Is CASL still actively enforced in 2026?

Yes. The CRTC continues to investigate complaints and issue Notices of Violation. Enforcement has shifted toward technical violations (consent records, identification, unsubscribe mechanisms) and away from purely volumetric complaints, which means even compliant-looking programs can be cited if record-keeping is weak.

What about US senders sending to Canadian recipients?

CASL applies to messages sent to a Canadian recipient regardless of sender location. US-based businesses with Canadian customers must comply with CASL for those Canadian sends. Many ESPs offer geo-segmentation features that allow CASL-compliant sending to Canadian segments while different rules apply to other geographies.

How does CASL interact with PIPEDA?

Different frameworks, overlapping requirements. PIPEDA governs how you collect and use personal information; CASL governs how you send commercial electronic messages. A compliant marketing program addresses both — the consent collected at form-fill must satisfy PIPEDA's purpose-identification standard, and any messages sent based on that consent must satisfy CASL.

Are SMS marketing campaigns subject to CASL?

Yes. SMS is a CEM under CASL. The same consent, identification, and unsubscribe rules apply, with the practical adaptation that SMS unsubscribe is typically handled via STOP keyword reply (which most SMS providers support natively).

What about cold B2B email outreach (sales prospecting)?

CASL applies. Cold outreach to a prospect with no prior business relationship requires either implied consent (narrow exceptions like conspicuously-published business addresses for role-relevant outreach) or express consent. Most pure cold-email programs operating at scale operate in a CASL grey zone; many face CRTC complaints when they scale aggressively.

Do I need separate consent for transactional vs marketing emails?

Pure transactional messages (receipts, password resets) don't require CASL consent. Marketing-augmented transactional messages (order confirmation that also pitches new products) need CASL consent for the marketing portion. The cleanest pattern: keep transactional and marketing messages structurally separate, and obtain explicit marketing consent at the appropriate touchpoint.

CASL Email Marketing Compliance for Canadian Businesses (2026 Guide)

The compliance position in one paragraph

CASL (Canada's Anti-Spam Law) governs every Commercial Electronic Message (CEM) sent to a Canadian recipient — meaning email, SMS, and most messaging-app marketing. Three things determine compliance: valid consent (express or specific narrow implied consent), correct sender identification (legal entity, mailing address, contact mechanism), and a working unsubscribe (functional within 10 business days, no requirement to log in or pay). Most Canadian businesses have weak record-keeping, which is the failure mode that loses the audit. Penalties are real: up to C$10M per violation for organizations. The good news: compliant programs perform within 5–10% of non-compliant ones in the metrics that matter (open rate, click rate, revenue per send), and often better in long-run sender reputation. This guide is informational, not legal advice — consult Canadian counsel for your specific situation.

What CASL actually applies to

CASL applies to Commercial Electronic Messages (CEMs) sent to or from Canada. The definition is broad: any electronic message that has as one of its purposes encouraging participation in a commercial activity. The scope catches more than most marketing teams realize:

Marketing emails to prospects
Newsletters, promotional emails, drip campaigns, abandoned-cart sequences, re-engagement campaigns. All clearly CEMs.
Marketing-flavoured transactional emails
Order confirmation that also says 'check out our new collection' is partly transactional, partly CEM. The CEM portion needs CASL compliance.
B2B emails with commercial purpose
B2B isn't exempt from CASL. The 'business-to-business' exception applies only to messages between organizations with an existing business relationship and only for messages directly relevant to the recipient's role.
SMS and messaging-app outreach
Text messages and most messaging platforms are CEMs when commercial. The same consent rules apply.
Social-media direct messages used for outreach
Cold DMs on LinkedIn that pitch products are CEMs. The platform doesn't change the regulation.

What CASL exempts (narrowly)

A few categories of message are exempt from the CASL consent requirement, but the exemptions are narrower than most marketing teams assume. The exemptions stop applying as soon as a message has any commercial purpose layered onto it.

Pure transactional emails (exempt)
Receipts, order confirmations without marketing content, password resets, account notifications. Not CEMs if they don't promote commercial activity.
Pure relationship messages (exempt)
Replies to inquiries, fulfilment notifications without upsell. The marketing portion would need consent; pure relationship doesn't.
Charity / political / referendum-related (exempt)
Different rules apply. Don't assume your nonprofit operations are exempt without checking — quasi-commercial activities still trigger CASL.

Express vs implied consent

CASL recognizes two consent forms. Most marketing teams over-rely on implied consent and create unnecessary risk. The right default is to build for express consent and treat implied consent as a narrow legal carve-out, not a marketing strategy.

Express consent (best practice)
Recipient has explicitly opted in via a clearly-worded, unchecked opt-in mechanism. Documented with timestamp, source, and exact wording presented at opt-in. Does not expire (until withdrawn).
Implied consent — existing business relationship
Recipient has a transactional relationship with you within 24 months (purchase, contract, etc.) or made an inquiry within 6 months. Implied consent expires; track the windows.
Implied consent — non-business relationship
Recipient has had a non-business interaction within 24 months (volunteering, gift, donation). Narrow, carefully scoped.
Implied consent — published business address
If a recipient's email is conspicuously published (company website, business card given in a relevant context) without a 'no unsolicited email' notice, you can email them once if it's relevant to their professional role. This is narrow and frequently abused; treat it as a single-message permission, not an ongoing consent.

If a regulator can't reconstruct exactly when, where, and how a recipient consented to receive your messages, you don't have valid consent — you have a hope you'll never need to prove it.

— Martin Vassilev, founder, Toronto SEO

Sender identification requirements

Every CEM must clearly identify the sender. The required elements are non-negotiable and easy to miss in template work:

Sender's legal name
The legal entity sending the message. If sending on behalf of another organization (agency or affiliate scenario), both must be identified.
Mailing address
Current physical mailing address valid for at least 60 days after the message is sent. Email-only addresses don't qualify.
One additional contact mechanism
Phone number, email address, or web address. The recipient needs at least one way to contact the sender beyond the message itself.
Identification visible in the message
Footer is acceptable. Linked-only identification (where the user has to click through to find the sender info) is not.

The unsubscribe mechanism

CASL requires a working unsubscribe in every CEM. The requirements are specific:

Free, no login required
The recipient cannot be required to create an account, log in, or pay anything to unsubscribe. One-click or single-form unsubscribe is the standard.
Functional within 10 business days
Unsubscribe requests must be honoured within 10 business days. Most modern ESPs honour them within seconds; build the workflow for the legal requirement and exceed it operationally.
Active for at least 60 days
The unsubscribe link must remain active for at least 60 days after the message is sent. Use stable, time-independent unsubscribe URLs.
Specific to the message and the sender
If you operate multiple email programs from the same legal entity, an unsubscribe from one may not apply to all (depending on how consent was scoped at opt-in). The cleaner pattern: unify unsubscribe across all marketing from the same entity, with a preference center for granular opt-out.
No 'unsubscribe will take 5 days' delays
10 business days is the legal ceiling, not a target. Aim for instant unsubscribe via API integration.

Record-keeping that defends you in an audit

CASL audits are rare but consequential. The single most common failure mode is inability to prove consent for specific recipients. The records that defend you:

Per-recipient consent log
For each subscriber: timestamp of consent, source (form name, URL, campaign), exact opt-in wording presented, IP address (where reasonable to capture). Most modern CRMs log this automatically when properly configured.
Form / source archive
Snapshots of every opt-in form, landing page, or mechanism used to obtain consent. If you change the consent language, archive the previous version with the date range it was active.
Implied-consent expiry tracking
If you rely on implied consent (existing business relationship, inquiry-based), track the expiry date. Auto-suppress the recipient when implied consent ages out, unless you've moved them to express consent meanwhile.
Unsubscribe processing log
Date received, date processed, action taken. Most ESPs log this; ensure it's exportable on demand.
3-year retention minimum
Records of consent and processing should be retained for at least 3 years (longer if practical). The CRTC has audited several years back in major investigations.

Compliant email patterns that perform

CASL compliance and email performance are not in tension. The patterns that protect you also tend to protect your sender reputation, which improves deliverability and engagement:

Single-purpose opt-in forms
One form per consent context. The 'newsletter signup' is not also the 'product update signup' is not also the 'partner-offer signup'. Each is a distinct opt-in.
Preference center, not all-or-nothing unsubscribe
Recipients who want fewer emails should be able to choose categories instead of unsubscribing entirely. Reduces churn and improves engagement on remaining sends.
Welcome sequence that re-confirms expectations
First email in a sequence reminds the recipient what they signed up for and how to manage preferences. Reduces spam complaints and unsubscribe rates downstream.
Re-engagement before sunset
Recipients who haven't engaged in 6–12 months get a re-engagement campaign before being suppressed. Better for sender reputation and CASL hygiene simultaneously.
Honest 'from' name and subject line
CASL also prohibits misleading sender identity and misleading subject lines. The compliant brand-and-purpose pattern is also the high-trust pattern.

What enforcement actually looks like

CASL enforcement is concentrated on egregious violators rather than minor technical gaps, but enforcement does happen and the penalties are meaningful:

Maximum penalty per violation
Up to C$1M per violation for individuals, C$10M for organizations. Penalties for major violators have been in the C$50K–C$1.5M range historically.
CRTC investigation triggers
Multiple complaints about the same sender, sender showing up in spam-trap data, or pattern of complaints across recipients. Single complaints rarely trigger investigation.
Private right of action
CASL also permits civil suits by recipients for non-compliance, with statutory damages provisions. The federal government suspended this provision but it could be reactivated.
Reputation damage
Even where the regulatory penalty is modest, the reputational cost of being publicly named in a CRTC enforcement action is significant. Compliance is partly an operational discipline and partly a brand-defense investment.