A Brampton hair salon runs a holiday promotion. The owner exports every number and email address from three years of bookings, adds some contacts collected at a community fair, and sends a message offering 20% off. It feels like ordinary marketing, and it is the kind of campaign many small businesses have run. Under Canada’s Anti-Spam Legislation, commonly called CASL, parts of that list may be perfectly fine, while other parts could be a violation of federal law.
CASL does not target only the large overseas operations most people picture when they hear “spam”. It applies to a commercial message sent by a local shop, a mortgage agent, a trucking firm, or a charity’s gift store. The rules are not complicated once you see their structure, but they are unforgiving of assumptions, and the burden of proving consent sits with the sender.
This article offers general information only and is not legal advice. Your own campaigns, data sources, and industry may raise different points, and a review of your actual list and forms is the only way to reach a firm answer.
What Counts as a Commercial Electronic Message
The Act regulates a “commercial electronic message”, often shortened to CEM. In plain terms, this is an electronic message to an electronic address where one of its purposes is to encourage participation in commercial activity. Offering a product or service, advertising a business, or promoting an opportunity can each do it, and charging no money for what you offer does not necessarily change the result.
“Electronic address” reaches well beyond email. Text messages, instant messages, and similar accounts are included. A message from your business account to a person’s private inbox on a messaging platform can qualify. A public post on your own social media page generally differs from a direct message, but do not treat a group chat as automatically outside the law.
Mixed messages count. A customer service email that also contains a “check out our spring sale” banner may be a CEM because one of its purposes is promotional. An email asking for consent to send marketing is itself treated as a CEM, so you generally cannot cold-email strangers just to ask permission.
Voice calls are generally not covered by CASL; they are subject to separate telemarketing rules. A pre-recorded voice message may be treated differently, so ask before assuming.
The Three Things Every Marketing Message Needs
Section 6 of the Act sets out the basic requirement. Unless an exception applies, you need:
- Consent of the recipient, express or implied.
- Identification information. The message must identify the sender, and anyone on whose behalf it is sent, and include contact information valid for at least 60 days after sending, such as a mailing address plus a phone number, email, or web address.
- An unsubscribe mechanism that lets the recipient opt out at no cost, is easy to use, and stays valid for at least 60 days after the message is sent.
Requests to unsubscribe must be given effect without delay, and no later than 10 business days after they are sent. Processing a request requires no further confirmation or follow-up from the customer. A message saying “you have unsubscribed, but we would love to know why, click here for offers” is a trap to avoid.
If you hire a marketing agency or use a platform in Mississauga or anywhere else, the responsibility does not simply pass to them. Whoever sends the message and whoever it is sent on behalf of both have obligations, and the identification information may need to identify both.
Express Consent: Clean, Durable and Worth the Effort
Express consent is the strongest footing. It does not expire, although the recipient can withdraw it whenever they like. To be valid, your request must state clearly and simply the purpose of the consent and identify who is seeking it, and include contact details and a statement that consent can be withdrawn.
Regulatory guidance from the CRTC explains that consent should be an active opt-in. A pre-checked box is not a safe way to get it, nor is burying consent in your general terms and conditions. Separate it from the rest of the transaction, so someone can buy from you without agreeing to marketing.
A workable sign-up form on a Brampton retailer’s website might have an empty checkbox reading, in substance, that the customer agrees to receive promotional emails from the named business, with the address, phone number, and a note saying they may unsubscribe at any time. Below the form, the business saves a timestamp and the wording that was on the page at the time.
Paper and verbal consent can work too, if recorded. A sheet at a booth at a local trade show, with a clear statement above the signature line, is better than a fishbowl of business cards. If someone gives consent over the phone, keep a recording or a reliable note of what was said.
Implied Consent: Useful but Time-Limited
Implied consent is often the basis for your existing customer list, and it is where most mistakes happen. The main categories are these:
Existing business relationship. This covers a purchase, lease, or similar transaction with you, or a written contract, in the two years before the message is sent. Where a subscription or membership or account is continuing, the period generally runs from when it ends. It also includes an inquiry or application about those things within the prior six months.
Non-business relationships. Registered charities, political parties, and clubs have parallel categories, such as donations or memberships within the prior two years.
Conspicuous publication. If someone conspicuously publishes their email address, for example on a company website, without a statement saying they do not want unsolicited messages, you may be able to message them, but only if your message is relevant to their business role or functions. A roofing company’s general inbox is not an invitation to pitch unrelated personal products to the owner.
Disclosure. If a person has given you their business card or address, with no statement that they do not want messages, a message relevant to their role can be sent.
Because the two-year and six-month clocks are counted from specific dates, your customer list needs dates in it. If you cannot tell when the last transaction took place, you may not be able to show that implied consent exists.
Returning to the hypothetical salon: a client who paid for a haircut 14 months ago probably falls in the two-year window, while someone last seen three years ago likely does not. The fair contacts depend on what was collected and what they were told. A simple way to handle this is to ask those still in the window for express consent while implied consent lasts. After it lapses, you will generally have lost your chance.
Messages That Fall Outside Some or All of the Rules
CASL and its regulations contain exceptions, and they are more specific than people expect.
Excluded from the consent requirement and the other Section 6 rules. Messages between people with a personal or family relationship are excluded, as defined narrowly by the regulations. So are certain messages within and between organizations, including messages between employees or representatives of organizations that have a relationship where the message concerns the recipient organization’s activities. This is often called the business-to-business exemption, and it does not cover a cold pitch to a business with which you have no relationship. Messages sent in response to a request, inquiry, or complaint, or to satisfy a legal obligation or enforce a right, are also generally excluded.
Exempt from consent, but still needing identification and unsubscribe. This includes messages that provide a quote or estimate someone requested, confirm a commercial transaction, provide warranty or safety information, or deliver factual information about an ongoing account or subscription. Your order confirmation is likely in this category, though a sales pitch tacked on can change that.
Third-party referrals. A limited exemption allows one message following a referral from someone with a qualifying relationship, with conditions on who must be named.
Penalties, Directors and Keeping Your Own Proof
The CRTC is the main enforcer. The maximum administrative monetary penalty for a violation is $1,000,000 for an individual and $10,000,000 for any other person. Those are ceilings and not typical amounts. The Act lists factors for setting a penalty, including the ability to pay, the nature and scope of the violation, and the purpose of deterring repetition.
Two provisions are particularly relevant to a small owner-managed company. Section 13 places the onus of proving consent on the person relying on it. Section 31 says that an officer, director, or agent of a corporation can be personally liable if they directed, authorized, assented to, acquiesced in, or participated in the violation. Owners who decide personally what goes out to the list should take note of that wording.
A due diligence defence is also available, and it depends on evidence of the steps you took. The private right of action in the statute, which would allow individuals to sue, has been suspended and is not in force, but the CRTC can still act on complaints.
A Simple Compliance Routine
This is the plain version of what a small business can do, without buying a large system:
- Add source, date, and consent type fields to every contact record.
- Stop buying or renting contact lists; you usually cannot prove the consent behind them.
- Use one approved footer template containing your identification information and unsubscribe link.
- Test the unsubscribe link every quarter and make sure that requests from every channel (email, texts, front-desk verbal requests) reach one suppression list.
- Set a calendar reminder to run a re-consent campaign before the two-year window closes on any large group of customers.
- Keep copies of consent forms and the wording they showed at the time.
- Make sure any agency you hire agrees in writing to follow your rules and to give you records, a term that belongs in your service contracts.
- Train the staff who send texts from their phones. Quick promotional messages from a sales rep count too.
CASL also operates alongside privacy law. Collecting and using contact information for marketing must be consistent with your obligations under PIPEDA, which is why a broader privacy check often goes hand in hand with a CASL review.
If a Complaint Arrives
Do not delete anything or scramble to fix your records after the fact. Preserve your list, your templates, and your send logs, stop the campaign in question if there is any doubt, and respond to the person who complained. If the regulator contacts you, get advice before you reply. Being able to show a documented program made in good faith before the complaint is usually far more persuasive than a set of promises made after it.
Most Brampton businesses can comply with CASL using careful forms, dated records, and a working unsubscribe link. If you want help assessing your list or your consent wording, our corporate law group can review how your marketing is set up.