CASL
Canada's anti-spam law — commercial email needs consent you can prove, plus identification and unsubscribe rules.
Say it out loud
“Canada is the strict one. Consent has to be provable, and the kind we get from a purchase expires.”
CASL (Canada's Anti-Spam Legislation) requires consent that is either express or fits a defined implied category, plus sender identification and a working unsubscribe. Crucially, implied consent has a clock on it: the categories expire, and when they do the permission is gone rather than merely old.
- 2 years
- implied consent from a purchase
- CASL, S.C. 2010 c. 23
- 6 months
- implied consent from an enquiry
- CASL, S.C. 2010 c. 23
- CAD 10M
- maximum penalty, business
- CASL, S.C. 2010 c. 23
You must be able to show what they were told at the time.
Two years from the purchase or contract, then it is gone.
Only where the address is published without a no-marketing statement, and only about their role.
Yours
Nobody does this for you.
What goes wrong
Treating a Canadian segment as “basically the US”. The penalties are an order of magnitude larger than most teams assume, and the two-year clock means a list that was compliant last year silently is not this year.
The dated rules behind this
A definition is not a citation. These are the pages with the primary source, the date it was published, and what to do about it.
See also
Where this sits
Stop 1, you get the address. Someone hands you an email address, and the terms of that handover decide everything after it.