Under Canada’s Anti-Spam Legislation, permission is not a nice-to-have. It is the condition for sending any commercial email, and if a complaint arises, you must prove you had it. The good news: once you understand the two kinds of consent and how long each lasts, building a compliant list is straightforward.
General information only, not legal advice.
Express consent: the gold standard
Express consent is a clear, positive action by the person, such as ticking an unticked box or typing their email into a sign-up form that explains what they will receive. The CRTC does not accept pre-checked boxes or consent buried in terms and conditions. A valid request should state:
- the purpose, for example “monthly newsletter and promotional offers”;
- who is asking, including any business on whose behalf you are asking;
- your mailing address and a phone number, email or website;
- that the person can withdraw consent at any time.
Express consent does not expire. It remains valid until the subscriber unsubscribes. Note that you cannot email someone to ask for consent, because that request is itself a commercial electronic message.
Implied consent: useful, but temporary
| Situation | How long implied consent lasts |
|---|---|
| Purchase, lease or contract with you | 2 years from the transaction |
| Inquiry or application | 6 months from the inquiry |
| Donation, volunteer work or membership (charities, clubs, political parties) | 2 years |
| Address conspicuously published or handed to you (e.g. a business card), without a “no spam” note | While relevant to the person’s role |
The practical lesson: use the implied-consent window to invite customers to give express consent, for example in the order confirmation or a post-purchase survey. Once they opt in, the clock no longer matters.
Referrals and other special cases
CASL regulations allow a single message to someone referred to you by a person who has a relationship with both of you, provided the message discloses the referrer’s full name and states that it follows a referral. After that first message, you need consent to continue. Messages within an organization, or between organizations that have a relationship, about the recipient’s activities are also exempt. These exceptions are narrow; for ongoing marketing, express consent remains the reliable route.
Proving consent
CASL places the burden of proof on the sender. For every contact, keep the date and time of consent, the form or channel used, the exact wording shown, and the IP address where available. Double opt-in subscription in Mailpro creates this trail automatically: the subscriber confirms by clicking a link, and the confirmation is time-stamped. The difference between single and double confirmation is explained in our FAQ on opt-in versus double opt-in.
Common mistakes Canadian senders make
- Importing bought lists. Purchased addresses carry no consent you can prove. Our article on why you should never buy email lists explains the deliverability damage too.
- Letting implied consent lapse. A customer who bought 25 months ago and never opted in is no longer a valid recipient.
- Forgetting French. A consent request in English only can be unclear to a francophone subscriber in Quebec, which undermines “informed” consent.
- Slow unsubscribes. The limit is 10 business days. Mailpro processes unsubscribes immediately.
Consent and privacy go together
The data you collect with consent is personal information under PIPEDA, and under Law 25 if your subscribers are in Quebec. Explain in your privacy policy where the list is stored. With Mailpro, that is Switzerland, outside US jurisdiction, and the data is never sold or rented. For forms that collect sign-ups, see our guide to creating a CASL-friendly subscription form, and once your list is ready, move on to sending effective campaigns.