CASL consent requirements

Treat a cold email to a Canadian recipient as a permission check before writing it. Under CASL, the sender generally may not email the person until the sender can show permission, and the burden sits with the sender.¹ A conspicuously published business address may support implied consent only when the recipient has not refused unsolicited messages and the email relates to the person's role.² Treat a visible address as an unconfirmed lead until the other conditions are clear.

Run the consent check

1

Ask whether the email

2

Confirm that the recipient

3

Choose the consent basis

4

Hold the send

1. Ask whether the email
2. Confirm that the recipient
3. Choose the consent basis
4. Hold the send

Before a record enters an outbound sequence, resolve the message type, consent basis, proof, and send conditions in that order.

1. Ask whether the email encourages participation in a commercial activity. Most promotional or advertising emails and texts fall within that description, and the sender must have express or implied consent before sending.³

2. Confirm that the recipient is in the Canadian audience you are contacting. A person or business that sends a commercial electronic message to Canadian residents must comply with CASL.⁴

3. Choose the consent basis before writing the message. The available paths are express consent, implied consent, or a listed exemption where one applies.⁵

4. If you cannot state the path in one sentence, hold the send. A vague sense that the contact is relevant does not give you a record to defend.

Ask yourself:

• What makes this email commercial?
• Which consent path am I relying on?
• What record would show that path to someone reviewing the send later?

Separate the consent paths

Express and implied consent need different checks. Label the path first, then test its conditions.

Express consent means the recipient agreed verbally or in writing to receive a commercial electronic message from you.⁶ That consent has no time limit unless the recipient withdraws it.⁷ Look for the agreement, the identity of the sender it covers, and the channel the recipient agreed to receive.

CASL restricts requests for express consent made through electronic messages such as email.⁸ A permission request remains subject to that restriction.

Implied consent is recognized only in certain circumstances.⁹ One route is an existing business relationship. Another can arise when the recipient has conspicuously published a business address, has not indicated a wish to refuse unsolicited commercial electronic messages, and receives a message relevant to the person's business, role, functions, or duties.² Check every condition in the published-address route before sending.

A referral can support consent for a single message when another individual refers the recipient and provides the recipient's electronic address.¹⁰ Use that route for the message it covers, then reassess the basis for anything that follows.

Build the proof

Make proof part of the send decision. The record should let another person understand why this recipient was eligible.

For an implied-consent route, a basis you cannot evidence is treated as no consent for enforcement.¹¹ Senders should be ready to provide proof of consent if asked.¹² Record when and how consent was obtained, and keep the record attached to the contact or send history.¹³

Set up a process that tracks recipient consent and gives effect to unsubscribe requests.¹⁴ Your review should answer these questions:

• What event created the consent?
• Where is the record of that event?
• Does the record support express consent, implied consent, or an exemption?
• Has the recipient withdrawn permission or refused unsolicited messages?

If the answer depends on a published address, keep the address and the context showing why the message relates to the person's role. If it depends on a referral, keep the referral details and treat the permission as limited to the single message.

Check the message before it leaves

Consent gets you to the message review. Run the finished email through a separate sender and unsubscribe check before it goes out.

A commercial electronic message must include the sender's identity, contact information, and an unsubscribe mechanism.¹⁵ Check that the recipient can tell who sent the message and how to reach that sender without opening another thread.

Place the unsubscribe mechanism at the bottom of every commercial electronic message.¹⁶ Make it easy to use, then connect it to the process that removes the recipient. A recipient must be removed from the distribution list within 10 business days after an unsubscribe request.¹⁷

Keep the consent decision and the message review separate in your workflow. A contact can have a defensible consent basis and still need a correction to the sender details or unsubscribe path before sending.

What not to do

Use these as hard stops in the review:

• Do not treat a published business address as blanket permission. The implied-consent route also depends on the absence of a refusal and relevance to the recipient's role.²
• Do not send when your implied-consent record cannot prove permission later. For enforcement, unevidenced implied consent is treated as no consent.¹¹
• Do not use a cold email to request express consent without checking the restriction on making that request through electronic messages.⁸
• Do not leave an unsubscribe request in the queue. The recipient must be removed from the distribution list within 10 business days.¹⁷
• Do not message someone who specifically told you not to.¹⁸

Before your next send, write the consent basis beside each Canadian contact and attach the record that supports it. If you cannot name the basis, show the proof, and pass the message checks, hold the send until the gap is resolved.