Skip to Main Content

Anti-spam law — FAQ

Canada’s Anti-Spam Legislation (CASL) is a tough law designed to curtail online annoyances and threats like junk mail and phishing scams. It imposes strict regulations on businesses and organizations that communicate electronically. Here’s what you need to know to comply.

How does it work?

The Anti-Spam Law governs all electronic messages that organizations send with a commercial intent. At its core, the law requires agencies operating in Canada to obtain a recipient’s consent before sending a “commercial electronic message,” or CEM.

The law defines a CEM as any electronic message that “encourages participation in a commercial activity.” This includes text and instant messaging, social media and e-mails.

You can still use CEMs, but they must meet certain requirements.

Under CASL, your messages require three things:

  • consent, either express or implied;
  • clear identification of the sender;
  • a way for recipients to unsubscribe.

What is express consent?

Express consent means the person receiving your messages gave an explicit indication that they wish to receive them. This could include subscribing to a newsletter or clicking a “yes” box during software installation.

What is implied consent?

There are four forms of implied consent. The first two revolve around existing relationships between organizations and recipients, either in a business or non-business capacity.

In an existing business relationship, the recipient has made, or inquired about purchasing your products and services or accepted a business opportunity or investment from you.

A non-business relationship exists when either:

  • You are a registered charity, political party or candidate and the recipient has offered gifts, donations or volunteer work.
  • You are a club or association of which the recipient is a member.

Another form of implied consent exists when the recipient’s contact information was published conspicuously, such as on a website or in a trade magazine.

The last type exists if the information was freely disclosed to you, on someone’s business card, for example.

Can consent expire?

Express consent lasts until the recipient withdraws it.

Implied consent is generally time-limited — often two years — although the time varies depending on the service or transactions made. These conditions are spelled out more specifically in the legislation.

I had consent before the law came into effect. Is it still valid?

Express consent obtained before July 1, 2014 remains usable.

If you had implied consent before the law came into effect, you must obtain express consent from those contacts within three years (by July 1, 2017).

Do I have to prove consent?

Yes, so be sure to keep records of how you obtained it.

What are the penalties?

The CRTC has a range of enforcement options, ranging from warnings to financial penalties. Penalties can range as high as $1 million for individuals and $10 million for businesses, although those are reserved for serious violations.

After July 1, 2017, you are also vulnerable to a private right to action, meaning individuals or organizations can bring you to court for violating the law.


Read more:

Canada’s Anti-Spam Legislation:

Three things to think about when sending messages:

FAQ for businesses and organizations: