CASL rules for emails: the checklist for Canadian small businesses

Canada's Anti-Spam Legislation, usually called CASL, is stricter than the US rules most email software is built around. The good news is that the rules for email fit on one page. This checklist turns the Act, the CRTC's regulations and the CRTC's own FAQ into twelve checks you can run on any newsletter, promotion or follow-up before it goes out.

What are the CASL rules for emails?

Section 6 of the Act sets three requirements for any commercial electronic message. The CRTC summarizes them the same way in its CASL FAQ: obtain consent, provide identification information, and provide an unsubscribe mechanism. Miss any one and the message breaks the law, even if the other two are perfect.

Checked October 2026 against the Act, the CRTC regulations and the CRTC FAQ. General information, not legal advice.

What counts as a commercial electronic message?

Under section 1(2) of the Act, a message is commercial if, looking at its content, its links or its contact information, it would be reasonable to conclude one of its purposes is to encourage participation in a commercial activity. A newsletter with a "book now" button counts. So does a "we miss you" email with a discount code.

Some messages are exempt from the consent rule but still need identification and an unsubscribe. Section 6(6) lists them, including a message that only provides a quote or estimate the person asked for, or one that only confirms or completes a transaction they already agreed to. Keep those messages strictly factual; adding a promotion turns them back into ordinary commercial messages.

What is the difference between express and implied consent under CASL?

Express consent is a clear yes to receiving your messages. The request must be sought separately and must include the purpose, who is asking, a mailing address and a phone, email or web contact, and a statement that the person can withdraw. The CRTC says you cannot use a pre-checked box; silence or inaction is not consent. Express consent does not expire until the person unsubscribes. Our express consent guide includes a seven-point form check.

Implied consent comes from a relationship and runs on a timer. A purchase or contract gives you two years from the transaction; an inquiry or application gives you six months. It also covers business addresses that are conspicuously published, when your message relates to the person's role, and addresses someone gives you directly, such as on a business card, unless they say they do not want messages. Our implied consent guide has a timer you can use. Practical tip: ask implied-consent contacts for express consent before the clock runs out.

What must every CASL compliant email include?

The CRTC's Electronic Commerce Protection Regulations spell it out. Every commercial email must show:

• The name you do business under, and the name of anyone you are sending on behalf of.
• A mailing address, plus a telephone number with access to an agent or voicemail, an email address or a web address.
• An unsubscribe mechanism, set out clearly and prominently and able to be readily performed.

If it is not practical to put all of this in the message, for example in a short text, the regulations allow a link to a web page with the information, as long as the page is readily accessible at no cost. The contact details must stay valid for at least 60 days after you send.

How fast must you process an unsubscribe under CASL?

Without delay, and in any event within 10 business days of receiving the request, under section 11(3) of the Act. The unsubscribe link or address must keep working for at least 60 days after the message was sent, and it must cost the person nothing to use. The CRTC's FAQ repeats the same 10 business day limit.

Treat 10 business days as the outer limit, not the target. Most email platforms process unsubscribes instantly. The risk is in the side doors: a customer who replies "stop" to a text, a client who asks your office manager by phone, or a list exported to another tool before the request came in. Write down who removes those, and check monthly.

What are the penalties for breaking CASL?

The maximum administrative penalty is $1,000,000 for an individual and $10,000,000 for any other person, such as a business, per violation under section 20(4). The Act states that the purpose of a penalty is to promote compliance, not to punish, and lists factors the CRTC must weigh, including the nature and scope of the violation, previous history, any financial benefit and the person's ability to pay. The practical lesson: keep records. The CRTC notes there is no prescribed period for keeping consent records, so keep them as long as you keep emailing the person.

Does CASL apply to texts and to emails sent from outside Canada?

Yes to both. The CRTC's FAQ says commercial messages sent by text message are covered because they go to an electronic address, and messages sent to recipients in Canada from another country must also comply. That matters if you use a US-based email or texting tool: the tool's settings do not make you compliant, your consent records and message content do. For text-specific rules see review request text templates and missed-call text back templates; for industry examples see CASL for HVAC companies and CASL for law firms. If you are choosing software, our AI tools for small business in Canada list notes which tools send messages for you.

Government background is on the federal fightspam page maintained by Innovation, Science and Economic Development Canada.