Key Takeaways
- CASL applies to all commercial electronic messages sent to or from Canadian email addresses — that means essentially every Ontario business doing email marketing.
- Express consent is the gold standard: a clear, affirmative opt-in that you've documented with a timestamp and source.
- Implied consent exists in specific situations but expires after two years for business relationships and six months for prospects.
- Your unsubscribe mechanism must work within 10 business days, be free to use, and remain functional for 60 days after the message is sent.
It's 2018, and CASL's private right of action provision was set to come into force before being suspended indefinitely last year — but the core legislation is very much active and enforced. Ontario businesses that have been running email lists without thinking carefully about consent are in a vulnerable position. The CRTC has issued fines to real Canadian companies, and the penalties are steep enough to seriously harm a small business. The good news is that CASL isn't trying to kill email marketing — it's trying to kill spam. If you're running an honest business and communicating with people who genuinely want to hear from you, compliance isn't difficult. It mostly comes down to getting clear consent upfront, keeping records, and making it genuinely easy to unsubscribe. This guide walks through the essentials: what CASL actually requires, the difference between express and implied consent, what your unsubscribe mechanism needs to look like, and practical steps to audit your current list. Whether you're starting fresh or cleaning up an existing database, this is what you need to know.
Definition: CASL (Canada's Anti-Spam Legislation)
CASL is a federal law that came into full force in July 2014, with a three-year transition period that ended in July 2017. It regulates commercial electronic messages (CEMs) — primarily marketing emails — sent to or from Canadian electronic addresses. It requires senders to have consent, identify themselves, and provide unsubscribe mechanisms. It is widely considered one of the strictest anti-spam laws in the world.
Express vs. Implied Consent: Understanding the Difference
Express consent is explicit opt-in; implied consent is inferred from a relationship and is time-limited.
Express consent is what most people think of when they think of 'opting in.' The person you're emailing has taken a deliberate action to receive your messages — they checked a box on a form, signed up on your website, or verbally agreed and you documented it. Critically, the checkbox can't be pre-ticked. The consent must be unambiguous and the person must know what they're agreeing to. You also need to record when and how they consented, because the burden of proof is on you.
Implied consent is more complicated and less reliable as a long-term strategy. CASL recognizes a few scenarios where consent can be implied: you have an existing business relationship (someone bought from you or made an inquiry within the last two years), someone published their contact details for use in a business context, or a few other narrower scenarios. The key limitation is that implied consent expires — two years from the last purchase or contract, or six months from an inquiry or application. After that, you need express consent or you need to stop emailing them.
The practical implication for Ontario businesses is this: your old contact lists almost certainly contain people whose implied consent has expired. If you've been emailing contacts for years without refreshing their consent, you're likely non-compliant on a portion of your list. The responsible move is to segment your list by consent type and run a re-permission campaign for anyone whose status is unclear.
- Express consent: checked opt-in box, verbal agreement with documentation, signed form
- Implied consent (time-limited): existing customer within 2 years, inquiry within 6 months
- Keep records: timestamp, IP address or form source, what they consented to
- Never assume consent carries over from one context to another
Unsubscribe Requirements: What Your Email Footer Needs
Every marketing email must contain a working unsubscribe mechanism that processes opt-outs within 10 business days.
CASL's unsubscribe requirements are specific and non-negotiable. Every commercial electronic message must contain a mechanism that allows recipients to withdraw consent — an unsubscribe link is the most common. That link must work for at least 60 days after the message is sent. When someone clicks it, you have 10 business days to process the request and stop sending. And you cannot charge a fee or require more than a single action to complete the unsubscribe.
Most modern email marketing platforms — Mailchimp, Constant Contact, ActiveCampaign — handle the technical side of this automatically. The risk for Ontario businesses isn't usually the platform; it's custom or manual email processes where someone might be sending marketing messages directly from their inbox or through CRM tools that don't have built-in unsubscribe management. If you're using any non-standard sending method, audit it carefully.
One thing many businesses miss: if someone unsubscribes from your marketing emails, you can't just re-add them to a 'different list' and start emailing them again. Unless they provide new express consent, the unsubscribe applies to commercial messages from your organization broadly. This is a trap that trips up businesses that manage multiple email programs.
Practical Steps to Audit and Clean Your Email List
A CASL compliance audit comes down to four steps: document consent, segment your list, run re-permission campaigns, and update your opt-in process going forward.
Yes, running a re-permission campaign will shrink your list. That's okay. A smaller list of people who genuinely want to hear from you will outperform a bloated list of disengaged contacts every time — both in terms of deliverability and actual results. Email providers also monitor engagement rates, and a high number of disengaged subscribers will hurt your sender reputation.
Going forward, bake consent into every customer touchpoint. At checkout, include an opt-in checkbox (not pre-ticked). On your contact form, add a separate checkbox for marketing messages. At events or networking, tell people explicitly what you'll be sending before they hand you a card. These small process changes compound over time into a clean, defensible list.
- Step 1: Map your consent sources: Go through your email list and identify where each contact came from. Website sign-up form? Trade show? Business card? Purchase history? Tag each record with its consent source and date.
- Step 2: Identify expired implied consent: Flag any contacts whose last transaction or inquiry was more than two years ago (or six months for prospects who never became customers). These contacts need re-permission before you can legally email them.
- Step 3: Run a re-permission campaign: Send a clear, honest email to contacts with uncertain consent status. Explain why you're asking, make it easy to confirm they want to stay on your list, and remove anyone who doesn't respond within 30 days.
- Step 4: Fix your opt-in process: Update your website forms, checkout pages, and any other sign-up touchpoints to include a clear, unchecked opt-in checkbox with language describing what they're signing up for.
Experience Signal
We've helped several Ontario clients audit their email lists as part of rebranding or marketing overhauls, and the conversation about CASL is always revealing. Most business owners are surprised to learn how much of their list may have expired implied consent. The re-permission campaigns we've run typically retain 40-60% of the list — which sounds like a loss, but the remaining subscribers are far more engaged and convert at dramatically higher rates. One client in the professional services space reduced their list from 3,200 to 1,800 contacts and actually saw more booked consultations from email than before.
Frequently Asked Questions
CASL — Canada's Anti-Spam Legislation — applies to any commercial electronic message sent from or to a Canadian computer system. If you send marketing emails to customers in Canada, CASL applies to you regardless of where your business is located.
Express consent means someone actively opted in to receive your emails — clicking a checkbox, signing a form. Implied consent exists in limited situations: existing business relationships, publicly posted contact details used for relevant messaging, or other prescribed circumstances. Implied consent is time-limited and less secure.
Violations can result in administrative monetary penalties up to $1 million per violation for individuals and $10 million for organizations. The CRTC has issued penalties to Canadian businesses. The safest approach is to build a clean, consent-based list from the start.
Sources
Need Help Building a Compliant Email Marketing Strategy?
Webnixon helps Ontario businesses build email programs that are CASL-compliant and actually drive results. From list audits to full campaign strategy, we'll make sure you're doing it right.
Talk to Us About Email MarketingAbout the author
Sophia Rossi
Web Designer
Sophia designs high-impact websites and brand experiences at Webnixon, combining visual craft with a thorough understanding of user behavior and conversion principles. She specializes in responsive UI design, brand system development, and creating digital experiences that balance aesthetic distinction with functional clarity. She writes about web design best practices, branding strategy, and building online presences that earn trust and drive results for businesses.