CASL: Canada's Anti-Spam Law on Consent, Unsubscribe Rules, and Penalties

Canada's Anti-Spam Legislation (CASL) generally requires a business to have the recipient's consent, whether express or implied, before sending a commercial electronic message, and requires every such message to identify the sender and include a working unsubscribe mechanism that must be honoured within 10 business days.

Information last verified on 2026-09-24. This article has not yet been reviewed by a licensed lawyer.

This article covers Canada's Anti-Spam Legislation, formally An Act to promote the efficiency and adaptability of the Canadian economy by regulating certain activities that discourage reliance on electronic means of carrying out commercial activities, S.C. 2010, c. 23, commonly known as CASL. CASL is federal law and applies the same way in every province and territory; there is no province by province variation to track. The Act's own text does not contain a short title clause naming CASL as its official short title, so this article treats CASL as the law's common name rather than its codified title.

This article does not cover Canada's National Do Not Call List, a separate federal scheme that governs live and automated telephone calls rather than electronic messages. Section 6(8) of CASL itself excludes an interactive two way voice communication between individuals, a fax sent to a telephone account, and a voice recording sent to a telephone account from its message rules. See Do Not Call List Canada: Registration, Exemptions, and Complaints for that topic. It also does not cover the broader consent rules for collecting and using personal information under Canada's private sector privacy law; see PIPEDA Explained for that separate statute. For an overview of Canadian privacy law generally, see Canada Privacy Law.

What Counts as a Commercial Electronic Message

Section 1(2) of the Act defines a commercial electronic message this way:

"a commercial electronic message is an electronic message that, having regard to the content of the message, the hyperlinks in the message to content on a website or other database, or the contact information contained in the message, it would be reasonable to conclude has as its purpose, or one of its purposes, to encourage participation in a commercial activity, including an electronic message that (a) offers to purchase, sell, barter or lease a product, goods, a service, land or an interest or right in land; (b) offers to provide a business, investment or gaming opportunity; (c) advertises or promotes anything referred to in paragraph (a) or (b); or (d) promotes a person ... as being a person who does anything referred to in any of paragraphs (a) to (c), or who intends to do so." (S.C. 2010, c. 23, s. 1(2))

An electronic message is defined broadly enough to include email, text messages, and other similar systems of telecommunication. A message does not have to be purely commercial to count. If encouraging commercial activity is even one of several purposes, the message is a commercial electronic message.

One detail surprises businesses: a message that only asks permission to send marketing later is itself a commercial electronic message. Section 1(3) states that "an electronic message that contains a request for consent to send a message described in subsection (2) is also considered to be a commercial electronic message." A permission request email has to follow the same rules as the marketing it is asking to send.

The Three Part Rule Before Sending a Commercial Electronic Message

Section 6(1) sets the baseline rule. A person must not send a commercial electronic message:

"unless (a) the person to whom the message is sent has consented to receiving it, whether the consent is express or implied; and (b) the message complies with subsection (2)." (s. 6(1))

Subsection (2) adds three requirements a compliant message must meet. It must set out prescribed information that identifies the person who sent the message and, if different, the person on whose behalf it is sent; information that lets the recipient readily contact one of those persons; and an unsubscribe mechanism in accordance with subsection 11(1).

Put together, this is the three part rule: consent, identification of the sender, and an unsubscribe mechanism. The contact information required under paragraph (2)(b) has its own separate deadline. Section 6(3) requires that this contact information stay valid for a minimum of 60 days after the message is sent, which is a different figure from the 10 business day window for processing an unsubscribe request, covered below.

Express and Implied Consent: The 2 Year and 6 Month Windows

Consent under CASL can be express, where the recipient affirmatively agreed, or implied. Implied consent arises only in the situations listed in section 10(9). The most common is an existing business relationship or an existing non-business relationship between the sender and recipient, both defined in section 10. Section 10(10) defines an existing business relationship to include:

"the purchase or lease of a product, goods, a service, land or an interest or right in land, within the two-year period immediately before the day on which the message was sent." (s. 10(10)(a))

The same subsection also covers a shorter window for a bare inquiry:

"an inquiry or application, within the six-month period immediately before the day on which the message was sent, made by the person to whom the message is sent to any of those other persons, in respect of anything mentioned in any of paragraphs (a) to (c)." (s. 10(10)(e))

Section 10(13) defines an existing non-business relationship using the same 2 year window for a donation, gift, volunteer work, or attendance at a meeting, where the other party is a registered charity, a political party or organization, or a candidate for publicly elected office, and for membership in a club, association, or voluntary organization. In short: a completed transaction, contract, donation, or membership gives implied consent for 2 years, while a bare inquiry with no completed transaction gives implied consent for only 6 months. Under section 10(14), where a purchase, lease, donation, or gift involves ongoing use under a subscription, account, loan, or similar relationship, the 2 year period begins when that relationship ends, and for a membership it begins when the membership ends.

Section 10(9) lists three other routes to implied consent. Consent is implied where the recipient has conspicuously published the electronic address, or has disclosed it to the sender, without indicating a wish not to receive unsolicited commercial electronic messages, but in both cases only if the message is relevant to the person's business, role, functions, or duties in a business or official capacity. Consent is also implied where the message is sent in circumstances set out in the regulations.

These figures are specific to CASL. Canada's National Do Not Call List uses a different pair of windows, 18 months and 6 months, for its own existing business relationship exemption to telemarketing calls; the two schemes should never be treated as interchangeable. See Do Not Call List Canada for the DNCL's own timing rules.

The Unsubscribe Mechanism and the 10 Business Day Rule

Section 11(1) requires the unsubscribe mechanism in a commercial electronic message to be free to use, available through the same electronic means the message was sent by or, if using those means is not practicable, another electronic means, and to specify an electronic address or web link to which the request may be sent. Section 11(2) requires that address or link to stay valid for at least 60 days after the message is sent. Once a recipient uses it, the sender's clock starts running. Section 11(3) requires the sender, and the person on whose behalf the message was sent if different, to:

"ensure that effect is given to an indication sent in accordance with paragraph (1)(b) without delay, and in any event no later than 10 business days after the indication has been sent, without any further action being required on the part of the person who so indicated." (s. 11(3))

That is 10 business days, not 10 calendar days, and the recipient should not have to do anything further, such as confirming the request a second time, for it to take effect.

Exemptions From the Consent Rule

Sections 6(5) and 6(6) create two different kinds of exemption. Section 6(5) takes a message outside section 6 entirely, so neither the consent rule nor the identification and unsubscribe requirements apply. It covers a commercial electronic message:

"(a) that is sent by or on behalf of an individual to another individual with whom they have a personal or family relationship, as defined in the regulations; (b) that is sent to a person who is engaged in a commercial activity and consists solely of an inquiry or application related to that activity; or (c) that is of a class, or is sent in circumstances, specified in the regulations." (s. 6(5))

The Electronic Commerce Protection Regulations, SOR/2013-221, define personal and family relationship for paragraph (a). A family relationship means individuals related through a marriage, common law partnership, or any legal parent child relationship who have had direct, voluntary, two way communication. Other relatives can fit only the personal relationship definition, which also requires direct, voluntary, two way communications plus circumstances from which it is reasonable to conclude a personal relationship exists.

Section 6(6) is narrower. It removes only the consent requirement in paragraph 6(1)(a), so the message must still identify the sender and include an unsubscribe mechanism. It covers a message that solely does one of the following: provides a quote or estimate the recipient requested; facilitates, completes, or confirms a commercial transaction the recipient previously agreed to enter into; provides warranty, product recall, or safety or security information about a product, goods, or a service the recipient uses, has used, or has purchased; provides factual information about the recipient's ongoing subscription, membership, account, loan, or similar relationship, or ongoing use or purchase under one; provides information directly related to an employment relationship or related benefit plan the recipient is currently involved in; delivers a product, goods, or a service, including updates or upgrades, the recipient is entitled to receive under a previous transaction; or communicates for a purpose specified in the regulations.

Installing Software on Someone's Computer

CASL is not only about email. Section 8 addresses installing a computer program on someone else's computer system in the course of a commercial activity. Section 8(1) provides that a person must not install, or cause to be installed, a computer program on another person's computer system, or cause an electronic message to be sent from that system once installed:

"unless (a) the person has obtained the express consent of the owner or an authorized user of the computer system and complies with subsection 11(5); or (b) the person is acting in accordance with a court order." (s. 8(1))

Section 8(2) limits this to situations connected to Canada, where the computer system is located in Canada, or the person installing the program is in Canada or acting under the direction of someone in Canada. The disclosure rules for seeking that consent are in section 10. Under section 10(4), extra disclosure, made clearly and prominently and separately from the licence agreement, is required when the program performs a function listed in section 10(5) that the installer knows and intends will cause the computer to operate contrary to the reasonable expectations of the owner or an authorized user. The listed functions are collecting personal information stored on the computer; interfering with the owner's or user's control of it; changing or interfering with settings, preferences, or commands without their knowledge; changing or interfering with stored data in a way that obstructs lawful access to it; causing the computer to communicate with another system or device without authorization; installing a program that a third party may activate without their knowledge; and any other function specified in the regulations. Under section 10(7), the consent request requirements in section 10(1) and (3) do not apply to installing an update or upgrade to a program that was expressly consented to, if the person is entitled to receive it under the terms of that consent and it is installed in accordance with those terms. Section 10(8) also treats a person as expressly consenting to programs such as cookies, HTML code, Java Scripts, and operating systems where their conduct makes it reasonable to believe they consent.

Penalties: Administrative Monetary Penalties, Not Criminal Fines

CASL's best known figure is its administrative monetary penalty, or AMP, ceiling. Section 20(4) sets it out:

"The maximum penalty for a violation is $1,000,000 in the case of an individual, and $10,000,000 in the case of any other person." (s. 20(4))

These are civil penalties pursued through the CRTC's enforcement process, not criminal convictions. A separate and much smaller set of fines exists under section 46(1), on summary conviction, for the offences in sections 42 and 43: failing to comply with a preservation demand or a notice to produce, failing to assist the execution of a warrant, obstructing or hindering an investigator, or giving an investigator false or misleading information:

"(a) to a fine of not more than $10,000 for a first offence or $25,000 for a subsequent offence, in the case of an individual; or (b) to a fine of not more than $100,000 for a first offence or $250,000 for a subsequent offence, in the case of any other person." (s. 46(1))

These two penalty schemes should not be confused. The multi million dollar figure that gets quoted as CASL's headline penalty is the AMP under section 20(4), for the underlying spam, consent, or software violations. The much smaller section 46 fines apply only to those section 42 and 43 offences, not to an ordinary failure to get consent or include an unsubscribe link. Under section 46(2), a person cannot be convicted of a section 42 offence if they establish that they exercised due diligence to prevent it.

There Is No Private Right of Action Under CASL

CASL was drafted to include a private right of action, a set of provisions in sections 47 through 51 that would have let an individual sue directly over a CASL violation. Those provisions were never brought into force. The Act's own coming into force footnote states:

"sections 47 to 51, 55, 68, subsection 89(2) and section 90 repealed before coming into force, see 2008, c. 20, s. 3."

The private right of action heading itself now reads "Private Right of Action 47 [Repealed before coming into force, 2008, c. 20, s. 3]," with the same repeal note repeating for sections 48 through 51. The 2008 provision referenced is the Statutes Repeal Act. Under it, the Minister of Justice must table a report each year listing provisions that were assented to nine years or more before the preceding December 31 and are still not in force, and each listed provision is repealed on December 31 of that year unless it comes into force by then or either House of Parliament adopts a resolution that it not be repealed. CASL received royal assent on December 15, 2010, and its private right of action sections were repealed through that process before ever coming into force, rather than merely delayed. There is currently no private lawsuit route under CASL. Enforcement rests with federal regulators, principally the CRTC, alongside roles for the Competition Bureau and the Office of the Privacy Commissioner of Canada in the conduct their own mandates cover.

How to Report Spam

Consumers and businesses can report a suspected CASL violation to the Spam Reporting Centre, using the online form on the federal government's Canada's Anti-Spam Legislation page. That page, the federal government's anti-spam site run by Innovation, Science and Economic Development Canada, directs reports to the Spam Reporting Centre and hosts the reporting form directly. The reporting page says each report becomes part of the intelligence the Spam Reporting Centre gathers, which supports enforcement by the three CASL enforcement agencies: the CRTC, the Competition Bureau, and the Office of the Privacy Commissioner of Canada.

For Businesses: A Compliance Summary

Everything above applies directly to any business or individual sending commercial electronic messages in or into Canada. In short, a sender needs consent, whether express or an implied consent that has not expired under the 2 year or 6 month windows; a compliant message identifying the sender and offering working contact information valid for at least 60 days; a free unsubscribe mechanism honoured within 10 business days; express consent before installing any computer program on someone else's system; and awareness that a violation can bring an administrative monetary penalty of up to $1,000,000 for an individual or $10,000,000 for any other person, with no private lawsuit risk but three separate federal regulators able to act.

Quebec businesses have an additional, separate compliance regime to track for personal information generally; see Quebec Law 25 Explained for that provincial statute, which applies alongside CASL rather than in place of it.

Disclaimer: This article provides general information about Canada's Anti-Spam Legislation, S.C. 2010, c. 23, and the Electronic Commerce Protection Regulations, SOR/2013-221, current as of September 2026. It is not legal advice. It does not cover Canada's National Do Not Call List or provincial privacy statutes, which are addressed in separate articles. Consult a lawyer licensed in your province, or contact the CRTC, the Competition Bureau, or the Office of the Privacy Commissioner of Canada, for advice on a specific situation.

Frequently Asked Questions

What counts as a commercial electronic message under CASL?

A commercial electronic message is any electronic message, such as an email or text, that has as its purpose, or one of its purposes, encouraging participation in a commercial activity, under section 1(2) of the Act. Even a message that only asks for consent to send marketing later counts as a commercial electronic message under section 1(3).

Do I need consent before sending marketing emails or texts in Canada?

Yes. Section 6(1) requires either express or implied consent before sending a commercial electronic message. Implied consent from a completed transaction, contract, donation, or membership lasts 2 years; implied consent from a bare inquiry lasts only 6 months, under section 10.

How long do I have to process an unsubscribe request under CASL?

No later than 10 business days after the request is sent, under section 11(3), and the recipient should not need to take any further action for the unsubscribe to take effect.

Can someone sue a company directly under CASL for spamming them?

No. CASL's private right of action, in sections 47 through 51, was never brought into force and has since been repealed under the Statutes Repeal Act, which repeals a provision that is still not in force roughly a decade after royal assent unless it is brought into force or either House of Parliament resolves to keep it. Enforcement is limited to federal regulators; a reader can report a suspected violation to the Spam Reporting Centre instead.

What are the penalties for violating CASL?

An administrative monetary penalty of up to $1,000,000 for an individual or $10,000,000 for any other person, under section 20(4). These are civil penalties issued through the CRTC's process, separate from a much smaller set of fines under section 46 that apply only to the offences in sections 42 and 43, such as ignoring a preservation demand or notice to produce, obstructing an investigation, or giving an investigator false information.

How do I report a spam message or CASL violation?

Through the Spam Reporting Centre's online form, hosted on the federal government's Canada's Anti-Spam Legislation page, run by Innovation, Science and Economic Development Canada.