CASL
Canada's Anti-Spam Legislation
Canada's anti-spam and electronic consent law
CASL regulates the sending of commercial electronic messages (CEMs) — emails, texts, and social media messages — to Canadian recipients. It requires express or implied consent, sender identification, and an easy unsubscribe mechanism in every commercial message. CASL is one of the strictest anti-spam laws in the world, with per-message penalties up to $1M for businesses.
Who must comply with CASL?
Any person or organization that sends commercial electronic messages to Canadian electronic addresses must comply with CASL — regardless of where the sender is located. Foreign businesses emailing Canadian customers are subject to CASL enforcement.
Not sure if CASL applies? Run a free assessment →
Key obligations under CASL
Express or Implied Consent
Obtain express consent before sending CEMs unless an implied consent exception applies (existing business relationship, etc.).
Clear Sender Identification
Every CEM must identify the sender by name, mailing address, and a phone/email/web contact that remains valid for 60 days.
Functional Unsubscribe
Every CEM must include an unsubscribe mechanism that works within 10 business days at no cost to the recipient.
Consent Records
Maintain records of how, when, and where you obtained consent for every subscriber. The burden of proof is on the sender.
Express Consent Expiry
Express consent does not expire unless withdrawn. Implied consent (existing relationship) expires after 2 years from the last transaction.
Software Installation Rules
Separate consent rules apply for installing programs, apps, or software updates on another person's device.
Penalties & enforcement
Kellogg Canada paid $60K after sending promotional emails without proper unsubscribe functionality (2019)
Run a free CASL gap assessment
Answer 47 questions, get a scored gap report, and see exactly what you need to do to comply with CASL — in under 3 hours. Free forever.
Start free assessment