Who does this apply to?

Anyone relying on implied consent or mailing Canadians with standard ESP footers.

In forceLegalIn force 1 Jul 2014

In Canada, relationship implied consent expires and unsubscribes take ten business days

Q: How long does CASL implied consent last, and how fast must I honour Canadian unsubscribes?

Under CASL's existing-business-relationship route, qualifying purchases and similar events generally support implied consent for two years; qualifying inquiries generally support six months. Express consent does not expire merely because those clocks run out—it lasts until withdrawal unless limited. CEMs must identify the sender, keep contact and unsubscribe details valid for at least 60 days after the message, and complete unsubscribe requests without delay and no later than ten business days.

Q: In plain English?

Under CASL, implied consent is time-limited: roughly two years after certain purchases or six months after inquiries (check the exact statutory basis for your case). Express consent lasts until withdrawn. Honour unsubscribes within ten business days at most. “They bought once in 2019” is not forever.

Q: What happens if you do not?

CRTC actions have included failures around consent proof and unsubscribe practices. Read current notices rather than recycling old blog summaries.

How long does CASL implied consent last, and how fast must I honour Canadian unsubscribes?

Canada

In one sentence

Canadian implied expires (about two years after a purchase, shorter for inquiries) — unsubscribes must complete within ten business days.

Plain English

Under , implied is time-limited: roughly two years after certain purchases or six months after inquiries (check the exact statutory basis for your case). Express consent lasts until withdrawn. Honour unsubscribes within ten business days at most. “They bought once in 2019” is not forever.

Why it matters. Expired implied is a silent landmine for legacy lists and migration projects.

Dotted words open definitions. Full glossary.

What to do

Your move — not a lecture

Part platform, part you

The platform covers the mechanical bit. The judgement is still yours.

can suppress quickly; configure -aware footers and 10-business-day SLAs.

Your part: Dating the relationship event that started the clock, and not confusing routes.

What to do first

In your , segment Canadians whose last qualifying purchase is older than two years and who lack express . That segment is the implied-consent time bomb.

You can skip this if: You only mail Canadians with current express .

Who this applies to

Anyone relying on implied or mailing Canadians with standard footers.

Checklist

01Store the event date that supports implied , not only "signed up."
02Re- before clocks expire if the relationship still has value.
03Honour unsubscribes within ten business days; operationally aim for same day.
04Keep identification and working for 60 days after each send.

That’s enough to act. Sources and exact wording are below for counsel, bosses, or AI tools that need a citation. Not legal advice.

Proof

Exact position, enforcement, sources

For records and people who will check you. Skip if Monday’s move is already clear.

The exact position

Under 's existing-business-relationship route, qualifying purchases and similar events generally support implied for two years; qualifying inquiries generally support six months. Express consent does not expire merely because those clocks run out—it lasts until withdrawal unless limited. CEMs must identify the sender, keep contact and details valid for at least 60 days after the message, and complete unsubscribe requests without delay and no later than ten business days.

What happens if you do not

CRTC actions have included failures around proof and practices. Read current notices rather than recycling old blog summaries.

Sources

CASL sections on implied consent periods and unsubscribe (official consolidation)
Published 1 Jul 2014Read primary source
CRTC CASL guidance
No publisher dateRead primary source

In Canada, commercial email needs provable express or statutory implied consentIn force

History of this page

2 Aug 2026Added clocks and unsubscribe SLA.

Awkward questions

Who is this actually for?

People who ship email and are too busy to re-read every PDF: week-one marketers, lifecycle/CRM, deliverability, multi-country ops, DTC brands, agencies — on Klaviyo, Mailchimp, Braze, HubSpot, SFMC, or something else. Pick your tool and geos so product-specific pages only appear when they match. EU and UK are first-class filters. Not for people who sell tools about email and need a fake score to demo.

Why only ~40 rules? Isn’t that… thin?

On purpose. A wall of 400 undated “best practices” is how you look busy and still get burned. Every page needs a primary source we actually read. Thin and checkable beats fat and folklore. Europe, bulk inbox rules, measurement honesty, and protocol topics like BIMI/DMARC policy are on the shelf when we can cite them — not every Member State and not every vendor myth. Coverage map lists what we still refuse to invent.

Is this legal advice?

No. If it were, you’d have a billable hour and a longer PDF. This is a dated operator reference written by an email geek. Confirm anything high-stakes with counsel who knows your facts. Same for “will this make me compliant?” — no tool does that. Lawyers and judges do. We say what the sources say and what to do first on Monday.

Why no trust score out of 100?

Because we refuse to invent a number you can’t audit. Fake scores sell seed tests and panic. You get findings, dates, and links. If that feels less exciting than a red dial, good — you’re not the red-dial customer.

Why should I trust you more than my ESP’s blog?

ESPs sell seats. Seed-score vendors sell fear. AI invents citations when nobody watches. We sell nothing today — no pixels, no placement scores, no affiliate — so we can say when a tool is the problem. A human verifies, dates, and corrects in public. Tools may help draft; they do not ship unsourced claims. Check the primary links. Fail that test and leave.

Do I need an account?

No. Filters live in this browser and the URL. Share the link. That’s it. Accounts come later only if they earn it — not so we can nurture you about email.

I’m an agency. Where’s multi-client mode?

We tried a client-name CRM on the setup card. It made the product feel like work before it felt useful. Role filters + copy link + one-page brief (optional PDF title) is enough for now. Complexity comes back when the free shelf is habit, not before.

Is the quiet changelog a bug?

No. Quiet means nothing material moved. We don’t invent urgency so the homepage looks “alive.” Sticky risks still show what usually needs a person when the market is still.