The Canadian emailing law | The law and emailing in Canada

One of the strictest anti-spam regimes in the world

Commercial email to Canadian recipients is governed by Canada's Anti-Spam Legislation, commonly called CASL (S.C. 2010, c. 23), whose main provisions took effect on 1 July 2014. Its central rule is short: you may not send a commercial electronic message to an electronic address unless the recipient has consented, and the message meets the required content standards.

CASL matters even if your business is not Canadian. Messages received in Canada must comply, and the law generally reaches any commercial message sent using a computer system located in Canada. If your list contains Canadian subscribers, CASL applies to you.

Express consent and implied consent are not the same thing

CASL recognises two kinds of consent, and the difference is where most senders get into trouble. Express consent is an opt-in the recipient actively gives — and, contrary to a widespread myth, it does not expire. It lasts until the person withdraws it.

Implied consent is narrower and it does expire. It arises mainly from an existing business relationship, an existing non-business relationship, or a conspicuously published business address. The clocks are specific: two years from a purchase, lease, contract or comparable transaction, and six months from an enquiry or application. When the clock runs out, so does your right to email that person.

Conspicuous publication is narrower still. An address only qualifies if the person published it themselves, did not accompany it with a statement refusing unsolicited messages, and your message is relevant to their business role or duties. Publicly visible is not the same as conspicuously published, and scraping addresses does not create consent.

What every message must contain

Three requirements apply to each commercial electronic message. It must identify you as the sender — and, where you are sending on someone else's behalf, identify them too. It must include a mailing address plus at least one of a telephone number, an email address or a web address, and that contact information must stay valid for at least 60 days after sending. And it must carry an unsubscribe mechanism that costs the recipient nothing, is readily performed, and is acted on no later than 10 business days after they use it.

Note the detail that trips people up: the deadline is ten business days, and the statute also requires the request to be given effect "without delay" — so ten days is an outer limit, not an allowance. A mailing address is mandatory; a web form alone does not satisfy the rule.

Penalties and who enforces them

Breaching CASL exposes a sender to administrative monetary penalties of up to CAD 1 million per violation for an individual and up to CAD 10 million for a business. Directors and officers can be held personally liable where they authorised or acquiesced in the breach, and employers are liable for employees acting in the course of their work. A due diligence defence is available.

Three bodies share enforcement. The CRTC handles the consent, identification and unsubscribe rules. The Competition Bureau deals with false or misleading representations, including deceptive subject lines. The Office of the Privacy Commissioner covers address harvesting and the collection of personal information through unauthorised access.

One point worth correcting, because most articles online still get it wrong: CASL's private right of action was never brought into force, and the provisions that would have created it were repealed at the end of 2025. Enforcement today is regulatory only. That is not a reason to relax — it simply means the risk comes from the regulators rather than from class actions.

CASL is not Canada's privacy law

CASL governs the act of sending. The Personal Information Protection and Electronic Documents Act (PIPEDA) separately governs how you collect, use and disclose the personal information behind your list, and it remains Canada's federal private-sector privacy statute. Satisfying one does not discharge the other. Proposals to replace PIPEDA have been introduced more than once without passing, so plan against the law as it stands rather than the law as announced.