CASL: Contact Forms, Newsletters and What Counts as Consent

Compliance · Published

Canada's anti-spam law is stricter than its American equivalent and considerably less well understood by the businesses it applies to. It governs commercial electronic messages, which covers far more than newsletters: quote follow-ups, appointment reminders with an offer attached, and the email you send after someone fills in your contact form. This covers what consent has to look like, what every message must carry, and where the deadlines sit. General information, not legal advice.

Get a free quoteCall (613) 800-8028

What counts as a commercial electronic message

Any electronic message that, judged by its content, links or contact information, could reasonably be taken as encouraging participation in a commercial activity. Email, text messages and certain direct messages all qualify. Intent is not the test; how it reads is.

That sweeps in more than most businesses expect: newsletters obviously, but also a follow-up after a quote, a note that you have availability next week, an appointment reminder that mentions a promotion, and an invitation to a customer event. A purely transactional message, a receipt, a booking confirmation, a warranty notice, is treated differently and is largely exempt, but the moment you attach an offer to it the character changes.

Express consent, which is what you want

Express consent is someone actively agreeing to receive commercial messages from you. It does not expire. It is what a mailing list should be built on.

  • It must be opt-in, through a positive action. A pre-checked box is not consent, and neither is a checkbox bundled with agreement to terms of service.
  • You have to state clearly what they are agreeing to receive, and identify who is asking, including any business name they might not recognise.
  • You must give contact information for the person or business seeking consent.
  • You must tell them consent can be withdrawn.
  • You have to keep a record of it: what they agreed to, when, and how. The burden of proving consent is on the sender, which means an undocumented list is an unprovable one.

Implied consent, and the clocks nobody is watching

Implied consent is narrower and temporary. It is legitimate to rely on, and the mistake is treating it as permanent.

  • Existing business relationship: a purchase, a contract, or a written contract that expired. Implied consent runs for two years from that event.
  • An enquiry or application: someone asks about your product or service. Implied consent runs for six months from the enquiry. This is the one that covers replying to a contact form, and it runs out quickly.
  • Conspicuous publication: a business email address published without a statement refusing commercial messages, where your message is relevant to that person's role. This is narrower than the cold-emailing industry pretends, and the relevance requirement is doing real work.
  • Disclosed contact information: someone gives you their business address directly, without saying they do not want commercial messages, and your message relates to their role.
  • Referrals are permitted in limited circumstances and only for a single message, which must name the person who made the referral.

The practical consequence is that a list built entirely on implied consent is decaying continuously. Someone who enquired seven months ago and never bought is no longer someone you may send a commercial message to. Converting implied consent to express consent while it is still valid is the whole game, and it is done by asking.

What every commercial message must contain

  • Identification of the sender, and of anyone on whose behalf the message is sent.
  • A mailing address, and either a phone number, an email address or a web address. That contact information has to remain valid for at least 60 days after the message is sent.
  • An unsubscribe mechanism that is clearly set out and can be used without difficulty.
  • An unsubscribe mechanism that stays functional for at least 60 days after sending.
  • Unsubscribe requests actioned within 10 business days, with no confirmation step, no login and no survey in between.

What this means for your website specifically

  • A newsletter sign-up needs an unchecked box or a dedicated action, a clear statement of what is being sent, and a record of the consent event including timestamp.
  • A contact form gives you six months of implied consent to send commercial messages to that person. Use it to ask for express consent, rather than assuming the relationship continues indefinitely.
  • Do not bundle newsletter consent into a quote request. Bundled consent is not express consent, and it also produces a list of people who do not want to hear from you.
  • Keep the consent record with the contact record, not in a spreadsheet somebody exported once. If you cannot show when and how someone consented, you cannot show consent.
  • Automated sequences need auditing, because they are where old implied consent quietly keeps sending long after it lapsed.
  • Purchased lists are not usable. There is no consent, you cannot prove one, and the seller's assurances are not a defence.

The penalties, and the realistic risk

The administrative monetary penalties are substantial, up to one million dollars for an individual and ten million for an organisation, and enforcement has fallen on ordinary Canadian businesses rather than only on offshore spammers. A private right of action was legislated and its coming into force was suspended indefinitely, which removes one avenue of exposure without changing the underlying obligations.

For a small business the realistic risk is not a headline penalty. It is a complaint from one irritated recipient, an investigation that asks you to produce consent records you do not have, and the cost of dealing with it. Keeping the records is much cheaper than not having them.

Related reading

Frequently asked questions

Can I email someone who filled in my contact form?

Yes. An enquiry gives you implied consent for six months from the date of the enquiry. The useful move is to use that window to get express consent for anything ongoing, because once it lapses a further commercial message is no longer permitted.

Does CASL apply to text messages?

Yes. It covers commercial electronic messages generally, which includes SMS and certain direct messaging. Appointment reminder systems that add a promotional line are the common way businesses drift into scope without noticing.

Is a pre-checked newsletter box acceptable?

No. Express consent requires a positive action by the person, so a box they have to clear is not consent. Nor is bundling newsletter consent into acceptance of terms of service. Both are among the more commonly cited failures.

How long can I keep emailing a past customer?

Two years from the transaction under implied consent, unless you have obtained express consent, which does not expire. If a meaningful part of your list rests on purchases made more than two years ago, that part of the list is no longer mailable.

Do transactional emails need an unsubscribe link?

Purely transactional messages, receipts, booking confirmations, warranty and safety information, are treated differently and are largely outside the commercial message rules. The moment such a message carries promotional content, it is safest to treat it as a commercial message and include the full requirements.