Email Marketing in Canada: A Plain-English CASL Guide for Small Businesses

The short answer

Under Canada's Anti-Spam Legislation, commercial emails generally need consent (express or, in limited cases, implied), must identify who sent them with contact details, and must include a working unsubscribe mechanism that's honoured promptly. Keep records of how you got consent. This article is general information, not legal advice.

Express vs implied consent

Express consent is a clear opt-in — for example, an unticked checkbox the person chooses to tick. Implied consent can arise in limited situations, such as an existing business relationship, and generally expires after a set period. Express consent is the safest foundation for a marketing list.

What every marketing email needs

• Your business name and contact information
• A clear, working unsubscribe link
• Unsubscribes honoured promptly

Building a compliant list

Use unticked opt-in checkboxes on forms, explain what people will receive, keep a record of when and how each person consented, and never buy email lists.

Transactional vs marketing messages

Messages that complete a transaction or respond to a request — such as sending a requested quote — are treated differently from promotional messages. When in doubt, get express consent.

Frequently asked questions

Can I email people who gave me their business card?

Possibly, in limited circumstances — but express consent is far safer. Check CASL guidance or get legal advice.

Do I need a double opt-in?

CASL doesn't strictly require it, but it improves list quality and provides clear evidence of consent.

Does CASL apply to text messages and social media messages?

Yes. CASL covers commercial electronic messages, which includes SMS and direct messages on social platforms as well as email. The same principles apply: get consent, identify yourself and give people an easy way to unsubscribe. Automated review requests or promotional texts should follow the same consent rules as your email list. This is general information, not legal advice.

What records should I keep to prove consent?

For each contact, record when and how they consented, the form or source, and the wording they agreed to. Most email platforms store sign-up date and source automatically; keep copies of your form wording too, since it changes over time. For consent given in person or by phone, note it in your CRM at the time. Clear records are your evidence if a complaint arises.

Who enforces CASL, and what happens if a business breaks it?

The CRTC is the main enforcement agency, and it can investigate complaints and issue administrative monetary penalties. In practice, most small businesses avoid trouble by using express consent, honouring unsubscribes promptly and never buying lists. If you're unsure whether a message or list complies, get legal advice before sending. This article is general information, not legal advice.

How Flowmatix can help

We put this into practice for businesses in Toronto and around the world through our Email Marketing & Newsletters, marketing automation services. Want to know what it would take for your business? Get a personalised quote in about 3 minutes.