CASL and Email Marketing: A Practical Guide for Canadian Small Businesses

What should a Canadian small business check before sending marketing emails under CASL? For commercial electronic messages covered by the legislation, the starting points are a valid consent basis, required sender identification and a working unsubscribe mechanism. Exceptions can change which requirements apply, so assess the message and the relationship rather than assuming every contact can receive a campaign.

For a busy business owner, the challenge is often practical. Contacts arrive through enquiry forms, purchases, networking events and older spreadsheets. Different staff members may add them to different systems, leaving the marketing team uncertain about who should receive what.

A clear process helps you resolve those questions before pressing send. It also makes it easier to respect customer preferences and maintain useful records as your database grows.

At Bloomtools Canada, we help businesses connect their websites, customer information and email marketing. This guide explains the main CASL considerations and offers a practical approach to reviewing your forms, lists and campaigns.

This article provides general information, not legal advice. Obtain advice on your specific circumstances when consent or an exception is uncertain.

What is CASL, and which messages does it cover?

Canada's Anti-Spam Legislation includes rules for commercial electronic messages, often called CEMs. A message can be commercial when one of its purposes is encouraging participation in a commercial activity.

A sales offer, promotional newsletter or automated marketing follow-up may qualify. Email is not the only channel: texts and some direct messages can also fall within the rules. An ordinary public social media post is different from a message sent to someone's electronic address.

The CRTC's CASL questions and answers explain how content, links and context affect the assessment. A logo or website link in a signature does not, by itself, automatically make a message commercial.

For campaign planning, identify the purpose of each message before deciding which audience can receive it. Do the same for automated sequences, rather than reviewing only your occasional newsletters.

Express consent and implied consent explained

Express consent involves an active agreement

Express consent means the person has actively agreed to receive the relevant commercial messages. It may be obtained orally or in writing, including electronically. It has no fixed expiry period, but the recipient can withdraw it.

Government guidance on getting consent explains the distinction between express and implied consent. Keep evidence of what the person agreed to and how that agreement was obtained.

On a website form, an unchecked marketing checkbox is one practical opt-in method. The visitor must actively select it. A preselected checkbox does not establish express consent, as explained in the CRTC's guidance on consent mechanisms.

Record the consent information separately from the enquiry itself. A person asking for a quote and a person subscribing to a newsletter may be taking different actions on the same form.

Implied consent depends on specific circumstances

Implied consent is not a general permission to email anyone in your contact database. It depends on a qualifying situation.

For common existing business relationships, a purchase may support a two-year period, while a qualifying enquiry or application may support six months. Written contracts and ongoing subscriptions have additional timing rules. The relevant event matters; the date someone was imported into your software does not establish when the relationship began.

Consult the CRTC's implied consent guidance before assigning expiry dates. Do not automatically apply a two-year or six-month timer to every category of implied consent.

For example, keep an enquiry date linked to the enquiry record and a purchase date linked to the transaction. A generic label such as "customer" does not explain the basis for a particular send.

Published business addresses and business cards need careful review

A publicly visible email address is not an unrestricted invitation to send promotions. Conspicuous publication can support implied consent only where the conditions are met, including publication by or caused by the recipient, no accompanying statement against unsolicited CEMs, and relevance to the recipient's business role.

A business card may also support implied consent in appropriate circumstances. It does not automatically establish express newsletter consent. Record the context and assess the intended message.

There is also a separate exemption for certain messages between organizations with a relationship, where the message concerns the recipient organization's activities. The Electronic Commerce Protection Regulations set out those conditions. Being a business contact alone is insufficient.

What about quotes, invoices and service messages?

CASL distinguishes exemptions from the consent requirement from exclusions from section 6 more broadly. Those distinctions matter when planning operational emails.

Certain messages that solely provide a requested quote, confirm an agreed transaction or deliver specified service information can be exempt from consent while remaining subject to identification and unsubscribe requirements. Other requested responses may qualify for a broader regulatory exclusion.

Check the actual provisions in CASL and its regulations. Avoid labelling every service email "fully exempt." Adding an unrelated promotion may change the analysis of a message that must solely serve a specified purpose.

As an operational practice, keep service templates and promotional templates distinct. That makes their purpose easier to review and reduces accidental changes when someone updates a shared email layout.

Sender information and unsubscribe requirements

Make the sender identifiable

Where the identification rules apply, include the required sender name and, when relevant, the party on whose behalf the message is sent. Provide a mailing address and a qualifying telephone number, email address or web address. Relevant contact information must remain valid for at least 60 days after sending.

The CRTC regulations on message information also cover consent requests. Do not substitute an unverified address or assume that only a physical street address is acceptable.

Make unsubscribing simple

Where required, the unsubscribe mechanism must be clear, free and readily performed. It must remain valid for at least 60 days after sending. Requests must take effect without delay, and no later than 10 business days.

The requirement is not a universal rule that every unsubscribe must happen in exactly one click. Avoid unnecessary barriers such as requiring account login. Respect the scope of the request, including an option to stop all marketing where appropriate.

Test the process from a recipient's perspective. Check what happens after the link is selected and verify that the resulting preference reaches the systems used for future campaigns.

How to improve your website's marketing opt-in form

Start with plain language that tells visitors what they are signing up for. Place the choice near the relevant form action so people can understand it before submitting.

For a quote form, a separate optional newsletter checkbox is often a useful design. The enquiry should still reach the team when the visitor leaves that marketing option unchecked. Configure and test both outcomes.

A starting point for the checkbox wording is:

"Yes, I would like to receive email marketing tips, service updates and promotional offers from [Business Name]. I can unsubscribe at any time."

This is sample wording, not a complete legal template. Add the required identification and contact information, describe the purpose accurately, and account for anyone on whose behalf consent is sought. Include an appropriate privacy notice that explains your handling of personal information.

Once the wording is approved, keep a version of it with your records. If you later change the newsletter's scope or update the form, you should be able to understand what an earlier subscriber saw.

Test the form using a designated internal address. Submit once with the marketing choice selected and once without it. Check that the two submissions produce different marketing statuses while both create the expected enquiry record.

Also review forms outside the main website. Event registrations, landing pages, checkout flows and downloadable-resource forms can all feed the same database. A good homepage form will not correct an unclear process elsewhere.

Build a practical consent and campaign workflow

Software can organize information and apply configured rules. It cannot decide every legal question or guarantee that an imported contact has valid permission. Treat automation as support for a reviewed process.

1. Map how contacts enter the database

List your sources, such as website enquiries, newsletter forms, event registrations, purchases and manual imports. Identify who owns each source and what information it supplies.

This often reveals the main problem quickly. A newsletter signup may preserve detailed evidence, while a spreadsheet upload contains only names and addresses. Those records should not be treated as equivalent.

2. Use statuses your team can understand

Create clear working categories for reviewed express consent, reviewed implied consent, unsubscribed contacts and contacts awaiting assessment. These labels are operational tools, not legal conclusions on their own.

Keep uncertain records out of routine marketing selections until they have been reviewed. Make the status visible to the people building campaigns, rather than hiding it in notes that are easy to overlook.

3. Link the status to supporting evidence

Useful records may include the address, source, date, wording shown and the action taken. For a relationship-based record, link the relevant purchase, enquiry or contract evidence.

Choose a consistent place to store this information. Your team should be able to explain a record without searching several personal inboxes. Collect additional technical data only where appropriate for your privacy practices and actual needs.

4. Review expiry rules before automating them

Where a time limit applies, document the event that starts it and the rule your system will use. Confirm what happens when the date is reached and how a genuine new qualifying event is recorded.

Do not reset dates merely because a contact was moved between systems, opened a campaign or was reassigned to a salesperson. Investigate unexplained changes before allowing a record back into an active audience.

5. Preserve unsubscribe information across imports

Keep suppression information available to campaign selection and import processes. An old spreadsheet should not reactivate someone who previously opted out.

If several systems send marketing, document how preferences move between them. Test that connection after a migration or integration change. Where the setup requires a manual step, assign responsibility and check that it happens.

6. Give someone ownership of the process

Name a person who can resolve uncertain records, approve changes and coordinate with your provider. Keep concise instructions for staff who add contacts or send messages.

The CRTC's compliance program guidance discusses records, training, responsibility and review. A small business can adapt its process to its scale without treating a large software installation as the only solution.

Bloomtools' contact management tools and database marketing platform provide options to discuss when organizing customer information. Confirm which fields, rules and integrations are available in your particular setup before relying on them.

Review an older email database before using it

An old list can contain several different situations: customers with supporting records, subscribers whose original consent evidence is still available, people who have unsubscribed and contacts with no clear source.

Begin with a working copy and preserve existing suppression records. Review the source information before importing contacts into an active campaign audience.

Buying a list does not, by itself, establish permission to send. Do not rely on a vendor's broad assurance without checking the basis and evidence relevant to your messages. Buying an operating business and its consent records raises different issues from buying addresses alone.

An email asking for marketing consent is itself a CEM. Do not send a blanket "please opt in again" campaign to expired or uncertain contacts as a way to repair missing permission. Check that you already have a valid basis or applicable exception for that message.

If you plan to seek express consent while a reviewed implied-consent basis remains valid, schedule that work before expiry. Honour any earlier withdrawal. Otherwise, build future subscriptions through appropriate opportunities such as a clear website signup form.

For the operational review, record what you checked and the resulting decision. A smaller, well-understood audience is easier to manage than a larger list with unexplained statuses.

A simple review before your next campaign

Confirm the message and audience

Read the full email, including banners, footers and links. Confirm its purpose and the audience selection criteria. Spot-check records from each source represented in the selection.

Check the template

Review sender information and contact details. Send a test to an internal address and check readability on mobile. Test links and the unsubscribe journey using a designated test contact.

Check scheduled follow-ups

A campaign may trigger a sequence later. Confirm that the next message uses current eligibility and suppression information rather than assuming the original audience remains appropriate indefinitely.

Keep a useful campaign record

Retain the sent content, selection rules, sending date and relevant review notes. If a question arises, those records should help you reconstruct what happened without guessing.

Review the results

Look at delivery problems, complaints and unsubscribe patterns alongside enquiries. Treat unexpected results as a reason to investigate the list source, message or configuration. Engagement metrics do not establish legal consent.

For advice on the content itself, read our guide to what to include in your email marketing campaigns.

Frequently asked questions

Can I send one email just to ask for consent?

A consent request is itself a commercial electronic message. Check your existing basis or an applicable exception before sending it. There is no general free first marketing email.

Does an unsubscribe link make a purchased list safe to use?

No. The link addresses one part of the requirements. It does not establish permission to send to the addresses on that list.

Does using an agency remove my responsibilities?

No. Agree who reviews recipients, maintains evidence and processes preferences. An agency or software provider does not automatically remove the sender's obligations; responsibility depends on the facts and applicable provisions.

Will CRM software guarantee compliance?

No. It can help implement a process, but the source information, configuration and decisions still need attention. Confirm what your system actually does and test important workflows.

Does CASL compliance improve Google or AI search rankings?

Do not present it as a ranking tactic. This guide makes no claim that email consent records, open rates or compliance status cause better Google rankings or AI recommendations. Focus this work on responsible messaging and database management.

Improve your email marketing process with Bloomtools Canada

A useful email program starts with knowing your audience, keeping understandable records and making preferences easy to manage. Connect those tasks with clear campaign planning and regular review.

Bloomtools Canada offers email marketing tools alongside website and database capabilities. We can discuss how your forms, contact information and campaign processes work together, and identify configuration improvements within your setup.

Contact Bloomtools Canada to review your email marketing workflow and discuss practical next steps.