If a customer ticks a box on your booking form, is that enough to text them a promotion next month? Often yes, but only if the box, the wording and your records all meet the CRTC's tests. Here is what counts as express consent, and a checker for your own opt-in form.
CASL express consent is a clear, proactive opt-in to receive your commercial messages. It must come from an action the person takes, such as ticking an empty box, never from a pre-ticked box or silence. It does not expire, but you must be able to prove it and honour any unsubscribe within 10 business days.
What is CASL express consent?
Canada's anti-spam law, CASL, requires consent before you send a commercial electronic message (CEM). The CRTC guidance defines express consent as a clear agreement, in writing or orally, that the person gives through a proactive action. It must be obtained through an opt-in mechanism. The alternative, implied consent, is inferred from a relationship and runs out. See our page on CASL implied consent and its 2-year and 6-month windows.
What counts as express consent, and what does not?
| How you asked | Express consent? | Why |
|---|---|---|
| Empty checkbox the person ticks | Yes | The CRTC accepts a box the user must check (opt-in) |
| Person types their own email or number into a sign-up field and submits | Yes | The CRTC lists this as an acceptable opt-in |
| Pre-ticked checkbox | No | Presumes consent, so it is an opt-out mechanism |
| Consent buried in general terms and conditions | No | Requests must not be bundled; a person must be able to accept the terms and refuse messages |
| Email or text asking "Can we keep sending you offers?" | No | A message seeking express consent is itself a CEM |
| Spoken "yes, text me deals" at the counter, with a record kept | Yes, if provable | Oral consent is allowed; you carry the burden of proof |
Does my opt-in form pass? A seven-point checker
Express consent form checker
Tick every statement that is true for your sign-up form or counter script. Nothing is saved or sent.
What should the opt-in wording say?
Here is a plain template. Edit the bracketed parts, keep the box empty, and place it away from your terms link.
[ ] Yes, send me [reminders and occasional offers] from [Business name] by [email / text]. You can withdraw consent at any time using the unsubscribe link or by replying STOP. [Business name], [mailing address].
If you collect the same consent by phone, read the same words aloud, log the date and the staff member, and keep the recording or note. The CRTC recommends records such as audio recordings or completed forms because the burden of proof sits with you.
What happens after someone opts in?
Send one short confirmation with no promotion in it, then keep the record. The CRTC says confirmation should be sent to the person whose consent was sought. From then on, every message needs your identity, a way to contact you and a working unsubscribe, and you must act on a request within 10 business days. If you use a text tool or an AI receptionist to send messages, check that STOP replies are processed the same day. For missed-call texting see our missed call text back templates, and for review requests the CASL review request texts.
CASL FAQ
What is CASL express consent?
It is a clear, proactive agreement to receive commercial electronic messages, given in writing or orally. The CRTC says it must be obtained through an opt-in mechanism, and it does not expire. You can keep sending until the person withdraws consent.
Can I use a pre-checked box to get CASL express consent?
No. The CRTC says a pre-checked box that presumes consent is an opt-out mechanism and is not acceptable. The person must tick the box or click the icon themselves, or type their own address into a sign-up field and submit it.
Can I email people to ask for their consent?
Not with a promotional or subscription message. The CRTC says a message asking for express consent is itself a commercial electronic message, so you cannot use one to get that consent. Ask at the point of service, on your booking form or in person.
What must a request for express consent include?
Under the CRTC's regulations bulletin, the request must carry the sender's mailing address, valid for at least 60 days, and a statement that the person can withdraw consent. The Act also requires the purpose of the request to be set out clearly and simply.
Does express consent ever expire under CASL?
No. The CRTC says express consent does not expire, and you can keep sending until the recipient withdraws it. Every message still needs an unsubscribe, and you must honour a request within 10 business days.
Who has to prove a customer gave consent?
The person who says they have consent. Section 13 of the Act puts the burden of proof on the sender, and the CRTC recommends keeping records such as completed forms or audio recordings. Log the date, the wording shown and the source.
Sources
- CRTC: Guidance on implied and express consent under CASL (opt-in mechanism, no expiry, 10 business days, burden of proof).
- CRTC Bulletin 2012-549 (opt-in versus opt-out, pre-checked boxes, no CEM to seek consent, confirmation).
- CRTC Bulletin 2012-548 (mailing address valid 60 days, withdrawal statement, separate consent, no bundling with terms).
- Justice Laws: Canada's anti-spam legislation, sections 10 to 13 (purpose of request, 60-day unsubscribe address, 10 business days, burden of proof).
General information for Canadian businesses, not legal advice. Last verified October 2026 by Aniket Gandhi, AGNT/01.
Collect consent once, use it properly.
We will review how your forms, missed-call texts and review requests record consent. Free, founder-led, 30 minutes.
Get the free audit →