Canadian marketers answer to more than one law at once. CASL controls whether you may send a commercial message; PIPEDA and provincial privacy statutes control how you collect, store and transfer the personal information behind it. This page maps how the pieces fit together and what each one means for a day-to-day email program.
This is general information, not legal advice. Laws change, and a Canadian lawyer can confirm how they apply to your business.
1. CASL: the anti-spam layer
Canada’s Anti-Spam Legislation came into force on July 1, 2014. It applies to any commercial electronic message sent to or from a computer system in Canada, which means foreign companies emailing Canadians are covered too. It is technology-neutral: email, text messages and direct messages on social platforms all count.
Consent
CASL is an opt-in regime. Express consent is given actively, for example by ticking an unticked box with clear wording. Implied consent arises from certain relationships, such as a purchase in the last two years or an inquiry in the last six months. Express consent lasts until the person withdraws it; implied consent expires. Our page on getting permission under CASL goes through each type.
Content requirements
- Identify the sender and anyone on whose behalf the message is sent.
- Include a mailing address and at least one of a phone number, email address or website, valid for 60 days after sending.
- Provide an unsubscribe mechanism that is easy to use and free, and honour requests within 10 business days.
Penalties and liability
The CRTC can impose administrative monetary penalties of up to $1 million per violation for individuals and $10 million per violation for other persons, including businesses. Directors and officers can be personally liable if they directed or acquiesced in a violation. The Competition Bureau can act on misleading sender information or subject lines, and the OPC deals with email address harvesting.
2. PIPEDA: the federal privacy layer
The Personal Information Protection and Electronic Documents Act applies to private-sector organizations handling personal information in commercial activity, except where a province has substantially similar legislation (Alberta, British Columbia and Quebec have their own private-sector laws). For email marketers, PIPEDA means:
- Collect only what you need and say why you are collecting it.
- Keep information accurate and protect it with safeguards appropriate to its sensitivity.
- Remain accountable when a service provider processes data for you, including abroad, and be transparent that information may be processed in another country.
3. Quebec’s Law 25
Quebec modernized its private-sector privacy law through Law 25, with most obligations in force since September 22, 2023. Key points for marketers:
- A privacy impact assessment is required before personal information is communicated outside Quebec, including to a service provider. The transfer may proceed if the information will receive adequate protection.
- Consent must be clear, informed and given for specific purposes, and privacy policies must be published in clear terms.
- The Commission d’accès à l’information can impose administrative penalties of up to $10 million or 2% of worldwide turnover, whichever is greater.
Quebec’s Charter of the French Language also sets expectations for commercial communications in French, so many businesses send a French version to Quebec subscribers. Our guide to multilingual email marketing shows how to manage both versions in one list.
4. Where the data sits
Neither PIPEDA nor Law 25 bans storage outside Canada, but both expect you to understand the protection your provider offers. Mailpro hosts data in Switzerland on private infrastructure, outside US jurisdiction and therefore outside the reach of the US CLOUD Act. Switzerland benefits from an EU adequacy decision, which is helpful evidence when documenting a Law 25 assessment.
5. Sending from outside Canada, or beyond it
CASL applies when a message is sent to, or accessed from, a computer system in Canada. A US or European company emailing Canadian customers must therefore follow CASL, even though it may be used to looser opt-out rules at home. The reverse is also true: a Canadian business emailing customers abroad must respect the rules there. If you mail residents of the European Union, the GDPR applies to their data; if you mail US residents, the CAN-SPAM Act applies. Consent-based practices that satisfy CASL generally put you in a strong position elsewhere, but check each market’s specific requirements.
6. Text messages and other channels
Because CASL is technology-neutral, the same consent, identification and unsubscribe rules apply to marketing text messages. Separate consent for email and SMS is good practice, and a “Reply STOP” mechanism is the usual way to opt out of texts. Voice telemarketing calls are covered by a different regime, the CRTC’s Unsolicited Telecommunications Rules and the National Do Not Call List.
A compliance checklist for Canadian senders
- Record the source, date and wording of every consent.
- Track implied-consent expiry dates and ask for express consent before they lapse.
- Check that every template includes your identification block and a working unsubscribe link, ideally with automatic unsubscribe handling.
- Offer French where your audience expects it.
- Document where your email provider stores data and why that protection is adequate.
For the official detail, see our Canadian law and emailing page, and if you also send texts, read how CASL applies to SMS in Canada.