What are the penalties for CASL violations?
Still have a question, spotted an error, or have a better explanation or a source we should cite?
CASL has some of the steepest penalties of any email law in the world. Up to $1 million CAD per violation for individuals and $10 million CAD per violation for businesses. Each non-compliant email can be a separate violation. Do the math on a campaign to a mid-sized Canadian list and it gets alarming fast.
Directors and officers can be held personally liable if they directed, authorized, or participated in violations. Corporate structure doesn't fully protect you. If the company sent non-compliant emails and you were running the email program, your personal exposure is real.
The CRTC (Canada's telecommunications regulator) enforces CASL and has brought cases against both Canadian and international companies. Enforcement tends to focus on lack of consent, missing required information, and false or misleading content. There's also a private right of action provision, though it hasn't been activated yet, that would allow individuals to sue for up to $200 per violation.
The penalties are designed to make compliance cheaper than non-compliance. And they succeed. The good news: senders making good-faith compliance efforts and keeping proper consent records are not typically enforcement targets. The cases that get fined are systematic violators, not accidental ones.
If you're emailing Canadians and you're not sure where your CASL compliance stands, our SOS call is free and we can help you figure out the gaps before they become problems.
Contributors
Who worked on this answer
Every name links to their profile. Every company links to their site. Real people, real accountability.
