CASL (Canada's Anti-Spam Legislation)
Also known as: CASL, Canada anti-spam law, Canadian anti-spam legislation, Canada spam law
CASL, Canada's Anti-Spam Legislation, controls how businesses send commercial electronic messages like marketing emails and texts.
It requires consent, clear sender identification, and a working unsubscribe link, and it carries penalties of up to $10 million per violation for businesses. While it's often called the world's toughest anti-spam law, its biggest weapon, a private right to sue, was suspended before it ever took effect.
CASL (Canada's Anti-Spam Legislation), explained at three levels
At home
Think of CASL as a guest list for your inbox and phone. A business can only send you commercial emails or texts if you put it on the list by agreeing, or if you've dealt with it recently. Every message must name the sender and include a working unsubscribe link, and once you take the business off your list, it has 10 business days to stop.
At work
CASL is a federal law that regulates commercial electronic messages, meaning any email, text, or direct message that encourages someone to buy something or do business. Before sending one to a person in Canada, a business needs consent, must identify itself, and must include an unsubscribe mechanism. The law also covers installing software on someone's device. Businesses care because penalties reach $10 million per violation, even for senders outside Canada.
At home
CASL's core mechanism is consent, which comes in two forms. Express consent is a clear yes, such as ticking an unchecked box, and it lasts until you withdraw it. Implied consent comes from an existing business relationship: a purchase or contract in the past two years, or an inquiry in the past six months. Each new purchase restarts the two-year clock. When implied consent lapses, the business needs your express consent to keep messaging you.
At work
A compliant message needs three things: valid consent, identification of the sender and anyone it's sent on behalf of, and an unsubscribe mechanism that keeps working for at least 60 days after sending. The sender carries the burden of proving consent, so records of when, where, and how each person opted in are central. Some messages need no consent, such as quotes the recipient asked for, receipts, and warranty or safety notices, but they still need identification and an unsubscribe option.
At home
CASL also covers software. Installing a computer program on your device in the course of commercial activity generally needs your express consent, and programs that do things you might not expect, such as collecting personal information, changing settings, or making your device contact other systems, need a specific disclosure that you acknowledge. The law also bans altering transmission data, such as silently redirecting your browser. While the email rules get most attention, in my view the software rules target some of the sneakiest practices.
At work
CASL is an opt-in regime, unlike the US CAN-SPAM Act, which lets businesses send until recipients opt out. Liability reaches beyond the sender: directors and officers can be personally liable, and businesses can be vicariously liable for employees and agents. The CRTC enforces mainly through administrative monetary penalties, and a due diligence defence depends on documented policies, training, and consent records. The private right of action has never been brought into force, but it remains in the statute and could still be revived.
Real-world examples
At home
Marcus bought a coffee maker online and started getting weekly promotional emails from the retailer. Two years later, without his express consent, the retailer was required to stop. He'd never ticked the box agreeing to ongoing marketing, so the emails ended when the implied consent period ran out.
At work
Nadia manages marketing at a Vancouver outdoor-gear company that bought an email list from a partner. Her compliance review found no consent records for most of the contacts. Rather than risk CASL penalties, she sent only to customers with documented consent and built a sign-up campaign to grow the list properly.
How it compares
| feature | CASL (Canada's Anti-Spam Legislation) | CAN-SPAM (US) |
|---|---|---|
| Consent model | Opt-in (express or implied consent required) | Opt-out (can send until recipient unsubscribes) |
| Covers | Email, text, social media messages, software installs | Commercial email mainly |
| Unsubscribe deadline | 10 business days | 10 business days |
| Maximum penalty | $10 million per violation for businesses | Per-email penalties set by the FTC |
| Private lawsuits | Suspended | Limited, mostly to internet providers |
CASL requires permission before you send; CAN-SPAM mostly requires you to stop when asked.
For analysts
Consent records are the part of CASL most businesses neglect. I'd make sure your marketing platform stores when, where, and how each person opted in, because without that record your consent effectively doesn't exist in an investigation.
History & origin
Parliament passed CASL in December 2010, and its main provisions came into force on July 1, 2014. Rules on installing software without consent followed on January 15, 2015. A private right of action, which would have let individuals sue for violations, was scheduled for July 2017 but was suspended indefinitely shortly before it began, after business groups raised concerns about class-action exposure. Enforcement falls mainly to the Canadian Radio-television and Telecommunications Commission (CRTC), alongside the Competition Bureau and the Privacy Commissioner. The CRTC has issued penalties against companies for sending messages without consent or without working unsubscribe mechanisms. In my opinion, CASL's real effect has been cultural: Canadian marketers learned to treat consent as an asset rather than a hurdle.