Quick Answer
You can build an email list in Canada without breaking CASL, and the rule that governs most of it is simple: get express consent through an opt-in action, record how and when you got it, and give every message a working unsubscribe. Canada’s Anti-Spam Legislation does not ban email marketing. It bans sending commercial messages to people who never agreed to receive them.
By Cody Wise, founder of Wise Media. Wise Media builds email and lead capture systems for Canadian businesses. This article is general information about how CASL works, not legal advice. CASL enforcement is fact-specific and the penalties are large, so get advice from a Canadian lawyer before relying on any interpretation here for your own list.
Summary
- Two kinds of consent exist. Express consent comes from an opt-in action and does not expire. Implied consent is time-limited and arises only from specific relationships set out in the Act.
- The two-year clock is real. Implied consent from a purchase, lease, barter or accepted business opportunity lasts two years from that transaction, per section 10(10) of CASL.
- Inquiries give you six months, not two years. A quote request is not a purchase.
- Pre-checked boxes do not work. The CRTC states express consent must be obtained through an opt-in mechanism, as opposed to opt-out.
- Every message needs identification plus a mailing address valid for at least 60 days, and an unsubscribe mechanism that stays valid 60 days and is honoured within 10 business days.
- You carry the burden of proof. Section 13 of CASL puts the onus of proving consent on the person claiming it, which is why your records matter more than your intentions.
- Maximum administrative monetary penalties are $1 million CAD per violation for an individual and $10 million CAD for a business.
Table of contents
- Can you legally build an email list in Canada?
- Express vs implied consent, and the clocks attached to each
- What a compliant signup form looks like, field by field
- Lead magnets that do not breach CASL
- The unsubscribe mechanism the law actually requires
- Records of consent: what to store and for how long
- Purchased lists, scraped addresses and LinkedIn exports
- The penalties, and who has actually been fined
- Eight mistakes Canadian businesses make
- FAQ
Can you legally build an email list in Canada?
Yes. CASL regulates commercial electronic messages, it does not prohibit them. You need consent before you send, you need to identify yourself in the message, and you need to give the recipient a way out. Do those three things and list building is entirely legal.
What CASL changed is the default. Under American law the default is that you may email someone until they opt out. Under Canadian law the default is that you may not email someone until they opt in, with a narrow set of relationship-based exceptions. If you are running a US playbook on a Canadian list, that inversion is the whole problem.
The statute itself is An Act to promote the efficiency and adaptability of the Canadian economy, which everyone calls CASL. The CRTC publishes the enforcement guidance and the CASL frequently asked questions, and maintains an index of the Act, the regulations and the guidelines including separate guidance on implied consent and on keeping records of consent. The Office of the Privacy Commissioner also enforces parts of CASL that touch address harvesting.
If you want the compliance baseline for your website rather than your list, we covered that separately in is my website CASL compliant. This article is the growth side: how to build the list in the first place without creating a problem. For the delivery and strategy layer, our email marketing service builds the whole stack.
Express vs implied consent, and the clocks attached to each
Express consent is given by a deliberate opt-in action and does not expire, though it can be withdrawn at any time. Implied consent is not given at all, it is inferred from a relationship the Act defines, and every form of it runs on a clock. Build your list on express consent. Treat implied consent as a short grace period, not a strategy.
Express consent, in the CRTC’s own terms
The CRTC states that express consent must be obtained through an opt-in mechanism, as opposed to opt-out. It can be given orally or in writing, and the sender must be able to prove it was obtained. That rules out the three shortcuts most signup forms still use:
- Pre-checked boxes. The recipient has not acted, so there is no opt-in.
- Consent bundled into terms of service. Burying it in a block of legal text that someone accepts to complete a purchase is not a clear request for a specific purpose.
- Silence or inaction. Not unticking a box is not consent.
Section 10(1) of CASL also specifies what you have to tell someone when you ask. The request must clearly and simply set out the purpose or purposes for which consent is sought, and information identifying who is seeking it, and the person on whose behalf it is sought if that is someone else. In plain terms: say who you are and what you will send.
Implied consent and the exact time limits
Section 10(9) allows implied consent in four situations: an existing business relationship, an existing non-business relationship, an address the person conspicuously published, and an address the person disclosed to you directly. The last two only work where the message is relevant to that person’s business, role, functions or duties, and only where they did not state that they do not want unsolicited commercial messages.
| Source of implied consent | CASL section | How long it lasts |
|---|---|---|
| Purchase or lease of a product, goods, service, land or interest in land | 10(10)(a) | 2 years from the transaction |
| Recipient accepted a business, investment or gaming opportunity you offered | 10(10)(b) | 2 years |
| Barter of any of the above | 10(10)(c) | 2 years |
| A written contract on another matter | 10(10)(d) | While in force, or 2 years from expiry |
| An inquiry or application about any of the above | 10(10)(e) | 6 months |
| Donation or gift to a registered charity, political party or candidate | 10(13)(a) | 2 years |
| Volunteering for, or attending a meeting organised by, those same bodies | 10(13)(b) | 2 years |
| Membership in a club, association or voluntary organisation as defined in the regulations | 10(13)(c) | 2 years |
Two details that catch people out. For an ongoing subscription or membership, section 10(14) starts the clock when the relationship or membership ends, not when it began. And under section 10(12), if you buy a business you inherit its existing business relationships, which is useful to know during an acquisition and dangerous to assume without checking what the seller actually has documented.
The six-month inquiry window is the one that quietly breaks campaigns. Someone requests a quote in January, does not buy, and sits on your list for three years. That is a violation from July onward unless you converted them to express consent in between.
The job of every implied-consent contact is to become express
Treat implied consent as a window in which you are allowed to ask properly. Send value, and somewhere in the first few messages ask them to confirm they want to keep hearing from you, with a real opt-in action. People who confirm are worth more than people who drifted onto your list anyway, and the clock stops being your problem.
What a compliant signup form looks like, field by field
A compliant form needs five things: an email field, an unchecked consent checkbox, a plain statement of what you will send and how often, your identity and a way to reach you, and a stored record of the whole interaction. Nothing exotic. Most non-compliant forms are missing two of the five.
| Element | What it must do | Common failure |
|---|---|---|
| Email field | Collect the address | Asking for ten fields and killing the conversion rate |
| Consent checkbox | Unchecked by default, separate from any other agreement | Pre-ticked, or merged with terms acceptance |
| Checkbox label | Say what you will send and roughly how often | “I agree to receive communications” with no specifics |
| Your identity | Name the business sending the mail | Form sits on a landing page with no business name anywhere |
| Contact details | A mailing address, in the form or in the emails | Neither place has one |
| Stored record | Date, time, IP, page URL, and the exact wording shown | No record at all, which is the most common gap |
| Confirmation step | Optional under CASL, strongly recommended | Skipped, so a typo address becomes a permanent bad record |
Wording that works
Keep the checkbox label specific and human. Something like: “Yes, send me the monthly Wise Media newsletter on websites, SEO and marketing systems for Canadian businesses. You can unsubscribe at any time.” That names the sender, names the content, implies frequency and signals the exit. It is also short enough that people actually read it.
Avoid wording that covers more than you asked for. “Marketing communications from us and our partners” is a request for consent you probably cannot evidence per partner, and partner consent is one of the harder parts of CASL to get right.
Double opt-in is not legally required, and you should still use it
CASL does not mandate a confirmation email. The CRTC guidance describes express consent as obtained through an opt-in mechanism without requiring a second step. But a confirmation click gives you a timestamped, logged, verifiable record from the address holder themselves, which is exactly the evidence section 13 asks you to produce. It also strips typos and bot submissions before they ever reach your sender reputation.
The trade-off is real: you will lose roughly a fifth to a third of raw signups to unconfirmed addresses. Those were mostly addresses that would never have opened anything. Take the smaller, provable list. It also helps your deliverability, which is a separate problem that a dirty list makes much worse.
Lead magnets that do not breach CASL
A lead magnet is fine under CASL. What is not fine is treating the download as consent to market. Delivering a requested file is one thing. Adding that person to a weekly promotional list is a separate purpose, and it needs its own clearly stated consent.
The two-checkbox pattern
- No checkbox for delivery. If someone enters an email to receive a specific file, sending them that file is the transaction they asked for.
- One unchecked box for the list. “Also send me the monthly newsletter.” Separate, optional, and not a condition of the download.
This splits your record cleanly. You can evidence that the people on your marketing list ticked a box asking for marketing, and that the people who only wanted the file only got the file. That distinction is what an enforcement inquiry would actually ask you about.
Lead magnets that work for Canadian service businesses
| Format | Why it works | Who it suits |
|---|---|---|
| Pricing or cost breakdown in CAD | Highest intent signal available, people download it when they are budgeting | Any service business with variable pricing |
| Provincial compliance checklist | Genuinely hard to find, and the rules differ by province | Trades, clinics, brokerages, anyone licensed |
| Template or calculator | Used repeatedly, so your name stays in their tooling | Consultants, agencies, accountants |
| Scorecard or self-audit | Produces a result the reader wants explained, which is a natural sales conversation | Anything diagnostic |
| Recorded walkthrough | Shows process, which reduces perceived risk of hiring you | High-ticket services |
Avoid the generic ebook. Nobody downloads “The Ultimate Guide to Marketing,” and the people who do are not buyers. A pricing breakdown with real CAD ranges will out-convert it several times over, for the same reason cost posts out-convert thought leadership.
The unsubscribe mechanism the law actually requires
Every commercial electronic message must carry an unsubscribe mechanism that is free, uses the same electronic means as the message or another practicable one, stays valid for at least 60 days after you send, and is honoured without delay and no later than 10 business days after the request. Those numbers come from sections 11(1) to 11(3) of CASL.
The requirements in full
| Requirement | Source | What it means in practice |
|---|---|---|
| Readily performed | CRTC guidance | Simple, quick and easy. One or two clicks, no login, no survey |
| Free of charge | s. 11(1) | No cost, and no requirement to call a paid line |
| Same electronic means | s. 11(1) | An emailed message needs an email-based opt out. SMS can use a reply of STOP |
| Valid at least 60 days | s. 11(2) | The link must still work two months after the send |
| Honoured within 10 business days | s. 11(3) | Without delay, and 10 business days is the outer limit, not the target |
| Identification and mailing address | s. 6 and CRTC guidance | Valid for at least 60 days after sending. A street address, PO box, rural route or general delivery address all qualify |
| Hyperlink allowed if space is tight | CRTC guidance | A clearly placed link to a free, readily accessible web page carrying the full information |
What breaks it
- Requiring a login to unsubscribe. Not readily performed.
- An unsubscribe that only opens a preference centre with no “unsubscribe from everything” option. Preference centres are allowed, but there has to be a way out of all of it.
- Links that expire with the campaign. If your platform kills links when you archive a campaign, you have a 60-day problem.
- Processing in a weekly batch. Technically inside the 10 business day limit, usually. Also the single most common way to annoy someone into complaining about you.
- A separate list that the unsubscribe does not touch. Someone unsubscribes from the newsletter and keeps getting promotional blasts. From their side it reads as a company ignoring the request.
Process unsubscribes immediately and globally unless the person chose a narrower option themselves. The law permits 10 business days. Almost every email platform can do it in under a second, and the gap between what is legal and what is decent is where complaints are born.
Records of consent: what to store and for how long
Section 13 of CASL puts the burden of proving consent on the person who claims it. That is you. An enforcement inquiry does not ask whether you believe someone consented, it asks you to produce the evidence, and an empty database is the same as no consent.
The seven fields to store per subscriber
- Email address.
- Consent type: express, or the specific implied-consent category and the date the clock started.
- Timestamp of the opt-in, with timezone.
- Source: the exact URL, form name or offline context.
- The wording shown to them at the moment they consented. Store the string, not a reference to your current form, because your form will change.
- IP address for web signups, and the confirmation click timestamp if you use double opt-in.
- Withdrawal date if they later unsubscribe.
That fifth field is the one almost nobody keeps and the one that matters most. If your form said something different in 2023 than it says today, proving what someone agreed to in 2023 requires the 2023 wording. Version your consent language and store the version ID against each record.
How long to keep it
Keep consent records for as long as the person is on your list, and for a period after they leave that covers the limitation period for enforcement. CASL’s limitation period for the CRTC to commence proceedings is three years from the day the subject matter of the proceedings arose, so a common practical approach is to retain records for at least three years past the last message sent. Confirm the retention period that fits your situation with counsel, and balance it against your privacy obligations to not keep personal information longer than necessary.
Offline and in-person consent
Oral express consent is valid under CASL, which matters for trades, clinics and anyone collecting addresses at a counter or a trade show. The difficulty is evidential, not legal. If you take consent verbally, record who asked, what was said, when, and who confirmed it, and send a confirmation email the same day so there is a written artifact. A business card dropped in a bowl is not consent unless the sign beside the bowl said what you would send and the person could read it.
Purchased lists, scraped addresses and LinkedIn exports
Do not buy a list, do not scrape addresses, and do not export your LinkedIn connections into a mailing tool. None of those produce consent you can prove, and two of them create a second violation on top of the first.
Why a purchased list cannot work
Consent under CASL is given to a specific sender for a specific purpose. A list vendor cannot transfer consent that was never given to you. Even where a vendor claims the addresses are opted in, you would have to produce, per address, the wording shown and the timestamp, from a third party with no incentive to keep it. Section 13 makes that your problem, not theirs.
Address harvesting is separately prohibited
CASL also amended PIPEDA to prohibit the collection of electronic addresses through computer programs without consent, which is why scraping is enforced by the Office of the Privacy Commissioner rather than only the CRTC. Running a scraper over a directory of Canadian businesses is a distinct contravention from sending to the addresses afterwards.
The conspicuous publication exception, and its limits
Section 10(9)(b) is the one people reach for to justify cold email, and it is narrower than it looks. Three conditions all have to hold: the recipient conspicuously published the address or had it published, the publication carries no statement that they do not want unsolicited commercial messages, and your message is relevant to that person’s business, role, functions or duties.
So emailing a plumbing company’s published info address about commercial plumbing supply is arguably within it. Emailing the same address about a marketing retainer is a harder argument. Emailing a personal address you found on a conference attendee list is not within it at all. And if their contact page says “no unsolicited offers,” the exception closes entirely.
The honest framing: conspicuous publication is a defence you might run, not a list-building strategy you should design around.
What to do instead
- Run the cold outreach as one-to-one sales, not as a campaign. A researched, individually written message about that specific business is a different animal from a blast, and it is how most Canadian B2B actually starts.
- Use paid traffic into a consented signup rather than paying for addresses. You buy attention and they give consent, which is the legal order of operations.
- Build the list off content. Slower, but every address arrives with a timestamp, a source URL and a stored consent string.
- Partner with someone who already has the list and have them send on your behalf, with their consent, naming you as the person on whose behalf the message is sent per section 10(1).
The penalties, and who has actually been fined
Maximum administrative monetary penalties under CASL are $1 million CAD per violation for an individual and $10 million CAD per violation for a business. Those are statutory maximums rather than typical outcomes, and the CRTC has in practice negotiated undertakings and issued penalties well below the ceiling.
| Exposure | Amount (CAD) | Notes |
|---|---|---|
| Maximum AMP, individual | $1,000,000 per violation | Statutory maximum, not a typical penalty |
| Maximum AMP, business | $10,000,000 per violation | Statutory maximum |
| Officer and director liability | Varies | CASL contains provisions extending liability to directors and officers who directed or acquiesced in a violation |
| Vicarious liability for employees | Varies | An employer can be liable for violations by employees acting within the scope of their employment |
| Due diligence defence | N/A | CASL provides that a person who establishes due diligence is not liable, which is the legal reason a documented compliance program is worth building |
The practical risk for a small Canadian business is not a ten million dollar penalty. It is a complaint, an inquiry, a demand to produce consent records you do not have, and the cost and disruption of responding to it. That is avoidable with a signup form and a spreadsheet, which is why the due diligence point above is the one to act on.
Note for Quebec and for personal information generally
CASL is not your only obligation. Collecting an email address is collecting personal information, so federal privacy law applies, and Quebec’s Law 25 adds its own requirements for organisations handling personal information of Quebec residents. If you sell into Quebec, treat consent language and privacy notices as a combined problem rather than solving CASL in isolation.
Eight mistakes Canadian businesses make
- Treating a quote request as a two-year licence. Section 10(10)(e) gives you six months for an inquiry. Everything after that needs express consent.
- Importing the old customer spreadsheet. Purchases from four years ago are outside the two-year window. Those contacts need to opt in again before you mail them.
- One consent box covering everything. Newsletter, product updates, partner offers and event invites are different purposes. Section 10(1) asks you to state the purpose.
- Keeping no record of the wording. You can prove someone ticked a box. You cannot prove what the box said in 2022.
- No mailing address in the footer. Required, and it must stay valid for at least 60 days after you send.
- Unsubscribe that only covers one list. If the person still receives something after opting out, the complaint is coming.
- Assuming a US platform defaults are compliant. Most major platforms are built around opt-out logic because that is the US baseline. Configure them for Canada deliberately.
- Sending to role addresses you found online as a campaign. The conspicuous publication exception is narrow and relevance-dependent. A blast does not fit inside it.
A 30-minute audit you can run today
- Open your signup form. Is the consent box unchecked, separate, and specific about what you send?
- Open your last campaign. Does it name your business and carry a mailing address?
- Click your own unsubscribe link from a campaign sent more than 60 days ago. Does it still work?
- Export twenty random subscribers. Can you produce a date, a source and the consent wording for each?
- Filter your list for contacts whose last transaction was more than two years ago and whose consent is implied. Those need a re-permission campaign or removal.
If step four fails, that is the one to fix first. Everything else is a form change. Records cannot be reconstructed after the fact, so the longer you run without them the larger the eventual cleanup.
Frequently asked questions
Does CASL apply if my business is not in Canada?
CASL applies based on where the message is sent from or accessed, not only on where the business sits. Section 12(1) provides that a contravention of section 6 applies where a computer system located in Canada is used to send or access the message. If you are emailing people in Canada, assume CASL applies to you.
Is double opt-in required by CASL?
No. CASL requires express consent obtained through an opt-in mechanism, and does not mandate a confirmation email. Double opt-in is strongly recommended anyway because it produces the timestamped, address-holder-verified record that section 13 effectively asks you to be able to produce.
How long does implied consent last in Canada?
Two years from a purchase, lease, barter or accepted business opportunity, two years from the expiry of a written contract, two years from a donation, volunteer engagement or membership ending, and six months from an inquiry or application. Those periods are set out in sections 10(10), 10(13) and 10(14) of CASL.
Can I email someone whose address is on their company website?
Only if the message relates to their business, role, functions or duties, the address was conspicuously published by them or with their authorisation, and the publication carries no statement that they do not want unsolicited commercial messages. All three conditions have to hold, which makes this unsuitable as a bulk list-building method.
What has to be in the footer of a Canadian marketing email?
Identification of the sender and anyone on whose behalf the message is sent, a mailing address valid for at least 60 days after sending, and an unsubscribe mechanism that is free, readily performed, valid for 60 days and honoured within 10 business days. A hyperlink to a free, readily accessible page carrying the full information is acceptable where the message cannot hold it all.
What are the penalties for breaking CASL?
Administrative monetary penalties reach a maximum of $1 million CAD per violation for an individual and $10 million CAD per violation for a business. Those are statutory ceilings rather than typical amounts, and CASL provides a due diligence defence, which is the practical reason to maintain a documented compliance program.
Do I need separate consent for SMS?
Yes. SMS is a commercial electronic message under CASL and needs its own consent, its own identification and its own unsubscribe mechanism, which can be a reply of STOP or UNSUBSCRIBE. Consent to email is not consent to text.
What happens to my list when I sell my business?
Under section 10(12), the purchaser of a business is considered to have the existing business relationships of the seller. Express consents transfer with the business as well, but only to the extent the original consent request identified the purposes clearly. In practice, audit the consent records during diligence rather than assuming the list is clean.
The short version
Ask properly with an unchecked box that says what you will send. Record the date, the source and the exact wording you showed. Give every message your identity, a mailing address and a working unsubscribe. Convert implied consent to express before the clock runs out: two years for most relationships, six months for an inquiry. Do those four things and your list is both legal and worth more, because every address on it is someone who said yes.
If you want the signup forms, the consent records, the automation and the deliverability setup built as one system rather than assembled from plugins, that is the work. It also pairs with the content system that feeds the list in the first place, and with a funnel that turns those subscribers into clients.
Tell us about your list and how you collect it in the Wise Media intake form and we will tell you what we would fix first.
