CASL Compliance for Cold Email: What Canadian Law Actually Requires

CASL Compliance for Cold Email: What Canadian Law Actually Requires

Canada's Anti-Spam Legislation flips the default that US senders are used to. Under CAN-SPAM you may email anyone until they ask you to stop. Under CASL you may not email anyone until you can show you were allowed to, and if a regulator asks, the burden of proving it sits on you rather than on them.

That single difference is why outbound teams that treat Canada as an extension of their US list end up exposed. Here is what the law requires, where the exemptions actually apply, and how to run Canadian outbound without guessing.

This is not legal advice. It is an operator's reading of CASL and the CRTC's published guidance.

What CASL covers

CASL regulates commercial electronic messages, or CEMs: any electronic message that encourages participation in a commercial activity, sent to or accessed from a computer system in Canada. A cold sales email is squarely a CEM.

Three things must be true for a compliant send:

1. You have consent, express or implied, or a listed exemption applies.
2. The message identifies the sender and anyone on whose behalf it is sent, with valid contact information.
3. The message contains a working unsubscribe mechanism.

Miss any one and the message is non-compliant even if the other two are perfect.

Express consent

Express consent is a positive, informed opt-in. The request must set out the purpose the consent is being sought for, identify who is seeking it and on whose behalf, give a mailing address plus a phone number, email, or web address, and state that consent can be withdrawn. Pre-checked boxes do not count. Consent obtained by implication from a terms-of-service acceptance does not count.

The compensation for that friction is durability: express consent does not expire. Implied consent does.

Implied consent, the route most cold email relies on

Two categories matter for outbound.

Existing business relationship

Consent is implied for a defined window after a qualifying interaction:

The six-month inquiry window is the one people forget. Someone who filled out a form and went quiet is a lawful recipient for six months, not two years.

Conspicuous publication

This is the workhorse for cold outbound, and it has three conditions that must all hold:

1. The recipient conspicuously published the address, or caused it to be published. A company website, a public directory listing, a published staff page. An address scraped from a private database or guessed from a naming pattern does not qualify.
2. The publication carries no statement saying the person does not wish to receive unsolicited commercial messages. A "no unsolicited sales enquiries" line on the contact page removes the implied consent.
3. The message is relevant to that person's business, role, functions, or duties in a business or official capacity.

Condition three is the one that fails in practice. Emailing a CFO about a marketing tool is not relevant to their role, and relevance is judged against the individual's actual function, not against the company's general interest in growth.

Practical consequence: capture the evidence at collection time. The source URL, a timestamp, and ideally a snapshot. Implied consent you cannot evidence is, for enforcement purposes, no consent.

The business-to-business exemption, and why it is narrower than it sounds

Section 3(a)(ii) of the Governor in Council Regulations exempts messages sent by an employee or representative of one organization to an employee or representative of another, where the two organizations have a relationship and the message concerns the recipient organization's activities. When it applies, CASL's requirements do not apply to that message at all.

The Federal Court of Appeal narrowed the reading in its June 2020 CompuFinder decision. The relationship has to be between the organizations, not merely between a handful of individuals inside them. A limited contractual relationship covering a small number of transactions affecting a few employees was held insufficient.

CompuFinder is also the case that shows the enforcement arc. The CRTC issued a notice of violation with a $1.1 million administrative monetary penalty over three 2014 email campaigns, found 317 messages sent without consent, and reduced the penalty to $200,000 in October 2017 after weighing the company's lack of prior violations and ability to pay. The Federal Court of Appeal dismissed CompuFinder's appeal in full in 2020, confirming CASL is constitutionally valid.

The operating lesson: the B2B exemption is a defence for messages between organizations that already work together. It is not a general carve-out for B2B cold email.

Form and content requirements

Every CEM must include:

• Identification of the sender and anyone on whose behalf the message is sent. If it will not fit in the message, a hyperlink to a readily accessible, free webpage is acceptable.
• Contact information, including a mailing address that stays valid for at least 60 days after sending. A street address, PO box, rural route, or general delivery address all qualify.
• An unsubscribe mechanism that can be readily performed: a link to an accessible page, or a reply keyword for SMS. It must remain valid for at least 60 days after the message is sent.
• Processing of unsubscribes without delay, and no later than 10 business days. No confirmation step that the recipient has to complete.

Sixty days is longer than CAN-SPAM's 30-day requirement, which means a single global standard of 60 days clears both.

Penalties and who enforces

Maximum administrative monetary penalties are $1 million per violation for an individual and $10 million per violation for any other person, which in practice means corporations. Directors and officers can be personally liable, and a company can be vicariously liable for what its employees or agents send.

Enforcement sits with the CRTC, working alongside the Competition Bureau and the Office of the Privacy Commissioner. CASL's private right of action, which would let individuals sue for statutory damages, was suspended before it came into force and remains not in force, so regulators are still the only route to enforcement.

How to run Canadian outbound

• Segment Canada out of your global list. Different rules mean a different process, not a footnote in the same one.
• Build on conspicuous publication. Source addresses from company sites and public directories, store the source URL and date on every record, and re-check before a send if the record is old.
• Enforce the relevance test at the targeting layer. If your ICP filter cannot explain why this role would care about this offer, the message fails condition three regardless of copy quality.
• Respect refusal statements. Scrapers do not read a "no unsolicited enquiries" line on a contact page. A human review pass or a keyword filter on the source page should.
• Track implied consent expiry. Six months on inquiries, two years on transactions, and a suppression rule that fires when the clock runs out.
• Publish a real mailing address and a 60-day unsubscribe in every message, and suppress globally on the first request.
• Keep the records. Consent evidence, unsubscribe logs, and send logs are your only defence, and CASL puts the burden on you.

Compliance and deliverability reinforce each other here. Sourcing from published addresses, targeting by genuine role relevance, and honouring opt-outs instantly are also the behaviours that keep complaint rates low, which is what Google Postmaster Tools measures and what spam rate benchmarks track.

For the wider picture across regimes, see is cold email legal. On the technical side, make sure your authentication records are correct, your list is properly verified before it ships, and you know how to check and clear a blacklisting. The fundamentals live in the cold email deliverability guide.

Running outbound into Canada and want the consent and evidence layer built in? Get a free campaign plan and we will walk through how it works.