Email campaigns are perfectly legal in Canada, but the country takes a stricter line than most. Since July 1, 2014, Canada’s Anti-Spam Legislation (CASL) has required senders to obtain consent before sending a commercial electronic message. In the United States, by contrast, you can generally email until someone opts out. If you market to Canadians, whether from Canada or abroad, CASL is the starting point.
This page is general information, not legal advice. For a specific situation, speak to a Canadian lawyer.
The three requirements of CASL
A commercial electronic message (CEM) is any electronic message that encourages participation in a commercial activity: a newsletter with offers, a promotional email, a marketing text message. To send one legally, you need:
- Consent. Either express consent (the person actively agreed) or implied consent (for example, a recent purchase). The details are covered on our page about permission to send email campaigns.
- Identification. The message must name the sender (and anyone on whose behalf it is sent) and give a mailing address plus a phone number, email address or web address. Contact details must stay valid for at least 60 days after sending.
- An unsubscribe mechanism. A simple, free way to opt out, processed without delay and within 10 business days.
Some messages, such as a quote the recipient asked for or a warranty notice, are exempt from the consent requirement, but most still need identification and an unsubscribe link.
Who enforces the rules
| Authority | Role under CASL and related law |
|---|---|
| CRTC (Canadian Radio-television and Telecommunications Commission) | Investigates unsolicited messages and issues administrative monetary penalties. |
| Competition Bureau | Targets false or misleading representations in electronic messages, such as deceptive subject lines. |
| Office of the Privacy Commissioner (OPC) | Handles address harvesting and personal information issues under PIPEDA. |
What happens if you get it wrong
CASL allows administrative monetary penalties of up to $1 million per violation for individuals and up to $10 million per violation for businesses. Directors and officers can be held personally liable, and employers are liable for violations committed by their employees. Enforcement is real: in 2021 the CRTC imposed a $75,000 penalty on an individual for sending messages without consent, the largest it had issued to an individual at the time. CASL also includes a private right of action, but it was suspended in 2017 and has not been brought into force.
Crucially, the burden of proof sits with the sender. If a complaint reaches the CRTC, you must be able to show when and how each contact gave consent.
Privacy law sits alongside CASL
CASL decides whether you may send; privacy law decides how you handle the data. PIPEDA applies to personal information collected in the course of commercial activity in most provinces. Quebec’s Law 25, with most provisions in force since September 2023, adds consent, transparency and cross-border assessment duties, enforced by the Commission d’accès à l’information with penalties that can reach $10 million or 2% of worldwide turnover. If you also mail people in the European Union, the GDPR applies to them as well.
Staying legal with Mailpro
- Collect sign-ups through double opt-in forms, which leave a time-stamped consent record.
- Every campaign includes an unsubscribe link, and unsubscribes are processed automatically, well inside the 10-business-day limit.
- Your contact data is hosted in Switzerland, outside US jurisdiction, and never sold or rented.
For a deeper look at the statute, read our guide to Canadian emailing law and the glossary entry on CASL.