What are CASL restrictions on unsolicited messages?
Still have a question, spotted an error, or have a better explanation or a source we should cite?
If you're sending cold emails to Canadian addresses, CASL is the law that will catch you off guard. It's stricter than CAN-SPAM and stricter than most people expect.
The core rule: you need consent before sending a commercial electronic message (CEM). A CEM is any message that encourages participation in a commercial activity, which covers essentially all cold sales email.
Express consent means the recipient explicitly agreed to receive messages from you. It doesn't expire. Implied consent is narrower: it applies in specific circumstances like an existing business relationship (typically valid for 2 years), a purchase inquiry (valid for 6 months), and a publicly listed email address used in a directly relevant context. Once implied consent expires, you can't send.
Every message you send under CASL must include your full name or business name, a physical mailing address, and a working unsubscribe mechanism honored within 10 business days. These aren't optional.
Penalties reach $1 million CAD per violation for individuals and $10 million CAD for organizations. Keep consent records with timestamps and source documentation. If a complaint comes in, you'll need to prove you had a valid basis. If you're not sure your list is CASL-clean, build a suppression list and review your consent types before your next send. If the situation is complex, ask us before you send.
Contributors
Who worked on this answer
Every name links to their profile. Every company links to their site. Real people, real accountability.
