CASL compliance for email marketers
Canada's Anti-Spam Legislation is an opt-in law: consent must exist before the first commercial message, penalties reach $10 million per violation for corporations, and the implied-consent window from a purchase expires after two years. This guide covers what the law requires of a working email program and the consent register that makes compliance provable rather than assumed. It describes our operating practice, not legal advice; involve counsel for edge cases.
By Priya Raghavan. Sendnexa is a Canadian company; CASL is not an add-on for us, it is the water we swim in, and the register described below runs in every engagement.
What does CASL require in every message?
Three things, per the CRTC: consent (express or implied) before sending, identification of the sender including contact information, and a functioning unsubscribe mechanism honored promptly. The unsubscribe requirement overlaps neatly with Gmail and Yahoo's RFC 8058 one-click rule for bulk senders, so a compliant Canadian program usually satisfies both with one implementation.
Express versus implied: what is the practical difference?
| Express consent | Implied consent | |
|---|---|---|
| Created by | Affirmative action: checked box, typed signup, recorded agreement | Existing business relationship, e.g. a purchase or inquiry |
| Expires | Does not expire | Two years from end of relationship (shorter for inquiries) |
| Best practice | Double opt-in: the confirmation click is timestamped proof | Track the date; convert to express before the window closes |
Why does the two-year clock matter so much?
Because it expires segments silently. A customer who bought once in March 2024 and never returned stops being mailable in March 2026, and nothing in a default ESP setup will tell you. Lists built over years of checkout opt-ins carry a growing shadow of expired implied consent. The fix is mechanical: record the consent basis and date per profile, flag approaching expiries, and run re-permission campaigns that convert implied to express while it is still legal to ask.
What is a consent register?
A per-profile record of what was agreed to, when, and through which source: signup form, checkout checkbox, trade-show sheet. Under CASL the sender carries the burden of proving consent, and "they are on the list" is not proof. Ourlist-growth service builds the register inside the ESP with custom properties, so segments can filter on consent basis the same way they filter on engagement.
Where does compliance overlap with performance?
Almost everywhere, which is the under-told story. Expired-consent segments are also the segments that generate spam complaints, and complaints above Google's 0.1% guidance throttle delivery for the whole program. In one audit, 71% of send volume targeted profiles with no purchase in 180+ days: a compliance exposure and a deliverability problem in the same rows. Suppressing them fixed both at once, as theSaaS onboarding case study shows in detail. Consent hygiene is not a tax on growth; it is the same work as reputation management, and email's $36-per-dollar ROI (Litmus) only accrues to mail that reaches inboxes legally.
The five-point CASL checklist
- Every capture point uses an unchecked, affirmative opt-in with sender identification.
- Double opt-in wherever volume allows; the confirmation is your express-consent proof.
- A consent register records basis, date, and source per profile.
- Automated flags on implied consent approaching the two-year expiry, with re-permission campaigns queued.
- One-click unsubscribe (RFC 8058) live and honored immediately, satisfying CASL and the Gmail bulk-sender rules together.
Does CASL apply to my company if we are not in Canada?
It applies to commercial electronic messages sent to Canadian recipients, wherever the sender happens to sit. A US brand mailing Canadian subscribers is inside CASL's scope, which matters because the penalty ceiling runs to $10 million per violation for corporations and $1 million for individuals, and directors can be held personally liable.
What counts as express consent under CASL?
A clear, affirmative action: a checked (never pre-checked) box, a typed email into a signup form, a written or recorded verbal agreement. Express consent does not expire, which is why it is worth capturing properly once. Record what the person agreed to, when, and through which form, because the burden of proving consent sits with the sender.
How does implied consent expire?
On a clock. An existing business relationship, such as a purchase, creates implied consent that runs two years from the end of that relationship; an inquiry runs shorter. Buy once in March 2024 and never again, and the implied window closes in March 2026. Segments built on old purchases silently expire unless something restarts the relationship.
Is CASL stricter than the US CAN-SPAM rules?
Meaningfully. CAN-SPAM is opt-out: you may mail until the recipient unsubscribes. CASL is opt-in: consent, express or implied, must exist before the first commercial message. Every message must also identify the sender and carry a working unsubscribe. Teams running one combined list for both countries need the consent basis tracked per profile.
How much of your list is still legal to mail?
The working session includes a consent-coverage read: documented basis per segment, and what expires next quarter.
Book a working session