What this is for#
Canada's Anti-Spam Legislation (CASL, in force since 2014) is the strictest commercial-email law in the world. It covers any "commercial electronic message" (CEM) sent to or from a Canadian recipient — so even non-Canadian businesses owe compliance the moment they email someone in Canada. Penalties go to CAD $10 million per violation for businesses and CAD $1 million for individuals.
CASL differs from CAN-SPAM in one big way: CASL is opt-in by default. You need consent before you send. CAN-SPAM is opt-out — you can send first, must allow unsubscribe. If you're emailing both audiences, CASL is the higher bar — meet it and you've automatically met CAN-SPAM.
Express vs implied consent#
Every Canadian subscriber on your list needs either express consent or a valid implied-consent category.
| Type |
Definition |
Expires |
| Express |
Subscriber actively opted in — ticked an un-pre-ticked checkbox, filled a signup form, confirmed via double opt-in |
Never (until they withdraw) |
| Implied — existing business relationship |
They bought from you, made an inquiry, or had a contract with you |
2 years after the transaction |
| Implied — non-business relationship |
They donated to your charity or volunteered |
2 years |
| Implied — membership |
They are an active member of your club, association, or political party |
While membership is active |
| Implied — conspicuous publication |
They published their business email publicly without a "no spam" notice |
Only for messages relevant to their role |
Key practical rule: the burden of proof is on you, not the regulator. If a Canadian subscriber files a complaint, you must produce when, where, and how their consent was obtained. If you can't, the consent is treated as never having existed.
What every CEM must contain#
CASL §6 requires four things in the body of every commercial email:
- Your full legal name (or operating name, if different and registered)
- A mailing address plus one of: telephone, email, or website URL
- A clear, functioning unsubscribe mechanism — link or reply-to instruction
- Unsubscribe must be honoured within 10 business days
AcelleMail handles #3 (unsubscribe link is automatic) and #4 (suppression is instant — well under the 10-day ceiling). #1 and #2 you fill in once at Account → Contact — Company info (legal name) + Address card — and AcelleMail injects both into every campaign footer.
Recording consent inside AcelleMail#
CASL audits are paperwork-heavy. The fastest way to stay defensible is to record consent origin at signup as a list custom field.
- Open Lists → [your list] → Manage list fields
- Click Create field and add a text field called
consent_source
- (Optional) Add a second text field
consent_date — type date
- In your signup form (built in Forms → [your form] → Edit), include both fields as hidden inputs pre-populated with the source (e.g.
homepage-hero-2026-05) and current date
- Confirm by opening one new subscriber after signup — both fields should be populated under the subscriber's profile
That gives you a per-subscriber record of where and when consent was obtained, queryable from the subscribers table.
For higher-stakes audits — large lists, regulated industries — turn on double opt-in under Lists → [your list] → Edit → Subscription settings. Double opt-in produces a server-side log entry every time someone confirms, which is admissible as a record of express consent. See Double Opt-In vs Single Opt-In.
The transition period is over#
CASL gave a three-year window for "implied consent from before July 2014" to ride out without action — that window closed July 1, 2017. Any consent that was implied-only on July 1, 2014, has long since expired. If you haven't audited your Canadian segment since then, do it now: anyone with neither express consent nor an active implied-consent category must be removed.
The fastest way to surface this in AcelleMail: build a segment filtered by country = Canada AND consent_source IS NULL, export to CSV, and decide row-by-row. See Advanced Segmentation Strategies for the segment builder.
Common issues#
| What you see |
What to do |
| You inherited a list and have no record of how Canadian subscribers were collected |
Segment them out and re-permission via a single confirmation email ("Do you still want to hear from us?"). Anyone who clicks confirm becomes express-consent. The rest must be removed. |
| Your form has a pre-ticked consent checkbox |
Un-tick it. CASL (and GDPR) explicitly disallow pre-ticked boxes as express consent. |
consent_source is empty for old subscribers |
Backfill what you can ("pre-2024-migration") — partial provenance is better than none. Going forward, every new signup should populate it from a hidden form field. |
What to do after#
- Verify Account → Contact has your legal name + mailing address filled in.
- If you collect Canadian subscribers, turn on double opt-in on those lists.
- Add
consent_source + consent_date custom fields to every list that collects email.
Related articles#
