CASL (Canada’s email law) is stricter than US CAN-SPAM. You need express consent or a limited implied type the law lists, plus clear who-you-are text and a working unsubscribe. Keep records of what people saw when they joined. Penalties can be very large; treat Canadian addresses as high-stakes.

In forceLegalIn force 1 Jul 2014

In Canada, commercial email needs provable express or statutory implied consent

Q: What happens if you do not?

CRTC has issued public CASL enforcement actions and AMPs. Recent actions should be read on the CRTC index; not every AMP is a routine marketing-email fact pattern.

Can I send marketing email to a Canadian without express opt-in under CASL?

Canada

In one sentence

Canada needs you can prove — not US-style “mail until they .”

Plain English

(Canada’s email law) is stricter than US . You need express or a limited implied type the law lists, plus clear who-you-are text and a working . Keep records of what people saw when they joined. Penalties can be very large; treat Canadian addresses as high-stakes.

Why it matters. US playbooks on Canadian lists create legal and brand risk. If you cannot show , you should not send marketing there.

Dotted words open definitions. Full glossary.

What to do

Your move — not a lecture

Part platform, part you

The platform covers the mechanical bit. The judgement is still yours.

store timestamps and honour unsubscribes when configured for fields.

Your part: Whether was valid, which statutory implied route applies, and proof artefacts.

What to do first

Export 20 Canadian profiles at random. For each, write type, source, and date. Any blank is a hole.

You can skip this if: You never send commercial email to Canada.

Who this applies to

Anyone sending CEMs to recipients in Canada, including foreign senders and B2B.

Checklist

01Prefer express with clear purpose language; avoid pre-ticked boxes.
02Map implied to the statutory relationship or publication routes only.
03Keep form copy, timestamp, source and withdrawal history.
04Treat CAD $10M as a ceiling in the statute, not a forecast of your fine.

That’s enough to act. Sources and exact wording are below for counsel, bosses, or AI tools that need a citation. Not legal advice.

Proof

Exact position, enforcement, sources

For records and people who will check you. Skip if Monday’s move is already clear.

The exact position

Canada's Anti-Spam Legislation forbids sending a commercial electronic message without and prescribed identification content. Consent may be express or implied, but implied only through routes Parliament listed—not a vague "reasonable expectations" test. The person asserting consent bears the burden of proof. Corporate administrative monetary penalties can reach CAD $10 million per violation; individual ceilings are CAD $1 million. These are maxima, not automatic tariffs.

What happens if you do not

CRTC has issued public enforcement actions and AMPs. Recent actions should be read on the CRTC index; not every AMP is a routine marketing-email fact pattern.

Sources

CASL (S.C. 2010, c. 23) commercial electronic message and consent provisions
Published 1 Jul 2014Read primary source
CRTC, CASL guidance and enforcement
No publisher dateRead primary source

History of this page

2 Aug 2026Re-verified against primary sources (bulk/auth/consent core).
2 Aug 2026Added from statute and CRTC materials.

Awkward questions

Who is this actually for?

People who ship email and are too busy to re-read every PDF: week-one marketers, lifecycle/CRM, deliverability, multi-country ops, DTC brands, agencies — on Klaviyo, Mailchimp, Braze, HubSpot, SFMC, or something else. Pick your tool and geos so product-specific pages only appear when they match. EU and UK are first-class filters. Not for people who sell tools about email and need a fake score to demo.

Why only ~40 rules? Isn’t that… thin?

On purpose. A wall of 400 undated “best practices” is how you look busy and still get burned. Every page needs a primary source we actually read. Thin and checkable beats fat and folklore. Europe, bulk inbox rules, measurement honesty, and protocol topics like BIMI/DMARC policy are on the shelf when we can cite them — not every Member State and not every vendor myth. Coverage map lists what we still refuse to invent.

Is this legal advice?

No. If it were, you’d have a billable hour and a longer PDF. This is a dated operator reference written by an email geek. Confirm anything high-stakes with counsel who knows your facts. Same for “will this make me compliant?” — no tool does that. Lawyers and judges do. We say what the sources say and what to do first on Monday.

Why no trust score out of 100?

Because we refuse to invent a number you can’t audit. Fake scores sell seed tests and panic. You get findings, dates, and links. If that feels less exciting than a red dial, good — you’re not the red-dial customer.

Why should I trust you more than my ESP’s blog?

ESPs sell seats. Seed-score vendors sell fear. AI invents citations when nobody watches. We sell nothing today — no pixels, no placement scores, no affiliate — so we can say when a tool is the problem. A human verifies, dates, and corrects in public. Tools may help draft; they do not ship unsourced claims. Check the primary links. Fail that test and leave.

Do I need an account?

No. Filters live in this browser and the URL. Share the link. That’s it. Accounts come later only if they earn it — not so we can nurture you about email.

I’m an agency. Where’s multi-client mode?

We tried a client-name CRM on the setup card. It made the product feel like work before it felt useful. Role filters + copy link + one-page brief (optional PDF title) is enough for now. Complexity comes back when the free shelf is habit, not before.

Is the quiet changelog a bug?

No. Quiet means nothing material moved. We don’t invent urgency so the homepage looks “alive.” Sticky risks still show what usually needs a person when the market is still.