CASL consent requirements

Yes, for a commercial cold email to a Canadian recipient, CASL generally requires express or implied consent before sending.¹ Check why the send is allowed before treating it as a copywriting task. A public business address leaves conditions to test: implied consent can depend on how the address was published, whether the recipient refused unsolicited messages, and whether your message fits the person's business role.² If you cannot reconstruct later why the send was allowed, the problem is proof, even when the address looked public.³

Make the go or stop decision

Start with scope. These checks tell you whether to assess consent before writing or loading the message.

Classify the email first. A message that encourages participation in a commercial activity, including most promotional or advertising emails and texts, falls into the consent check.⁴

Next, check the Canadian connection. CASL regulations apply to a commercial electronic message sent from or to Canadian computers or devices in Canada.⁵

Then name the route that would allow the send. A compliant send requires express consent, implied consent, or a listed exemption.⁶ If you cannot name one for the specific recipient, stop the send.

Choose the consent route

Run express and implied consent as separate tests. They require different records and different questions.

CASL recognizes two principal types of consent: express consent and implied consent.⁷ Express consent means the recipient agreed verbally or in writing to receive a commercial electronic message from you.⁸

Ask what the recipient agreed to receive, who they agreed to receive it from, and whether the record shows that agreement. Express consent has no time limit unless the recipient withdraws it.⁹ Once a withdrawal appears, take the address out of the send path.

Do not assume the cold email can create its own express consent route. After July 1, 2014, CASL restricts requests for express consent made through electronic messages such as email.¹⁰ Treat an email asking for consent as a separate compliance question before sending it.

Test implied consent

Implied consent can support a send only when the recipient's circumstances fit a recognized route. A public address alone does not settle the decision.

CASL recognizes implied consent only in certain circumstances.¹¹ Those circumstances can include an existing business relationship or a conspicuously published business address where the recipient has not refused unsolicited messages and the message relates to the person's business, role, functions, or duties.^{12, 2}

For a published address, check each condition separately:

• Where and how was the business address published?
• Did the recipient state a wish to avoid unsolicited commercial electronic messages?
• Why does this message relate to the recipient's business role?

Write down the answer to each question before sending. If the address is public but the refusal check or role relevance is missing, the implied consent route is incomplete. Move on only when the facts fit the route and the record shows why.

Build the consent record

Build the record before the address enters an active sequence, so the decision does not depend on memory.

Senders should be ready to provide proof of consent when asked.¹³ Compliance includes systems that track recipient consent and process unsubscribe requests.¹⁴ Keep a record of when and how consent was obtained.¹⁵

For express consent, record the agreement and its channel. For implied consent, record the circumstance that creates the route, the published address or business relationship, any refusal check, and the connection between the message and the recipient's role. Another person should be able to follow your decision without asking you to remember the conversation.

Check the message controls

Consent answers whether you may send. The message still needs to identify the sender and give the recipient a workable way to leave.

CASL requires all commercial electronic messages to contain specified information.¹⁶ The message must include clear sender identification, contact information, and an unsubscribe mechanism.¹⁷

Put the unsubscribe mechanism at the bottom of every commercial electronic message.¹⁸ Route each request into the process that removes the recipient from future sends instead of leaving it in an inbox for manual review.

Before sending, ask whether the recipient can identify who sent the email, find a contact route, and unsubscribe without replying to explain the request. The unsubscribe process must remove the recipient within 10 business days after the request arrives.¹⁹

What not to do

• Do not treat a conspicuously published business address as blanket consent. The route also requires no refusal of unsolicited messages and relevance to the recipient's business role.²
• Do not send after the recipient has indicated a wish to avoid unsolicited commercial electronic messages.²
• Do not use an electronic message to request express consent without accounting for CASL's restriction on that practice after July 1, 2014.¹⁰
• Do not rely on a list or workflow that cannot track consent and unsubscribe requests.¹⁴
• Do not send when you cannot produce proof of consent if asked.¹³
• Do not leave an unsubscribe request unresolved beyond 10 business days.¹⁹

Before the next send, run each contact through scope, consent route, proof, and message controls in that order. When an answer is missing, keep the address out of the send until the answer is documented.