- The law
- Canada's Anti-Spam Legislation (CASL), S.C. 2010, c. 23, sections 6 and 10
- Who enforces it
- Canadian Radio-television and Telecommunications Commission (CRTC)
- Penalties
- Up to $1 million per violation for an individual and $10 million for any other person, such as a business.
What it means for your email
- You can't send a commercial email to a Canadian address unless the person has consented, expressly or by implication.
- Express consent is a clear yes, given verbally or in writing. It lasts until the person withdraws it.
- Implied consent comes mainly from an existing business relationship (also some non-business ones, such as donors or members) and is time-limited: 2 years from a purchase, lease or the end of a contract, 6 months from an inquiry or application.
- When you ask for consent, say why you're asking, who is asking (and on whose behalf), give contact details and say the person can withdraw at any time.
- If asked, you must be able to prove consent, so keep records of when and how each person agreed.
Do
- Ask for express consent on sign-up forms and at checkout, in plain words.
- Name your client as well as yourself if you're asking for consent on a client's behalf.
- Track the date of each customer's last purchase or inquiry, so you know when implied consent ends.
- Ask implied-consent customers for express consent before their window closes.
Don't
- Don't email a customer whose last purchase was more than 2 years ago unless they've given express consent.
- Don't treat an inquiry from 7 months ago as permission to market.
- Don't stretch consent beyond what was asked: say plainly what you'll send and who is asking, and if someone only agreed to one kind of email, such as a newsletter, send them only that.
- Don't rely on someone's address being on a website unless your message relates to their job and there was no note saying they don't want commercial messages.
Good to know
- Some messages don't need consent but still need sender details and an unsubscribe: quotes someone asked for, transaction confirmations, warranty, recall and safety information, and factual updates on an account or subscription.
- Messages between people with a personal or family relationship, and a business inquiry sent to a business, are outside these rules entirely.
Sources
- Canada's Anti-Spam Legislation, S.C. 2010, c. 23, sections 1 to 9 (Justice Laws Website, Government of Canada)
- Canada's Anti-Spam Legislation, S.C. 2010, c. 23, sections 10 to 13 (Justice Laws Website, Government of Canada)
- Canada's Anti-Spam Legislation, S.C. 2010, c. 23, section 20 (Justice Laws Website, Government of Canada)
- Electronic Commerce Protection Regulations (CRTC) (SOR/2012-36) (Justice Laws Website, Government of Canada)
- Getting consent to send email (Innovation, Science and Economic Development Canada)
Researched by Mailfois · 2026/27 edition · checked 20 October 2026
Not legal advice. This is a plain-English summary. Check the sources for anything specific, or take professional advice. Spotted something out of date? Email [email protected] and we'll credit you if you'd like.