CASL and Email Extraction: What Canada's Anti-Spam Law Means for Your List

What Is CASL?

Canada's Anti-Spam Legislation (CASL) is one of the strictest anti-spam laws in the world. It regulates commercial electronic messages (CEMs) sent to or from Canada, including emails, texts and social media messages.

CASL matters for extracted email lists because it requires consent before sending commercial messages, not just an opt-out mechanism after the fact. This is a stricter standard than the US CAN-SPAM Act, which allows sending to anyone as long as you include an unsubscribe option.

If you extract email addresses from files and any of the recipients are in Canada, or if you or your organisation is in Canada, CASL likely applies to your outreach.

How CASL Differs from CAN-SPAM

The key difference is consent timing:

CAN-SPAM (United States): You may send commercial email to anyone. The recipient can opt out after receiving your message. You must honour opt-out requests within 10 business days.

CASL (Canada): You must have consent before sending the first commercial email. Sending without consent is a violation, regardless of whether you include an unsubscribe option.

This means an extracted email list that would be legal to send to under CAN-SPAM may violate CASL if any recipients are Canadian and you lack prior consent.

Types of Consent Under CASL

CASL recognises two types of consent:

Express consent

Express consent means the person explicitly agreed to receive commercial emails from you. They took a clear action: checking a box, signing up through a form, or verbally agreeing in a recorded conversation.

Express consent does not expire. Once someone gives express consent, you may continue sending until they withdraw it (unsubscribe).

Express consent must be:

• Informed. The person must know what they are consenting to: who will send the messages, what type of messages they will receive, and that they can withdraw consent at any time.
• Opt-in. Pre-checked boxes do not count. The person must take an affirmative action to consent.
• Documented. You must be able to demonstrate that consent was obtained if challenged. Keep records of when and how each person consented.

Implied consent

Implied consent exists when there is an existing relationship between you and the recipient, even though they did not explicitly agree to receive your emails. CASL recognises implied consent in specific situations:

Existing business relationship. If someone purchased a product or service from you, entered into a contract with you, or accepted a business opportunity from you, implied consent exists for two years from the date of the last transaction or the end of the contract.

Existing non-business relationship. If someone donated to your charity, volunteered for your organisation, or was a member of your organisation, implied consent exists for two years from the last activity.

Enquiry. If someone made an enquiry about your products or services, implied consent exists for six months from the date of the enquiry.

Published address. If someone's email address is conspicuously published (on a website, in a directory, in a publication) and they have not indicated that they do not want to receive unsolicited commercial messages, you may send them a message related to their professional role or business. This is a narrow form of implied consent, and the message must be relevant to the reason the address was published.

The critical difference: Implied consent expires. Express consent does not (until withdrawn). This means an extracted list of business contacts from two years ago may have lost its implied consent basis, even if the addresses are still valid.

How This Applies to Extracted Lists

When you extract email addresses from files using Email Extractor, the tool finds addresses. It does not record or evaluate consent. That responsibility is yours.

Assessing consent for each address

For each extracted address, ask:

1. Do I have express consent? If the address came from a sign-up form with a clear opt-in, you have express consent. This is the safest basis.
2. Do I have implied consent? If the address came from a client contract, invoice or enquiry, implied consent may exist, but check the dates. A contract from three years ago means implied consent has expired.
3. When did the relationship last occur? Implied consent has a clock. Two years from the last purchase or contract end for business relationships. Six months from an enquiry. If the clock has run out, you need express consent before sending.
4. Is the address conspicuously published? If the address was in a public directory or on a company website, the published-address implied-consent basis may apply, but only for messages relevant to the person's role.

Practical recommendations

For addresses with express consent: Send as planned. Include a working unsubscribe mechanism, your contact information and your physical address.

For addresses with unexpired implied consent: Send, but be aware of the expiration date. Consider including a request for express consent (a "confirm your subscription" link) so that when implied consent expires, you already have express consent on file.

For addresses with expired implied consent: Do not send commercial messages until you obtain express consent through another channel. You can still send transactional messages (invoices, delivery confirmations, account updates) because those are not commercial electronic messages under CASL.

For addresses with no consent basis: Do not send.

What Must Be in Every Message

CASL requires every commercial electronic message to include:

• Sender identification. Your name (or your organisation's name), physical mailing address, and either a phone number, email address, or website URL.
• An unsubscribe mechanism. A working link or email address that allows the recipient to opt out. The mechanism must be available for at least 60 days after the message is sent.
• Prompt processing. You must process unsubscribe requests within 10 business days.

These requirements apply even when you have express consent.

CASL Penalties

CASL violations can result in significant penalties:

• Administrative monetary penalties of up to $10 million CAD per violation for organisations and $1 million CAD per violation for individuals.
• Private right of action allows individuals and organisations to sue for damages resulting from CASL violations (though this provision has been subject to regulatory developments).

These penalties make CASL compliance particularly important for extracted lists, where the consent basis for each address may be uncertain.

Practical Steps for Compliance

Before extracting

Understand the source of your files. Files from recent client transactions (within two years) provide a reasonable implied consent basis. Files of unknown age or origin do not.

After extracting

1. Download as CSV with sources. This tells you which file each address came from, helping you trace consent basis.
2. Sort by consent type. Separate addresses with express consent, unexpired implied consent, expired implied consent and no consent. Treat each group differently.
3. Start a consent campaign. For addresses with implied consent approaching expiration, send a message asking for express consent while you still have a legal basis to send.
4. Maintain records. Document the consent basis for each address. If a regulator or recipient challenges your right to send, you need to demonstrate that consent existed at the time of sending.

Ongoing

• Track implied consent expiration dates. Set up a system to flag contacts whose implied consent is approaching the two-year or six-month limit.
• Process unsubscribes promptly. Add unsubscribed addresses to your suppression list and honour them within 10 business days.
• Keep consent records. Maintain logs of when and how consent was obtained for each contact.

Related Guides

• Email Consent Types Explained
• CAN-SPAM and Extracted Email Lists
• GDPR and Email Extraction
• CCPA and Email Extraction
• What Is an Email Suppression List
• Double Opt-In Explained

Official guidance

Read the CRTC CASL FAQ and implied consent guidance. Publication alone does not give a broad licence to contact an address. The sender must be able to demonstrate that the conditions for consent or an applicable exception are satisfied.