Treat recipient jurisdiction and message purpose as routing decisions before writing copy. The consent rules change by jurisdiction. In the United States, CAN-SPAM permits commercial email without prior consent when its requirements are met, and the law has no B2B exception.1 In Canada, CASL generally requires express or implied consent before sending, and the sender must prove permission.2 Asking for consent by email is itself a commercial electronic message.3 Build the workflow around that gate, then check identity, disclosures, and unsubscribe handling.
Classify the send
Decide whether the message is commercial and which permission path applies before building a sequence or approving a recipient.
CAN-SPAM covers commercial messages whose primary purpose is advertising or promoting a commercial product or service, including email that promotes content on commercial websites.4 The law has no B2B carve-out and no volume floor below which its rules stop applying.5
Route by jurisdiction
Use the recipient's jurisdiction as a compliance input, even when your operation sits elsewhere. Make this decision before deciding whether outreach is permitted.
CASL applies to a commercial electronic message sent from a computer within Canada or accessed by a computer in Canada.6 An organization operating solely outside Canada will, in most cases, need to comply when communicating with Canadian clients or customers.7 A cold sales email is a commercial electronic message under CASL.8
Mark the record for the applicable route. A Canadian path needs a permission check before the message enters a send queue.
Prove permission
Use a recorded permission basis as the gate for a CASL send. If the record cannot show why the message is allowed, hold it.
A compliant send requires express consent, implied consent, or a listed exemption.9 Implied consent may apply when the recipient has conspicuously published business contact information, has not indicated a wish to receive no unsolicited commercial electronic messages, and the message is relevant to the recipient's business, role, functions, or duties in a business or official capacity.10
If you rely on an existing business relationship, send within the applicable CASL time frames.11 Messages sent to enforce a right, satisfy a legal obligation, or provide notice of a legal right are exempt from CASL.12
Keep consent evidence, unsubscribe logs, and send logs with the recipient record because CASL places the burden of proof on the sender.13 Your systems also need to track consent and give effect to unsubscribe requests.14 Move on when the record contains a basis you can explain without reconstructing the decision from memory.
Build the message
Audit each field before the message goes out. The recipient should be able to identify who sent it, what the message is about, and how to stop future messages.
The From, To, Reply-To, and routing information, including the originating domain and email address, must be accurate and identify the person or business that initiated the message.15 Use accurate routing information and subject lines, include a valid postal address, provide a clear opt-out mechanism, and keep oversight of any vendor sending on your behalf.16
Each separate email that violates CAN-SPAM can incur a penalty of up to $53,088.17 Treat the field check as a release condition for every commercial message.
Make unsubscribe work
Test the unsubscribe path, the record update, and the effect on future sends before relying on the mechanism.
Under CAN-SPAM, an unsubscribe link may lead to a page where the recipient enters an email address and clicks a button.18 The mechanism must work for at least 30 days after the message, the sender must honor the request within 10 business days, and the recipient cannot be charged a fee or required to do more than reply or visit one web page.19
CASL requires commercial electronic messages to contain specified disclosures and an unsubscribe mechanism.20 Every unsubscribe request must be processed within 10 business days or less and at no cost to the recipient.21
When a test request arrives, confirm that the recipient is recorded as unsubscribed and that the send system can act on that record. Move on only after the mechanism and the record produce the same result.
What not to do
Use these as release blockers when reviewing a campaign. Each one points to a failure that can survive a superficial message check.
- Do not assume a small send falls outside CAN-SPAM. The law has no minimum send volume below which its rules stop applying.5
- Do not use false or misleading header information.22
- Do not treat a List-Unsubscribe header or an easy unsubscribe link as a complete substitute for the regulatory opt-out link requirements in the message body.23
- Do not assume that a message exempt from the CASL consent requirement is free from the other CASL requirements, including disclosures and an unsubscribe mechanism.24