CASL Compliance: How to Review Marketing Communications in Canada

Canada's Anti-Spam Legislation (CASL) is among the strictest anti-spam laws in the world. Unlike CAN-SPAM in the US (which allows opt-out), CASL requires opt-in consent before sending commercial electronic messages (CEMs). Penalties reach up to $10 million per violation for businesses and $1 million for individuals. The Canadian Radio-television and Telecommunications Commission (CRTC) actively enforces CASL, and the private right of action — while suspended — may be activated in the future.

For marketing teams, CASL compliance isn't just about having a consent checkbox on your signup form. It requires documented consent records, compliant message content (identification, contact information, and unsubscribe mechanism in every CEM), proper consent management across your entire marketing stack, and regular review of your compliance processes.

Most organizations get the broad strokes right — they know they need consent. Where they fail is in the details: implied consent that has expired, consent records that can't prove when and how consent was obtained, unsubscribe mechanisms that don't work within the required timeframe, and messages that don't include all required identification elements.

What CASL Requires

The Three Requirements for Every CEM

Every commercial electronic message must meet all three requirements:

Consent Types

Critical rule: Implied consent expires. Express consent does not (unless withdrawn). Organizations that rely on implied consent without tracking expiry dates are at constant risk of non-compliance.

What Counts as a Commercial Electronic Message?

CASL's definition is broad. A CEM is any electronic message (email, text, social media message) that has as one of its purposes encouraging participation in a commercial activity. This includes:

• Marketing emails and newsletters
• Promotional text messages
• Social media direct messages promoting products or services
• Messages containing offers, promotions, or discounts
• Messages promoting a person or organization commercially

Exceptions (not CEMs under CASL):

• Transactional messages (order confirmations, shipping notifications, account alerts)
• Messages providing information requested by the recipient
• Messages enforcing legal rights or obligations
• Messages between individuals with a personal relationship

Identification Requirements

Every CEM must include:

Unsubscribe Requirements

Where Marketing Teams Fail CASL

1. Expired Implied Consent

The most common compliance gap. A customer purchased 26 months ago. Their implied consent expired at 24 months. You're still sending them marketing emails. Every email after the 24-month mark is a CASL violation.

How to prevent: Track implied consent expiry dates in your CRM or email platform. Set automated reminders to convert implied consent to express consent before expiry. Run re-consent campaigns for contacts approaching expiry.

2. Inadequate Consent Records

CASL places the burden of proof on the sender. If someone complains, you must prove you had consent at the time you sent the message. This means maintaining records of:

• When consent was obtained (date and time)
• How consent was obtained (web form, verbal, written, at an event)
• What the person consented to (the specific consent language they agreed to)
• Who obtained consent (which organization, which form, which campaign)

Common failure: Organizations know they obtained consent but can't produce the record. "They signed up on our website" isn't sufficient — you need the actual record showing the consent language, the date, and the mechanism.

3. Missing Identification Elements

Emails that clearly come from the brand but don't include all required identification elements:

• No physical mailing address (the most commonly missing element)
• Sender name is a department or product name that doesn't identify the legal entity
• No contact information beyond the email itself
• Messages sent on behalf of another organization without identifying both parties

4. Non-Compliant Unsubscribe Mechanisms

• Unsubscribe links that are broken or lead to error pages
• Mechanisms that require the recipient to log into an account to unsubscribe
• "Manage preferences" pages that don't include a clear option to unsubscribe from all
• Processing that takes longer than 10 business days
• Unsubscribe mechanisms that expire before the 60-day minimum availability

5. Third-Party and Partner Marketing

Organizations that share contacts with partners or affiliates without proper consent transfer. CASL consent is specific to the sender — consent to receive messages from Company A doesn't automatically extend to Company B, even if they're business partners.

6. Software Installation and Updates

CASL also covers the installation of computer programs. Software updates, apps, and plugins must have express consent for installation. Auto-updates without consent can violate CASL, even if the user originally consented to install the software.

Building a CASL Compliance Review Process

Step 1: Consent Audit

Review your entire contact database for consent status:

Step 2: Message Compliance Checklist

For every commercial electronic message before sending:

Consent:

• Recipient has valid, documented consent (express or non-expired implied)
• Consent record is accessible if challenged
• Consent is specific to this sender (not transferred from another organization)

Identification:

• Sender name clearly identifies the organization
• Physical mailing address included
• At least one additional contact method (phone, email, or web address)
• If sent on behalf of another, both parties identified

Unsubscribe:

• Unsubscribe mechanism is present, visible, and functional
• Mechanism is free and doesn't require more than identification to use
• Mechanism will be functional for at least 60 days
• Unsubscribe requests will be processed within 10 business days
• No conditions or barriers to unsubscribing

Content:

• Message purpose is clear
• No misleading subject lines or sender information
• If promotional, clearly identifiable as such

Step 3: Automate Consent Tracking

Set up your CRM or email platform to:

• Record consent type (express/implied) and date for every contact
• Calculate and track implied consent expiry dates
• Flag contacts approaching implied consent expiry (60 days before)
• Trigger re-consent campaigns automatically
• Suppress contacts with expired or unknown consent from marketing sends
• Process unsubscribe requests immediately (not at the 10-day limit)

Step 4: Template Compliance

Create compliant email templates that include all required elements by default:

• Sender identification block (organization name, address, contact info)
• Unsubscribe link (prominently placed, not in 6pt font at the very bottom)
• Clear identification of the sending organization

Review templates quarterly to ensure they still meet CASL requirements.

Step 5: Regular Compliance Audits

Using AI to Review Marketing Communications

What AI Can Check

• Identification completeness — verify sender name, mailing address, and contact information are present in every message
• Unsubscribe presence — confirm an unsubscribe mechanism is included and prominently placed
• Misleading content — flag subject lines or sender information that could be misleading
• CEM classification — assess whether a message qualifies as a CEM under CASL
• Template compliance — check that email templates include all required CASL elements
• Language consistency — verify compliance language is consistent across campaigns

What AI Cannot Check

• Whether consent actually exists for a specific recipient
• Whether implied consent has expired for a specific contact
• Whether the unsubscribe mechanism technically works (requires clicking)
• Whether consent records are adequately documented in your CRM
• Legal determination of whether a specific message is exempt from CASL

Practical Example

In TeamBench, you could configure a reviewer:

Reviewer name: CASL Marketing Communications Reviewer

System prompt:

You are a CASL compliance reviewer for Canadian marketing communications. Review commercial electronic messages (emails, texts, social media messages) against Canada's Anti-Spam Legislation requirements. Check for: sender identification (organization name, physical mailing address, at least one additional contact method), unsubscribe mechanism (present, prominent, free, no conditions), clear purpose identification, non-misleading subject lines and sender information, and proper identification when sending on behalf of another organization. Flag missing elements with the specific CASL section reference and suggest compliant alternatives. Use Canadian English. Note: you cannot verify consent status — flag consent as requiring separate verification.

Evaluation criteria:

• Identification Completeness (weight: 3) — Sender name, mailing address, contact information all present
• Unsubscribe Compliance (weight: 3) — Mechanism present, prominent, functional, no barriers
• Non-Misleading (weight: 2) — Subject line and sender information accurate and clear
• Content Clarity (weight: 1) — Purpose of the message is clear
• Template Standards (weight: 1) — Consistent formatting, professional presentation

Quality gate: Minimum score: 85 (high threshold given CASL penalty severity).

Upload CASL guidance from the CRTC and your organization's CASL compliance policy into a Knowledge Base.

The Cost of Non-Compliance

Beyond penalties, CASL enforcement actions are public. The CRTC publishes enforcement decisions, creating reputational risk.

Frequently Asked Questions

Does CASL apply to B2B communications?

Yes. CASL applies to all commercial electronic messages regardless of whether the recipient is a consumer or a business. However, the "conspicuous publication" implied consent provision may apply to B2B communications — if someone's business email is published on their company website for professional purposes, you may have implied consent to send relevant business communications.

What about messages sent from outside Canada?

CASL applies to messages sent to or from a Canadian computer system. If you're outside Canada sending to Canadian recipients, CASL applies. If you're in Canada sending to international recipients, CASL also applies. The extraterritorial reach is broad.

Can I use pre-checked consent boxes?

No. CASL requires express consent, which means the recipient must take a positive action to consent. Pre-checked boxes don't constitute express consent. The consent mechanism must require the person to actively opt in.

What about transactional emails?

Transactional messages (order confirmations, shipping notifications, account alerts, password resets) are not CEMs and don't require consent under CASL. However, if you include promotional content in a transactional email, the entire message may be classified as a CEM. Keep transactional and promotional content separate.

How do I handle contacts from before CASL?

CASL included a transitional period (now expired) for pre-existing contacts. Today, you must have either express consent or valid implied consent for every contact. If you can't document consent for a pre-CASL contact, you need to run a re-consent campaign or stop sending to them.

Do social media messages fall under CASL?

Yes — if the message is electronic and has a commercial purpose. Direct messages on LinkedIn, Facebook, Instagram, or other platforms promoting your products or services are CEMs under CASL and require consent, identification, and an unsubscribe mechanism.

What consent record is "good enough"?

At minimum: the date and time consent was obtained, the method (web form, verbal, written), the specific consent language the person agreed to, and the identity of the person. For web forms: capture a timestamp, the form URL, the consent checkbox language, and the submitter's details. Store these records permanently.

Can consent be transferred if my company is acquired?

Consent may transfer in the context of a corporate acquisition, but this isn't automatic. The terms of the consent, the nature of the transaction, and the relationship between the organizations all matter. Seek legal advice for consent transfer in M&A situations.

Key Takeaways

• CASL requires opt-in consent — not opt-out. Every commercial electronic message needs express or valid implied consent before sending.
• Implied consent expires — 2 years from last purchase/contract, 6 months from inquiry. Track expiry dates and convert to express consent before they lapse.
• Every CEM needs three elements: consent, identification (name + address + contact info), and a functional unsubscribe mechanism (processed within 10 business days).
• The burden of proof is on the sender. If challenged, you must prove you had consent. Maintain detailed consent records: date, method, language, and submitter.
• Penalties are severe — up to $10 million per violation for businesses. The CRTC actively enforces and publishes enforcement actions.
• Common failures include expired implied consent, inadequate consent records, missing mailing addresses in emails, and non-functional unsubscribe mechanisms.
• Audit monthly: review consent database for expired consents, test unsubscribe mechanisms, and verify template compliance.
• AI-assisted review can check identification completeness, unsubscribe presence, and misleading content, but cannot verify consent status — that requires your CRM and consent records.

---

This article provides general information about CASL compliance and is not legal advice. Always consult the CRTC's CASL guidance and seek qualified legal advice for your specific situation.