Does CASL apply if my company is not in Canada?

It can. CASL applies where a computer system located in Canada is used to send or to access the message, so a sender based elsewhere emailing someone in Canada is within scope. Sender location is not what decides it.

Is CASL stricter than CAN-SPAM?

On the point that matters most, yes. CAN-SPAM is an opt-out regime: you may send until the recipient asks you to stop. CASL is a consent regime: express or implied consent has to exist before the first message. The unsubscribe timing is similar, at 10 business days under both.

How long does implied consent last under CASL?

Two years from the most recent purchase or contract, and six months from an inquiry about a contemplated purchase. Each new qualifying transaction restarts the clock, so an active customer relationship keeps renewing implied consent while a dormant one lets it lapse.

JaxSuite AI

What Is CASL?

TL;DR

CASL, the Canadian Anti-Spam Legislation, is the federal law governing commercial electronic messages sent to or accessed in Canada. It requires consent before a message is sent, identification of the sender, and a working unsubscribe mechanism. Consent has to exist before first contact, not merely be available afterwards.

What does CASL require in a commercial email?

Three things together: consent, whether express or implied, identification of the sender and of anyone the message is sent on behalf of with contact information that stays valid, and an unsubscribe mechanism. Section 11 is specific about the mechanism. The address or link has to remain valid for at least 60 days after the message is sent, and the request must be given effect without delay and no later than 10 business days, with no further action required from the person who asked.

The consent requirement is what separates CASL from the American approach. CAN-SPAM permits sending until someone opts out; CASL treats the first unconsented message as the violation. A programme built for one and pointed at the other fails on the first send rather than on the first complaint.

When is consent implied under CASL?

Implied consent is time-limited and comes from a defined relationship. An existing business relationship gives two years from the most recent purchase, contract or similar transaction. An inquiry about a contemplated purchase gives six months from that inquiry. When the window closes, so does the permission, whatever the state of the relationship feels like.

The conspicuous publication route is the one B2B senders reach for, and it is narrower than it looks. Consent is implied where the recipient conspicuously published the address, the publication carried no statement refusing unsolicited commercial messages, and the message is relevant to the business role, functions or duties of the person receiving it. The CRTC has treated this as a higher bar than an address simply being findable, so scraping a page is not the same as meeting the test.

What are the penalties under CASL?

Administrative monetary penalties run to a maximum of 1 million Canadian dollars per violation for an individual and 10 million for an organisation. Officers and directors can be liable for violations by a company, and a company can be liable for what its employees do in the course of their work, so responsibility does not sit with a single sender.

The practical exposure is evidential rather than theoretical: the sender carries the burden of showing consent existed. That is a plain-language summary of the statute and not legal advice, and the part worth taking to Canadian counsel is your consent record, because that is what an enforcement file turns on.

FAQ

Frequently asked questions

It can. CASL applies where a computer system located in Canada is used to send or to access the message, so a sender based elsewhere emailing someone in Canada is within scope. Sender location is not what decides it.