Email Marketing and CASL Consent: A Guide for Small Businesses

Oct 14

5 min read

Email is one of the most affordable ways for a small business to stay in touch with customers, and in Canada it comes with clear rules. Canada's Anti-Spam Legislation (CASL) sets out when you can send marketing messages, what each message must include and how people can opt out.

The rules also match good marketing: people who chose to hear from you are the audience you want. Here is how CASL consent works and how to build a list you can rely on.

What CASL covers

CASL applies to commercial electronic messages (CEMs). A message is a CEM if one of its purposes is to encourage the recipient to take part in a commercial activity, such as buying a product or booking a service.

Channels: CASL covers messages sent to an electronic address, including email, text messages, instant messages and social media direct messages. Ordinary public posts are generally not CEMs.
Three requirements: every CEM needs consent, identification of the sender and an unsubscribe mechanism.
Requests for consent: an electronic message asking for consent is itself a CEM, so you generally need implied consent before emailing someone to ask for permission.
Enforcement: the Canadian Radio-television and Telecommunications Commission (CRTC), the Competition Bureau and the Office of the Privacy Commissioner of Canada share enforcement. At the time of writing, the maximum administrative monetary penalty is $1 million per violation for an individual and $10 million per violation for a business.

Express consent and implied consent

Express consent means the person actively agreed to receive your messages, for example by ticking an empty box on a sign-up form that explains what they will receive. It does not expire, but the person can withdraw it at any time.

Implied consent applies only in specific situations, and most of it has a time limit. Common examples include:

Customers: a purchase or lease from your business generally gives implied consent for two years after the most recent transaction.
Inquiries: someone who asked about your products or services, for example by requesting a quote, gives implied consent for six months after the inquiry.
Published or shared addresses: implied consent can also apply when a person conspicuously publishes their email address, such as on a company website, or hands you their business card without saying they do not want such messages. Your message must relate to their business role or duties.

Because implied consent runs out, invite these contacts to give express consent while it is still valid.

Build your list the right way

Use clear sign-up forms. Add them to your website or checkout and say what people will receive, such as a monthly newsletter or seasonal offers.
Leave the box unchecked. A pre-checked box does not count as consent because it assumes agreement.
Keep marketing consent separate. Do not bundle it with your terms and conditions; customers must be able to accept your terms of sale and still decline marketing messages.
Include the required details. Each request for consent must explain its purpose, identify your business (including a mailing address and a phone number, email address or web address) and state that the person can withdraw consent at any time.
Collect in-person sign-ups in writing. A paper or tablet form at a counter or trade show is easier to prove than verbal consent.
Do not buy or rent email lists. You must be able to prove consent, and you are unlikely to show that the people on a purchased list agreed to hear from you.
Consider double opt-in. A confirmation email to new subscribers checks that the address is real and strengthens your records.

What every marketing email must include

Who you are: your business name, and the name of anyone on whose behalf you send the message.
How to reach you: your mailing address plus at least one of a phone number that reaches a person or voicemail, an email address or a web address. These details must stay valid for at least 60 days after you send the message.
An easy way to unsubscribe: the mechanism must be simple to use, cost the recipient nothing and keep working for at least 60 days after the message is sent. You must honour an unsubscribe request without delay, and no later than 10 business days after the person sends it.
Clear choices: let people opt out of all your marketing messages, or of one type of message if you offer several.
Honest content: the Competition Act prohibits false or misleading representations in the sender information, subject line, content and web addresses of electronic messages.

Some messages do not need consent if that is all they do, such as a requested quote, an order confirmation or a product recall or safety notice. They still need sender identification and an unsubscribe mechanism.

Keep records that prove consent

Under CASL, the person who claims to have consent must prove it. Your records, whether in a spreadsheet or your email software, should capture:

the date and time the person gave consent
how they gave it, such as a website form or paper sign-up sheet
the purpose and the exact wording they saw, with a saved copy of each version of your form
for implied consent, the date of the last purchase or inquiry, so you know when it ends
unsubscribe requests and the date you processed each one

CASL does not set a period for keeping consent records, so keep them for as long as you send messages to that person. Written procedures can also help you show due diligence if a complaint arises.

Send emails people want to read

Keep your promise: send what you described at sign-up, as often as you said.
Plan useful content: answers to common questions, seasonal tips and service news.
Watch the signals: track clicks, replies, unsubscribes and complaints, and adjust your content and timing.
Protect personal information: privacy law also covers the email addresses you collect. Depending on where and how you operate, that may be the federal privacy law (PIPEDA) or a provincial law such as Alberta's Personal Information Protection Act (PIPA). Collect only what you need, explain how you use it and keep it secure.

How First Global Citizen can help

We help small businesses set up email marketing built on consent: sign-up forms and consent wording, a simple system for recording consent and unsubscribes, email templates with the required sender and unsubscribe details, and a practical content calendar. Each project has a fixed fee in a written proposal, and we make no promises about open rates or sales.

We do not provide legal advice. If you need a legal review of your consent process or privacy policy, we can coordinate with independent licensed professionals. Learn more about our marketing and digital presence services, see how we work, or book a free consultation.

This article is general information only. It is not legal, tax, accounting or financial advice. Fees and requirements can change, so confirm current details with the relevant government agency or registry. For advice about your situation, consult a qualified professional.