CASL-Compliant SMS and Email Marketing in Canada

If you send commercial texts or emails to people in Canada, Canada's Anti-Spam Legislation (CASL) applies to you, even if your business is based elsewhere. In force since 2014, CASL sets rules for consent, identification and unsubscribing, and it is enforced by the Canadian Radio-television and Telecommunications Commission (CRTC), with the Competition Bureau and the Office of the Privacy Commissioner also playing roles.

CASL is often described as one of the strictest anti-spam laws in the world. The good news is that its requirements are clear, and a well-designed program can meet them without much ongoing effort. This guide explains how. It is general information, not legal advice.

What CASL covers

CASL applies to commercial electronic messages (CEMs): electronic messages that encourage participation in a commercial activity. That includes:

• Marketing texts and SMS offers
• Promotional emails and newsletters with commercial content
• Instant messages and social media direct messages with a commercial purpose

It applies when a computer system in Canada is used to send or access the message, so messages to Canadian recipients are generally covered regardless of where the sender is located.

The three requirements

Every CEM must meet three conditions:

1. Consent: you have express or implied consent to send it.
2. Identification: the message identifies who sent it and on whose behalf.
3. Unsubscribe: the message includes a working unsubscribe mechanism.

1. Consent: express or implied

Express consent is when a person actively agrees to receive CEMs from you. To be valid under CASL, a request for express consent must state:

• The purpose for which consent is sought (for example, receiving marketing texts)
• Who is seeking consent, and on whose behalf if different
• Contact information for the person seeking consent: mailing address and a phone number, email or web address
• That the person can withdraw consent at any time

Express consent must be an opt-in. Pre-checked boxes do not count. Once obtained, express consent does not expire unless the person withdraws it.

Implied consent exists in specific situations defined in the law, including:

• An existing business relationship from a purchase, lease or contract within the past two years
• An inquiry or application within the past six months
• An existing non-business relationship, such as with a registered charity or club, within defined time limits
• Conspicuous publication of an email address, without a statement refusing messages, where your message relates to the person's role

Implied consent is time-limited. Track the relevant dates for each contact and convert implied consent into express consent when you can, for example by asking customers to opt in at checkout.

2. Identification

Each message must identify:

• The name of the sender, and the person on whose behalf it is sent if different
• Contact information that remains valid for at least 60 days after the message: a mailing address and a phone number, email address or web address

For SMS, where space is limited, CASL allows this information to be provided through a link to a web page that is readily accessible, at no cost.

3. Unsubscribe

Every CEM must include an unsubscribe mechanism that:

• Allows the recipient to unsubscribe using the same electronic means the message was sent by, if practicable, or another electronic means
• Is easy to use and costs the recipient nothing
• Is processed within 10 business days, without further cost or effort

For texts, the simplest approach is "Reply STOP to unsubscribe", combined with immediate processing.

Turning implied consent into express consent

Because implied consent expires, the most valuable CASL habit is converting customers to express consent while you still have a relationship with them. Practical ways to do this:

• At checkout: add an unchecked box, "Send me offers by text and email", with the required identification details and a note that they can unsubscribe at any time.
• On your website: a sign-up form for offers, with the purpose, your business name, contact details and the right to withdraw stated next to the unchecked box.
• In-store or at events: a tablet sign-up form or a QR code linked to a short opt-in page.
• Loyalty programs: make marketing messages an optional benefit, with clear consent wording.

Track the source of each consent in your CRM. When implied consent for a contact is about to expire and they have not opted in, stop sending CEMs to them rather than hoping no one notices.

Agencies, franchises and multi-brand businesses

CASL requires the message to identify both the sender and the person on whose behalf it is sent. If an agency, franchisor or parent company sends messages for a local business, each message, or the linked identification page, should name both. Consent also needs to cover the brand doing the marketing. A franchisee's customer list may not automatically allow the franchisor to market to those customers, and the reverse is also true. Map out who collects consent for whom before you launch a joint campaign.

Penalties

CASL carries administrative monetary penalties of up to $1 million per violation for individuals and up to $10 million per violation for businesses. The CRTC has issued penalties and accepted undertakings from businesses of various sizes. Directors and officers can be personally liable in some cases. The private right of action contained in the original law has never been brought into force.

Canadian text messaging: other considerations

• Carrier rules: Canadian carriers and the industry's common short code program have their own guidelines for consent, HELP and STOP keywords and content. Your SMS provider will apply these.
• Quebec: Quebec's Law 25 has strengthened privacy rules in the province, and the Charter of the French Language affects commercial communication. If you market in Quebec, offer French and review consent and privacy notices.
• Privacy law: Outside Quebec, PIPEDA and some provincial laws govern personal information in the private sector.
• Time zones: Canada spans six time zones. Schedule texts by recipient location, not head office.

A CASL-compliant SMS opt-in example

Yes, send me offers and updates by text from [Business Name], [address], [website]. Msg & data rates may apply. I can unsubscribe at any time by replying STOP.

Use an unchecked box, record the timestamp, source and wording, and send a confirmation text:

[Business]: You're subscribed to offers by text. Reply STOP to unsubscribe. Info: [link]

Record-keeping

Under CASL, the sender bears the burden of proving consent. Keep:

• The date, time and method of each consent
• The wording shown when consent was obtained
• Purchase or inquiry dates supporting implied consent
• Unsubscribe requests and when they were processed

A CRM or messaging platform that logs all of this automatically is the easiest way to stay compliant.

Common CASL mistakes

• Sending "just one" message to ask for consent by email or text (a request for consent sent electronically is itself a CEM)
• Treating any old contact as implied consent, long after the two-year or six-month limits expire
• Pre-checked consent boxes
• Unsubscribe links that require logging in
• Taking longer than 10 business days to process unsubscribes
• Not identifying the business on whose behalf the message is sent, for example when an agency sends for a client

What does a compliant program cost?

These figures are positioned below typical Canadian agency rates. Contact us for an exact quote.

How DND Teams helps Canadian businesses

We set up compliant messaging programs for businesses in Toronto, Vancouver, Calgary and Montreal, including consent forms, confirmation flows and campaign management. See our bulk SMS services, our Canada SMS compliance guide, or read about WhatsApp marketing for Canadian small businesses.

Prices shown are indicative "starting from" figures in local currency and exclude taxes and third-party charges (such as Meta or carrier fees) unless stated. Contact us for an exact quote. This article is general information, not legal advice, and reflects our understanding as of October 2026.