What is “implied consent” and when is it acceptable?
Still have a question, spotted an error, or have a better explanation or a source we should cite?
Say someone buys something from your store. You didn't ask them to tick a newsletter box, but they gave you their email and you have a real business relationship. That's the scenario implied consent is built for: consent that's inferred from context rather than explicitly given.
Whether implied consent is legally acceptable depends almost entirely on which laws apply to your sending.
CASL (Canada) explicitly recognizes implied consent for existing business relationships. If someone purchased from you in the last two years, you can email them. But it has an expiry: typically two years from the last transaction or interaction. After that, you need express consent to keep sending. Non-business relationships (donations, memberships, volunteer activity) also qualify under CASL, with similar time limits.
GDPR (EU/UK) doesn't accept implied consent as a consent basis. Consent under GDPR must be explicit. However, you might rely on "legitimate interest" as an alternative legal basis for certain customer communications. That's a distinct legal analysis and not the same thing as implied consent.
CAN-SPAM (US) doesn't require prior consent at all, so the implied vs. express distinction is less relevant there. You can email commercially without any opt-in, as long as you include required disclosures and honor unsubscribes.
When relying on implied consent, always document the relationship that justifies it, know the expiry rules for your jurisdiction, and make it easy to opt out. Implied consent is a narrow window, not an open door. If you're sending to multiple regions, the rules differ enough that it's worth mapping each audience to its governing law before you assume implied consent covers you.
Contributors
Who worked on this answer
Every name links to their profile. Every company links to their site. Real people, real accountability.
