# CASL: what does Canada's anti-spam law allow?

> CASL for small businesses: express vs implied consent, the 2-year and 6-month windows, 10 business days to unsubscribe, key exceptions and penalties.

Updated on October 15, 2026 · https://app.pilotiko.com/en/glossary/casl

CASL, Canada's anti-spam legislation (LCAP in French), is the federal law that prohibits sending commercial electronic messages without the recipient's express or implied consent. Each message must also identify the sender, give a way to contact them and include a simple, free unsubscribe mechanism.

## In short
- It covers commercial electronic messages: email, text messages, direct messages.
- Implied consent: a purchase in the last 2 years or an inquiry in the last 6 months.
- Unsubscribe requests must be honoured within 10 business days.
- Maximum administrative penalty: $10 million for a business.

## What does CASL actually cover?

The Government of Canada's official site says CASL was created in 2014 to reinforce best practices in email marketing and combat spam and related cyber threats. It focuses on commercial electronic messages, meaning messages that encourage participation in a commercial activity, whether or not there is an expectation of profit [2].

Section 6 of the Act prohibits sending, or causing to be sent, a commercial electronic message to an electronic address unless the recipient has consented, expressly or by implication, and the message meets the form requirements [1]. A spring promotion that a landscaping [small business](https://app.pilotiko.com/en/glossary/sme) emails to its customer list is a commercial message; a plain invoice may not be.

## What must every commercial message include?

- Information identifying the sender and, if different, the person on whose behalf it is sent (subsection 6(2)).
- Contact information that lets the recipient readily reach the sender.
- A free unsubscribe mechanism using the same method as the message, or another electronic method if that's impractical, with an address or link that stays valid for at least 60 days after sending (section 11) [1].

## When is consent implied?

Implied consent exists, among other cases, when there is an existing business relationship. The Act defines this to include a purchase of goods or services within the **two-year** period before the message is sent, or an inquiry or application made within the **six-month** period before sending (subsections 10(9) and 10(10)) [1].

| Situation | Rule | Where to read it |
|---|---|---|
| Customer bought a service | Implied consent for 2 years after the purchase | Para. 10(10)(a) |
| Someone asked for information | Implied consent for 6 months after the inquiry | Para. 10(10)(e) |
| Quote or estimate the person requested | No prior consent required; form rules still apply | Para. 6(6)(a) |
| Confirmation of a transaction already agreed to | No prior consent required; form rules still apply | Para. 6(6)(b) |
| Voluntary newsletter sign-up | Express consent | Sections 6 and 10 |

General information only. For a specific case, read the Act or consult a lawyer.

## How do you work out when implied consent ends?

**Example: a carpet-cleaning company in Rimouski planning its fall promotion**

- Customer A: last paid cleaning on March 15, 2025 : Implied until March 15, 2027 (2 years)
- Prospect B: price inquiry on June 10, 2026 : Implied until December 10, 2026 (6 months)
- Contacts on the list : 420
- Contacts with valid express or implied consent : 310
- Contacts to remove from the promotional send : 110
- **= The October 2026 send goes to 310 of 420 contacts; the other 110 are left out of this mailing.**

## What happens after an unsubscribe request?

The sender must give effect to the request without delay, and no later than **10 business days** after it was sent, without requiring any further action from the recipient (subsection 11(3)) [1].

In practice, connect the unsubscribe link straight to your sending list, not to an inbox someone checks once a month.

## What are the penalties?

Subsection 20(4) caps the administrative monetary penalty at $1,000,000 per violation for an individual and $10,000,000 for any other person [1].

## Which mistakes are most common?

- Importing every email address from a [CRM](https://app.pilotiko.com/en/glossary/crm) into your sending tool without checking the last purchase date.
- Forgetting that promotional texts are commercial electronic messages too.
- Adding a promo to an appointment reminder, so the message is no longer solely a confirmation.
- Confusing CASL with Quebec's [Law 25](https://app.pilotiko.com/en/glossary/quebec-law-25), which governs how personal information is collected and used.
- Using an unsubscribe link that forces people to log in.

## What does Pilotiko do about CASL?

Pilotiko's appointment confirmations and reminders, which help with your [no-show rate](https://app.pilotiko.com/en/glossary/no-show-rate), are being commissioned: nothing is sent yet. In Pilotiko, any send to a customer waits for a person's approval, following the [human-in-the-loop](https://app.pilotiko.com/en/glossary/human-in-the-loop) principle.

> Coming soon: email marketing and newsletters. Consent and unsubscribe handling are built; real sending and automated sequences are still to come.

## Frequently asked questions

### Does CASL apply to text messages?

Yes. It covers commercial electronic messages sent to an electronic address, which includes email and text messages. A promotional text follows the same rules as a newsletter.

### How long does implied consent last?

Two years after a purchase or contract, and six months after an inquiry, in the cases set out in subsection 10(10). Check which case applies to each contact.

### Can I email a quote without consent?

Yes, if the person asked for that [quote](https://app.pilotiko.com/en/glossary/quote) or estimate: paragraph 6(6)(a) removes the prior-consent requirement. The identification and unsubscribe rules still apply.

### How fast must I process an unsubscribe?

Without delay, and no later than 10 business days after the request. The unsubscribe link or address must stay valid for at least 60 days after the message is sent.

### What is the maximum CASL penalty?

Administrative penalties can reach $1 million per violation for an individual and $10 million for a business. That's a ceiling; the actual amount depends on several factors listed in the Act.

## Sources

1. Justice Canada (Justice Laws), « An Act to promote the efficiency and adaptability of the Canadian economy (S.C. 2010, c. 23) », https://laws-lois.justice.gc.ca/eng/acts/E-1.6/ (accessed on 2026-10-15)
2. Government of Canada, « Canada's anti-spam legislation », https://www.fightspam.gc.ca/ (accessed on 2026-10-15)