CASL Explained for Canadian Businesses: How to Run Email, SMS and Lead Generation Without Breaking the Law
Canada's anti-spam law is stricter than most owners realize and the CRTC is actively fining small businesses. Here is what CASL requires for email, text and lead follow-up, how consent really works and how to stay compliant while still growing.
Why this matters more than you think
Canada's Anti-Spam Legislation (CASL) has been in force since 2014, and it remains one of the strictest anti-spam laws in the world. (Innovation, Science and Economic Development Canada ISED) Unlike the US CAN-SPAM Act, which lets you email until someone opts out, CASL requires consent before you send. The CRTC, which enforces it, logged more than 150,000 spam complaints in a single six-month stretch of 2025 and continues to issue penalties to businesses of every size, from a few thousand dollars for small operators to hundreds of thousands for larger campaigns. The statutory maximum is CAD $1 million per violation for an individual and $10 million for a business. (Canadian Radio-television and Telecommunications Commission CRTC)
Most violations we see are not malicious. They are a contractor who bought a list, a clinic that added every past patient to a newsletter, or a sales team texting cold leads. This guide covers what the law requires and how to build lead generation that grows within it.
What CASL covers
CASL governs commercial electronic messages (CEMs): any electronic message (email, SMS, social direct messages, some in-app messages) whose purpose, or one of whose purposes, is to encourage participation in a commercial activity. Newsletters with offers, promotional texts, follow-up emails pitching services and "just checking in" sales messages are all CEMs. The law also covers installing software and altering transmission data, but for most businesses messaging is what matters. (Canadian Radio-television and Telecommunications Commission CRTC)
It applies whenever a message is sent from or accessed by a computer in Canada. Your US email platform does not exempt you; your Canadian recipients bring you in.
The three requirements
Every CEM must satisfy three conditions.
1. Consent
You need consent before sending. Two kinds exist.
Express consent is a clear, positive action by the recipient: ticking an unchecked box, typing an email into a newsletter form that explains what they will receive, or agreeing verbally with a record kept. It does not expire. Pre-checked boxes, buried terms and "by continuing you agree" language do not count. (Canadian Radio-television and Telecommunications Commission CRTC) Your consent request must state who is asking, that they can unsubscribe at any time, and your contact information.
Implied consent exists in specific situations, for a limited time:
- An existing business relationship: the person bought something, or entered a contract, within the last two years; or made an enquiry or application within the last six months. (Innovation, Science and Economic Development Canada ISED)
- An existing non-business relationship: donations, volunteering or membership within two years.
- Conspicuous publication: the person published their business email address without a statement saying they do not want unsolicited messages, and your message relates to their role. (Canadian Radio-television and Telecommunications Commission CRTC) This is narrow; a director's address on a company site does not license pitches for unrelated products.
- Disclosure: the person gave you their address directly without restriction, and the message is relevant to their business role.
When implied consent expires, so does your right to send. Track the dates.
2. Identification
Every CEM must clearly identify the sender (and anyone on whose behalf it is sent) and include a mailing address plus at least one of a phone number, email address or web address. That contact information must stay valid for 60 days after the message. (Canadian Radio-television and Telecommunications Commission CRTC)
3. Unsubscribe
Every CEM must include a clearly visible, no-cost unsubscribe mechanism that works by the same method as the message (a link in email, a reply keyword in SMS) and takes effect within 10 business days. Requiring a login to unsubscribe is not acceptable.
What is exempt
A few common situations are outside CASL or exempt from the consent requirement:
- Responding to an enquiry. If someone fills out your contact form or requests a quote, answering that request is not a CEM requiring separate consent. Your reply, follow-up about the quote, and reasonable follow-ups on that specific enquiry are fine. This is the exemption most lead-generation activity relies on.
- Transactional messages: receipts, warranty information, delivery updates, account notices, and messages that complete a transaction the recipient already agreed to.
- Messages between people with a personal or family relationship.
- Business-to-business messages between organizations that already have a relationship, where the message concerns that relationship.
- Referrals: a single message to someone referred by a person who has a relationship with both of you, naming the referrer.
Note that even exempt messages still must not be misleading, and identification and unsubscribe are best practice regardless.
Record keeping
You must be able to prove consent. Keep records of how, when and where each consent was obtained (form, page, timestamp, IP, the wording shown) for as long as you continue to contact that person. CASL sets no fixed retention period; the CRTC's guidance is that you must be able to demonstrate consent for every message you send. If you cannot prove it, you do not have it. Most reputable email platforms store this automatically if configured correctly.
Building compliant lead generation
Here is how we structure lead capture and follow-up for clients so growth and compliance work together.
Contact and quote forms. The submission is an enquiry; you may respond and follow up about it. Add an unchecked checkbox: "Yes, send me occasional tips and offers from [Company]. Unsubscribe anytime." Only those who tick it join your marketing list. Everyone else stays in a six-month enquiry window.
Lead magnets and newsletters. The sign-up itself is express consent, provided the form says what they are signing up for and who is sending. Keep the confirmation email and store the record.
SMS follow-up. Texting a lead about their specific enquiry is fine. Adding them to promotional texts requires express consent, and every marketing text needs a STOP mechanism. Missed-call text-backs that respond to a call the person made to you are responsive, not unsolicited.
Past customers. You have implied consent for two years after their last purchase. Use that window to ask for express consent ("Would you like to keep hearing from us?"). After two years without a purchase or express consent, stop.
Purchased or scraped lists. Do not. You cannot inherit consent, and this is the single most common source of penalties.
Sales outreach. Cold email to a business address is only allowed under the conspicuous-publication exemption and only when relevant to the recipient's role. One relevant message to a published address is defensible; sequences to scraped lists are not. LinkedIn messages sent through the platform's own tools are treated differently, but the moment you export addresses, CASL applies.
Referral programs. One introductory message naming the referrer is permitted. After that, you need consent.
A compliance checklist
- Every marketing message identifies your business and includes a mailing address and contact method.
- Every marketing message has a working unsubscribe honoured within 10 business days.
- Opt-in boxes are unchecked by default and explain what the person will receive.
- Consent records (source, wording, timestamp) are stored for three years after the relationship ends.
- Implied-consent dates are tracked and lists are purged when they expire.
- Staff are trained not to add contacts manually or text cold leads.
- Your privacy policy explains what you collect and how it is used, in line with PIPEDA and provincial privacy law.
Beyond CASL
CASL is one layer. Canada's federal privacy law (PIPEDA) and provincial laws (notably Quebec's Law 25, with its own consent and privacy-officer requirements) govern how you collect and use personal information more broadly. If you operate in Quebec, a bilingual privacy policy and Law 25 compliance belong on the same checklist.
This article is general information, not legal advice; for specific situations, consult a lawyer. What we can promise is that every lead-generation system Better Businesses builds is designed around these rules from the start, with consent capture, record keeping and compliant follow-up baked in. If you want your lead generation to grow without a CRTC letter, talk to us.
Sources
- Canada's anti-spam legislation — Innovation, Science and Economic Development Canada (ISED)
- Frequently Asked Questions about Canada's Anti-Spam Legislation | CRTC — Canadian Radio-television and Telecommunications Commission (CRTC)
- Compliance and Enforcement Information Bulletin CRTC 2012-549 | CRTC — Canadian Radio-television and Telecommunications Commission (CRTC)
- Compliance and Enforcement Information Bulletin CRTC 2012-549 PDF version — Canadian Radio-television and Telecommunications Commission (CRTC)
- Getting consent to send email — Innovation, Science and Economic Development Canada (ISED)
- From Canada's Anti-Spam Legislation (CASL) Guidance on Implied Consent | CRTC — Canadian Radio-television and Telecommunications Commission (CRTC)
- Information to be included in a commercial electronic message (CASL infographic) — Canadian Radio-television and Telecommunications Commission (CRTC)
Sources checked September 2026.
Frequently asked questions
- Does CASL apply to small businesses?
- Yes. CASL applies to any person or organization sending commercial electronic messages to or from Canada, regardless of size. The CRTC has fined individuals and small companies as well as large ones, with recent penalties ranging from a few thousand to hundreds of thousands of dollars.
- Can I email someone who filled out my contact form?
- Yes. A person who submits an enquiry has effectively asked you to respond, and responding to that request is not a commercial message requiring separate consent. Adding them to an ongoing marketing list, however, requires either express consent (an unchecked opt-in box) or a qualifying existing business relationship.
- How long does implied consent last under CASL?
- Implied consent from a purchase or contract lasts two years from the transaction. Implied consent from an enquiry or application that did not lead to a purchase lasts six months. After that you need express consent to keep sending.
- What must every marketing email include under CASL?
- Your business name, a mailing address, and a phone number, email address or web address where you can be reached, plus a working unsubscribe mechanism that takes effect within 10 business days. The contact information must remain valid for at least 60 days after sending.
Want help putting this into practice?