Is implied consent enough in Canada?

You made a sale last month, so you're safe to email that customer, right? In Canada, that depends on exactly when they bought, what they bought, and whether you're keeping track. CASL (Canada's Anti-Spam Legislation) is stricter than most people expect, and implied consent has an expiry date stamped right on it.

Here's how it actually works. CASL allows implied consent when a real business relationship exists, but only within defined windows:

• Purchase, lease, or contract: 24 months from the date of the transaction.
• Inquiry or application: 6 months from the date of the inquiry.
• Membership in a club, association, or voluntary organization: 24 months from when membership ends (as long as they haven't asked to be removed).

Once those windows close, implied consent is gone. You need express consent to keep sending, which means a clear, affirmative opt-in where the person knowingly agreed to receive your emails.

Not every business interaction qualifies either. A casual website visit? Not a qualifying interaction. Someone following you on social media? Also no. The relationship needs to be a real transaction or a direct inquiry about your products or services.

The practical problem: tracking this at scale.

This is where most Canadian senders get into trouble. Knowing the rule is one thing. Having a system that actually tracks the consent basis and date for each contact is another (and yes, that's the part regulators will ask about if it ever comes up).

And a workable approach looks like this:

• Store a "consent basis" field in your CRM or ESP for every contact. Values might be: express, implied-purchase, implied-inquiry.
• Store a "consent date" so you can calculate when the window closes.
• Set up an automated segment that flags contacts approaching their expiry, say 60 days out.
• Send a re-consent campaign before the window closes. Ask them to opt in properly. Keep it honest and low-pressure.
• If they don't respond, move them to a suppression list before the deadline hits.

That last step is the one most senders skip. Suppressing non-responders feels painful, but emailing a contact whose implied consent has expired is a compliance risk in Canada. The fines under CASL are not symbolic.

If you're not sure how clean your current list is or whether your consent records are solid, that's worth sorting out before a complaint does it for you. Our RME Clean service can help you get a clearer picture of what you're working with, or if you'd rather talk it through first, the SOS hotline is free.