CASL recognizes two types of consent, and knowing which one applies to a given contact matters for how long you can keep emailing them.
- Express consent: the subscriber clearly opted in, usually through an unchecked opt-in box or a clear sign-up action. This does not expire under CASL, though good list hygiene practices still apply.
- Implied consent: created through an existing business relationship, such as a recent purchase, or through an inquiry. Implied consent is time-limited, commonly cited as around two years for an existing business relationship and six months for a general inquiry, and needs to be renewed or converted to express consent before it lapses.
Default to express consent wherever possible. It is the stronger, more durable form of consent and removes the guesswork around expiry dates that implied consent requires.
Include the Required Message Elements
Every commercial electronic message sent under CASL needs to clearly identify who sent it. At minimum, this generally includes:
- The name of the business sending the message
- A valid contact method, such as an email address, phone number, or mailing address
- A clear, working unsubscribe mechanism
Skipping any of these is one of the most common and most avoidable gaps in CASL compliance, since most email platforms can handle this automatically if configured correctly.
Build an Unsubscribe Process That Actually Works
CASL requires that unsubscribing be simple and fast. The unsubscribe link should work without requiring the recipient to log in, provide a reason, or complete more than one step. Once someone unsubscribes, the request generally needs to be honored promptly, not left pending for weeks.
- No login required to unsubscribe
- No extra information needed beyond confirming the request
- Process the unsubscribe promptly, not on a delayed schedule
- Keep the unsubscribe mechanism functional for at least 60 days after the message was sent
Keep Records of Consent
Being able to show how and when a subscriber consented is part of practical compliance with CASL, particularly if a complaint or audit ever comes up. A commonly cited practice is retaining consent records for at least three years after the business relationship ends, which covers most realistic complaint or audit windows. Most modern email marketing platforms log this automatically, including the signup source and timestamp, which is far more reliable than trying to reconstruct consent history manually later.
How CASL Compares to GDPR and CAN-SPAM
Stores selling internationally often need to comply with more than one email law at once, and the differences between them trip people up more than any single law’s requirements do on their own.
| Feature | CASL (Canada) | GDPR (EU) | CAN-SPAM (US) |
|---|---|---|---|
| Consent model | Opt-in required (express or implied) | Opt-in required, generally stricter than CASL | Opt-out is sufficient |
| Applies based on | Recipient location | Recipient location | Recipient location |
| Unsubscribe requirement | One step, no login, processed promptly | Must be as easy as subscribing | Must be honored within 10 business days |
| Maximum penalty | Up to $10 million CAD per violation | Up to 4% of global annual revenue | Up to $53,088 USD per email as of recent guidance |
The practical takeaway for a store selling across all three regions: default to the strictest applicable standard, which usually means treating every contact as requiring express opt-in consent, rather than trying to apply a different standard to each segment of your list based on where they happen to live.
What Happens If You Don't Comply
CASL enforcement is handled by the Canadian Radio-television and Telecommunications Commission, along with the Competition Bureau and the Office of the Privacy Commissioner, depending on the specific violation. Penalties can reach up to $10 million CAD per violation for businesses and $1 million CAD for individuals, though most real enforcement actions against small and mid-sized senders land well below that maximum, often in a range that still represents a meaningful cost for a growing ecommerce store.
Enforcement typically starts with a complaint, either from a recipient directly or through Canada’s spam reporting system. A single complaint rarely triggers an immediate penalty, but a pattern of complaints, combined with genuinely non-compliant practices like missing unsubscribe links or expired implied consent, is what tends to draw real scrutiny.
The practical risk isn’t just the fine itself. A CASL investigation, even one that doesn’t result in a penalty, still costs time, legal fees, and the disruption of having to document your entire consent history under pressure. Building compliant practices into your sending process from the start avoids all of that, regardless of whether an actual complaint ever comes in.
A Quick CASL Compliance Checklist
- Confirm whether each Canadian contact has express or implied consent, and track expiry dates for implied consent
- Include business name, contact information, and a working unsubscribe link in every commercial message
- Make unsubscribing a one-step process with no login required, and keep it functional for at least 60 days
- Process unsubscribe requests promptly, not on a delayed schedule
- Keep records showing how and when consent was obtained, retained for at least three years
- When in doubt, default to express consent instead of relying on implied consent
- Don’t assume B2B messages are exempt from consent requirements
Key Takeaways
- CASL applies based on the recipient’s location in Canada, regardless of where your business operates
- Express consent is stronger and does not expire, unlike time-limited implied consent
- Every commercial email needs clear sender identification and contact information under casl law
- Unsubscribing must be a simple, one-step process with no login required
- Keeping consent records protects your store if a complaint or audit ever comes up
- If you sell internationally, default to the strictest standard across CASL, GDPR, and CAN-SPAM rather than mixing rules
- Penalties can reach $10 million CAD per violation, but the bigger real cost is often the time and legal fees of an investigation itself
- Run through the quick checklist regularly, not just once when you first set up sending
Final Thoughts
Staying on the right side of CASL laws is mostly a process problem, not a legal mystery, once you understand the difference between express and implied consent and build a clean unsubscribe flow. This overview covers the practical basics, but for guidance specific to your business, talk to a lawyer familiar with CASL. Our glossary entry on CASL covers the core definition in brief, and Adflipr’s anti-spam policy outlines how sending compliance works on the platform. The unsubscribe mechanism CASL requires is the same one covered in our guide on unsubscribe footer best practices.
FAQs
Yes. CASL applies based on where the recipient is located, so any business emailing Canadian contacts needs to comply.
Express consent comes from a clear opt-in and does not expire. Implied consent comes from an existing relationship and is time-limited.
Clear identification of the sender, valid contact information, and a working, easy-to-use unsubscribe mechanism.
No. CASL requires unsubscribing to be simple, generally without requiring a login or extra information from the recipient.
Purely transactional messages are treated differently from promotional ones, but they should still clearly identify your business.
No. This is a practical overview of CASL laws. Confirm specific obligations for your business with a qualified lawyer.
Both require opt-in consent, but GDPR is generally stricter and carries penalties up to 4% of global annual revenue, versus CASL’s per-violation cap.
Default to the strictest applicable standard, which usually means treating every contact as requiring express opt-in consent regardless of location.
The Canadian Radio-television and Telecommunications Commission, along with the Competition Bureau and the Office of the Privacy Commissioner, depending on the violation.
A pattern of recipient complaints combined with genuinely non-compliant practices, like missing unsubscribe links or expired implied consent, rather than a single isolated complaint.
No. Sending to a work email address does not exempt a message from CASL’s consent requirements, even though the recipient is a business contact.
A commonly cited practice is retaining records for at least three years after the business relationship ends, covering most realistic audit windows.
