Quick answer: Canada’s Anti-Spam Legislation (CASL) requires consent before you send commercial electronic messages, clear identification of who sent them, and a working unsubscribe option that is honoured within 10 business days. The CASL rules for businesses apply to email, text messages and direct messages on social media, and penalties can reach $10 million per violation for a business.
CASL is one of the strictest anti-spam laws in the world, and it affects almost every Canadian business that markets online. This guide summarizes the key rules in plain language, based on guidance from the Canadian Radio-television and Telecommunications Commission (CRTC). It is general information, not legal advice.
What is a commercial electronic message?
A commercial electronic message (CEM) is any electronic message where one of its purposes is to encourage the recipient to take part in a commercial activity. That includes offers to buy or sell products or services, promotions, discounts and many newsletters.
CEMs include emails, text messages and messages sent to similar accounts, such as direct messages on social media platforms.
What are the three core CASL requirements?
Every commercial message must meet three requirements: consent, identification and an unsubscribe mechanism.
1. Consent
You need express or implied consent before sending a CEM.
- Express consent is given actively, in writing or orally, and you must be able to prove it. Pre-checked boxes do not count, and silence is not consent.
- Implied consent comes from an existing relationship, for example within two years after a purchase or within six months after an inquiry. Abandoned shopping carts do not create implied consent.
Express consent does not expire unless the person withdraws it, which is why the CRTC recommends asking for it whenever you are unsure.
2. Identification
Each message must identify the sender and anyone the message is sent on behalf of, with contact information such as a mailing address and a phone number, email or web address. That information must remain valid for at least 60 days after the message is sent.
3. Unsubscribe mechanism
Every CEM needs a simple, quick way to unsubscribe. The mechanism must work for at least 60 days after the message is sent, and requests must be processed without delay, no later than 10 business days after they are received.
Does CASL apply to social media?
CASL generally applies to direct messages on social media but not to ordinary public posts. According to the CRTC, one-way broadcasts such as a regular post on your page generally fall outside CASL, while messages sent through closed, two-way messaging systems, such as Facebook Messenger or LinkedIn messages, are covered.
That means a promotional DM campaign needs the same consent, identification and unsubscribe rules as email. Our social media marketing service keeps paid and organic campaigns consent-first for this reason.
Not sure your email or DM campaigns are compliant? We can review your sign-up forms, consent records and templates. Get my free marketing review.
What are the penalties for breaking CASL?
The CRTC can issue administrative monetary penalties of up to $1 million per violation for individuals and up to $10 million per violation for businesses. Beyond fines, spam complaints damage your sender reputation and your brand.
CASL rules for businesses: a practical checklist
- Use unticked checkboxes for marketing consent on every form.
- Record when, where and how each person gave consent.
- Track implied consent dates so you know when they expire.
- Add your business name, mailing address and contact details to every message.
- Include a one-click unsubscribe link and process requests within 10 business days.
- Treat promotional social media DMs like email.
- Review your lists regularly and remove contacts without valid consent.
How CASL fits into good marketing
CASL is easier to follow when your marketing is built on value rather than volume. Helpful newsletters, useful guides and timely offers sent to people who asked for them perform better than mass messages anyway. If you want content that earns sign-ups, see our content marketing service, and read our Client Charter for how we handle consent and privacy.
Related reading: Your 2026 Digital Marketing Plan: A Practical Checklist for Canadian Small Businesses, Which Social Media Platforms Should Canadian Businesses Use in 2026? and How to Measure Social Media ROI: The Metrics That Actually Matter. · Alberta PIPA and your website
Frequently asked questions
Does CASL apply to business-to-business emails?
Generally yes. CASL applies to commercial electronic messages whether they go to consumers or businesses, although there are some limited exemptions. Check the CRTC guidance or get legal advice for your situation.
How long does implied consent last under CASL?
Implied consent from a purchase generally lasts two years, and implied consent from an inquiry or application lasts six months, according to CRTC guidance.
How quickly must I process an unsubscribe request?
Without delay, and no later than 10 business days after you receive it. The unsubscribe mechanism must keep working for at least 60 days after the message is sent.
Are social media posts covered by CASL?
Ordinary public posts generally are not, but promotional messages sent through direct messaging, such as Facebook Messenger or LinkedIn messages, are covered by CASL.
Sources
- CRTC: Frequently asked questions about Canada’s anti-spam legislation
- Government of Canada: Canada’s anti-spam legislation
Written by the Perfect Digital Solution team. We use AI tools to support research and drafting, and every fact in this article is checked by our team against the sources listed above.
