CASL compliance: Canada's consent-first email law

Canada's Anti-Spam Legislation, universally shortened to CASL, is one of the strictest email laws in the world, and CASL compliance is a live question for any sender whose messages touch Canada — whether the mail originates there, lands in a Canadian inbox, or routes through Canadian infrastructure on the way. Where the United States built CAN-SPAM around the right to opt out, Canada built CASL around permission to send in the first place. That single design choice — consent before contact, not after complaint — changes how you collect addresses, what you keep on file, and how quickly you act when someone asks to leave. This guide walks through what CASL actually requires, how express and implied consent differ, and where clean list practices fit around the edges of the law.

What CASL covers#

CASL governs commercial electronic messages, or CEMs — electronic messages that encourage participation in a commercial activity. Email is the obvious case, but the law is written broadly enough to reach other electronic message types as well. The trigger is the commercial purpose: a newsletter promoting products, a sales outreach note, a promotional blast, and a "just following up" email to a prospect are all CEMs, while a purely transactional receipt or a message someone is legally entitled to receive generally sits outside the core consent rules.

The jurisdictional hook is deliberately wide. CASL can apply to messages sent to or from Canada, and even to messages routed through Canadian computer systems. In practice that means a sender outside Canada does not escape the law simply by being incorporated elsewhere — if Canadian recipients are on the list, the Canadian rules are in scope for those addresses. This is one reason CASL comes up so often in any survey of email marketing laws by country: its reach extends well beyond Canada's borders.

The three pillars of CASL compliance#

Most of CASL compliance for email comes down to three requirements that apply together. Meeting one or two is not enough; the law generally expects all three for a given message.

The consent pillar is where CASL diverges most sharply from opt-out regimes, so it is worth unpacking on its own. The identification and unsubscribe pillars are more familiar to anyone who has worked under CAN-SPAM, but CASL's versions carry their own expectations.

Express versus implied consent#

CASL recognises two kinds of consent, and the distinction matters because they behave very differently over time.

Express consent is an affirmative, opt-in agreement to receive commercial messages. The person knowingly and clearly says yes — typically by checking an unticked box, entering an address into a subscribe form, or otherwise taking a positive action that is specifically about receiving your messages. Consent bundled invisibly into a long terms-of-service scroll, or a box that is pre-checked on the reader's behalf, is a weak foundation. Express consent, once properly obtained, does not carry a built-in expiry — it lasts until the person withdraws it. This is exactly why a genuine opt-in step matters so much; the difference between single and double opt-in is partly a question of how strong and how provable that "yes" is.

Implied consent is narrower and, crucially, often time-limited. CASL sets out specific circumstances in which consent can be implied rather than expressly given — the most common being an existing business relationship, such as a recent purchase or an inquiry the recipient made. In these defined situations the law generally allows you to message the person for a limited window tied to that relationship, after which the implied consent lapses unless you have obtained express consent in the meantime. Implied consent is not a free pass; it is a specific, bounded exception with conditions attached, and the exact circumstances and windows are set out in the legislation.

The practical takeaway is that express and implied consent are not interchangeable. Implied consent buys you time and a defined relationship; express consent is the durable, portable permission you actually want to build a list on. Treating a stale implied relationship as though it were express consent is one of the more common ways senders drift out of alignment with the law.

Identification and a working unsubscribe#

Beyond consent, every CEM has to make two things unmistakable: who it is from, and how to leave.

Identification means the recipient can tell who is actually sending the message. That includes identifying the sender (and anyone on whose behalf the message is sent, where relevant) and providing valid contact information that stays reachable for a reasonable period after the message goes out. The goal is transparency — no disguised senders, no dead reply addresses, no ambiguity about who is behind the campaign.

Unsubscribe means every CEM carries a clear, working mechanism to opt out, and that you act on requests promptly. The mechanism should be easy to use and function without hoops. This is the same discipline that one-click unsubscribe formalises for the major mailbox providers: make leaving frictionless, and process the request quickly rather than letting it sit. An unsubscribe link that fails, redirects through a login wall, or is quietly ignored undermines the whole point of a consent-based regime, because it strips the recipient of the control the law is built to protect.

How CASL compares to CAN-SPAM#

Senders who are comfortable with US rules sometimes assume that CAN-SPAM compliance carries over to Canada. It does not, and the gap is mostly about consent. CAN-SPAM lets you email people who have not opted in, as long as you identify yourself, tell the truth, and offer a way out. CASL generally requires permission first. The two laws share a family resemblance on identification and unsubscribe, but they start from opposite defaults.

Because of that opt-in default, CASL is generally the stricter of the two. A list assembled to satisfy CAN-SPAM — bought data, scraped addresses, or contacts who never affirmatively agreed — can be perfectly serviceable for US sending and still fall short of what CASL expects for Canadian recipients. If you operate on both sides of the border, the safe mental model is to hold the Canadian portion of your list to the consent standard, which is covered in more depth in the companion guide to CAN-SPAM compliance. Meeting the stricter bar tends to satisfy the looser one, rarely the other way around.

Enforcement and keeping records of consent#

CASL is backed by administrative monetary penalties, and enforcement has been active enough that the regime is taken seriously by large and small senders alike. Rather than fixating on any single figure — the amounts are set by the framework and can change — the more useful posture is understanding what regulators tend to look for: was there consent, can you demonstrate it, and did you honour opt-outs. That third question is squarely within your control and overlaps neatly with everyday deliverability hygiene.

The demonstrable part is where record-keeping earns its place. Because CASL is a consent regime, the burden of showing that consent exists generally sits with the sender, not the recipient. That makes it worth recording, in a durable form, how and when each contact agreed to hear from you — the source of the signup, the date, the wording they saw, and whether the consent was express or implied. If it was implied, note the relationship it rests on and when the associated window is likely to lapse. You do not need a courtroom-grade dossier for every address, but you do want to be able to answer "why is this person on your list?" with something better than a shrug. A clean, well-documented signup flow is far easier to stand behind than a list whose origins nobody can explain.

Where list hygiene fits around CASL#

Verification and list cleaning are not compliance controls — a syntactically valid, deliverable address tells you nothing about whether the person consented. It is important to be honest about that boundary. But good hygiene supports the parts of CASL that overlap with sender reputation, and it keeps your consent records meaningful.

Two practical connections are worth drawing out. First, honouring unsubscribes promptly is both a CASL expectation and a deliverability one; suppressing a departed contact quickly keeps you off the path that leads to rising spam complaint rates and mailbox-provider penalties. Second, keeping a list clean means you are actually reaching the people who consented rather than pounding dead mailboxes and spam traps — which is the ordinary work of cleaning an email list and of email verification in general. Neither of those activities creates consent, but both make your consented list healthier and your records easier to trust. The division of labour is simple: consent and identification come from how you collect and disclose; hygiene comes from how you maintain. CASL cares about both, for different reasons.

Frequently asked questions#

Does CASL apply to senders outside Canada?#

It can. CASL is written to reach commercial electronic messages sent to or from Canada, and even messages routed through Canadian computer systems. A sender based elsewhere does not automatically fall outside the law simply because of where the company is located — if Canadian recipients are on the list, the Canadian rules are generally in scope for those addresses. Because the specifics turn on facts, a lawyer familiar with CASL can tell you how it applies to your situation.

What is the difference between express and implied consent under CASL?#

Express consent is an affirmative, opt-in agreement — the person clearly and knowingly says yes to receiving your messages, and that consent lasts until they withdraw it. Implied consent is narrower and often time-limited, arising in defined situations such as an existing business relationship, and it can lapse after a set window unless you obtain express consent in the meantime. Express consent is the more durable foundation; implied consent is a bounded exception with conditions attached.

Is CASL stricter than CAN-SPAM?#

Generally yes, on the point that matters most. CAN-SPAM operates on an opt-out model — you may email people who have not opted in, provided you identify yourself, tell the truth, and offer a way out. CASL is consent-first, so it generally expects permission before you send. The two share requirements around identification and a working unsubscribe, but CASL's opt-in default makes it the stricter regime for Canadian recipients.

Does verifying my list make me CASL compliant?#

No. Verification checks whether an address is valid and deliverable; it says nothing about whether the person consented to hear from you, which is the heart of CASL. Consent, clear sender identification, and a working unsubscribe are the compliance requirements. Verification and list cleaning are hygiene practices that keep your consented list healthy and your records meaningful, but they do not substitute for permission — and they are not legal advice.

Clean lists and honoured unsubscribes are the hygiene layer that sits alongside any consent-based programme. Qualisend helps with that part: run a sample through the free email checker, or start with 100 free credits to clear out the dead addresses so the people who actually consented are the ones you reach.