Rules
How to Write CASL Compliant Email Persuasion That Still Sells
CASL compliant email persuasion has to carry consent records, sender identity and a working opt-out. Here is what the law demands before the copy does its job.
What to take away
- CASL is federal law enforced by the CRTC. Every commercial electronic message needs consent, a sender identity, a contact address and a working unsubscribe.
- Express consent is the durable kind. Implied consent comes from an existing business relationship or a conspicuously published address, and it expires.
- Consent records decide enforcement outcomes, so the wording shown at opt-in and its date matter as much as the copy.
- The CRTC can issue a notice of violation, publish it, and pursue directors personally.
- Clear disclosure does not weaken a sales email. It removes the doubt that stops a reader from clicking.
Who has jurisdiction over a Canadian send
Canada's Anti-Spam Legislation applies to any commercial electronic message sent from Canada or opened on a device in Canada. The CRTC enforces it. A Toronto retailer writing to Ontario buyers and an agency in Vancouver writing to clients face one federal rule. A sender outside the country is caught when the message reaches a Canadian inbox. The full text of CASL is the version to quote when a platform claims otherwise.
A private right of action was scheduled for 2017 and suspended before it took effect, so complaints run through the regulator rather than the courts. That does not make the rules soft. It narrows the risk to one question: can you show, on paper, that the person who received the email agreed to receive it? Consent behaves like any other commitment, and the drivers that decide whether a promise holds are set out in commitment and consistency.
What a compliant message must disclose
CASL compliant email persuasion starts in the footer, not in the subject line. Three items are mandatory, and each has a failure mode that auditors see often.
| Element | What it must contain | Common failure |
|---|---|---|
| Sender identity | The legal name of the sender and of any party on whose behalf the message is sent | A brand nickname that matches no registered entity |
| Contact address | A mailing address, or another method such as a phone number the recipient can readily use | Only a link to a website contact form |
| Unsubscribe | A clear and prominent opt-out that keeps working for at least 60 days after the message is sent | A mechanism that stops responding once the campaign ends |
The unsubscribe mechanism is where audits most often fail. A recipient has to be able to complete it without creating an account, answering a survey or waiting on a phone line. The 60-day figure is a floor, not a target. Honour a withdrawal that arrives later, because refusing on a technicality is how a routine complaint becomes a published finding.
Claims inside the message fall under a second set of rules. A subject line that promises a result the product cannot deliver invites a complaint under misleading advertising law. Proof claims lifted from nowhere are the usual trigger. Messages that overstate what the numbers support are the subject of Social proof ethics.
A footer that reads like fine print invites a spam report. A footer that reads like a signature does not.
Records to keep
Consent is only as good as the record behind it. When a complaint arrives, the CRTC looks for evidence that the address was added with permission. Keep five things:
- The date and time the address was added.
- The source, such as a checkout box, a webinar form or a paper sign-up sheet.
- The exact wording the person saw when they consented.
- The type of consent, and for implied consent the transaction behind it.
- Every withdrawal, with the date it took effect.
Implied consent has a shelf life. A purchase or a signed contract supports it for 24 months from the last transaction. A business inquiry supports it for six months. The Act sets no fixed retention period, so hold the record while you rely on the consent, and a little longer.
Consent records and records of what the message claimed belong together. What a reader is owed either way appears in Informational influence ethics.
What happens if you do not
The CRTC issues a notice of violation. It names the sender and sets a deadline for a response. Decisions and undertakings are published, so the name travels further than the campaign did. Directors and officers can be held liable for a corporation's breach.
Misleading claims in the message also fall under the Competition Act, and the provisions on false or misleading representations cover the same email. An inflated promise is therefore two problems, not one.
Where the rules differ by place
CASL is federal, so the consent rule does not change at the Ontario or British Columbia border. The law around it does. Quebec's Charter of the French Language requires commercial advertising to be in French, so a national list that reaches Quebec addresses needs French treatment.
Provincial privacy statutes govern storage and use. One consent standard for the country, with a Quebec overlay, is the workable pattern.
Common questions
Does a pre-checked box count as express consent? No. Express consent needs a positive action, so a box that is already ticked does not meet the test. Ask the recipient to tick it themselves.
How quickly must an unsubscribe request take effect? The Act requires it to be given effect without delay, and no later than 10 business days after the request. A slower process is a breach even if it eventually works.
Who is liable if I buy a list from a supplier? You are. Consent attaches to the sender, and a contract that promises a clean list does not move the duty. A supplier's confidence is not a defence, which is the distinction drawn in Authority compared with expertise.
