What is CASL (Canada's Anti-Spam Legislation)?
Definition
CASL (Canada's Anti-Spam Legislation) is the federal law that governs commercial electronic messages, such as marketing emails and texts, sent to or from Canada. It generally requires the recipient's consent, clear identification of the sender and a working unsubscribe mechanism in every message.
Last updated 2026-10-18 · Flowmatix
How CASL works
CASL applies to any commercial electronic message (CEM): an email, text or direct message that encourages someone to buy, hire or invest. Before sending one, you need consent, and that consent comes in two forms.
Express consent is a clear opt-in, such as a person ticking an unticked box that says they want your newsletter. It does not expire unless withdrawn. Implied consent arises from certain relationships set out in the law. Under section 10 of the Act, a purchase creates an existing business relationship for two years, while an inquiry or application creates one for six months. The CRTC's guidance on implied consent explains these categories in more detail.
Every CEM must also identify the sender, include contact information and offer an unsubscribe mechanism. Section 11 requires unsubscribe requests to be honoured without delay and no later than 10 business days.
Example: a landscaping company emails last summer's customers about spring clean-ups. Those who bought within the past two years fall under implied consent. People who only requested a quote eight months ago do not, unless they opted in.
Why it matters for your business
Penalties are serious. Section 20 of the Act sets maximum administrative penalties of $1,000,000 per violation for individuals and $10,000,000 for businesses and other organisations. Beyond fines, CASL-compliant lists tend to be healthier lists: people who agreed to hear from you open more and complain less, which also helps email deliverability.
This is general information, not legal advice. For a practical walkthrough, read our plain-English CASL guide for small businesses.
Common mistakes
- Using pre-ticked consent boxes or bundling marketing consent into terms of service.
- Failing to record when, where and how each person gave consent.
- Treating implied consent as permanent instead of tracking its expiry dates.
- Importing purchased lists or contacts collected from business cards without confirming consent.
- Letting unsubscribes sit in a separate tool that never syncs with the sending platform.
Frequently asked questions
Does CASL apply to businesses outside Canada?
It can. CASL covers commercial electronic messages accessed by recipients in Canada, so foreign businesses emailing Canadians should plan to comply.
Are transactional emails covered by CASL?
Messages such as receipts, order confirmations and service updates are largely exempt from the consent requirement, but adding promotional content to them can change that.
Can I email business contacts whose addresses I found online?
Only in narrow cases. Implied consent can apply when someone has conspicuously published their address, has not said they refuse marketing messages, and your message relates to their business role. Keep a record of where each address came from.
How Flowmatix can help
Our email marketing work puts this into practice for businesses in Toronto and around the world. Get a personalised quote in about 3 minutes.
Related terms
Ready to see what your project costs?
Answer a few questions and get a personalised plan, a comparison with typical market prices, and a clear next step. No obligation, no sales pressure.