What type of consent is required under CASL (implied vs. express)?
Still have a question, spotted an error, or have a better explanation or a source we should cite?
Under CASL, you need either express or implied consent before sending commercial email to Canadians. The distinction matters a lot, because they have very different rules.
Express consent is explicit opt-in. The recipient took a positive action to agree to receive commercial messages. No pre-checked boxes, no passive acceptance. Express consent doesn't expire (until the person withdraws it), and it's the strongest legal footing you can have. It's what you're aiming for with every subscriber.
Implied consent is permission inferred from a relationship without an explicit opt-in. It comes in two forms. An existing business relationship (purchase, contract, membership within the past 2 years) gives you 24 months of implied consent. An inquiry (someone asked for information or a quote but didn't complete a transaction) gives you only 6 months.
The critical thing about implied consent: it expires. When the window closes, you need to stop sending unless you've converted to express consent in the meantime. This is why smart CASL programs run consent conversion campaigns well before the 24-month mark. Nudging customers to explicitly confirm they want to stay on your list.
If you're building a CASL-compliant program from scratch, treat express consent as the default and use implied consent as a short-term bridge for recent customers. You can check what to document to prove either type is valid.
Contributors
Who worked on this answer
Every name links to their profile. Every company links to their site. Real people, real accountability.
