CASL Consent for Newsletter Publishers: Canadian Rules

What to take away

Who has jurisdiction over your sends

CASL is federal. The CRTC is the main enforcer, with the Competition Bureau and the Office of the Privacy Commissioner holding parallel powers over false advertising and address harvesting. The statute itself is Canada's Anti-Spam Legislation, S.C. 2010, c. 23. The consent rules live in section 6, which prohibits sending a commercial electronic message without consent, and section 10, which sets out what a request for consent must contain.

Jurisdiction follows the message, not the sender's address. A newsletter sent from Ontario to a subscriber in British Columbia is a commercial electronic message under the Act. So is a promotional issue sent from New York to a reader in Alberta, because the message is received in Canada.

Transactional messages, such as a receipt for a paid subscription, fall outside the consent requirement. The moment an issue promotes a sponsor, a paid tier, or your own back catalogue, it becomes commercial and the rules apply.

What valid express consent requires

Express consent is the durable kind, and getting it right is a matter of form. It has to come from a positive act by the reader: an unchecked box they tick themselves, a confirmation link they click, or another clear affirmative step. Consent assumed from silence, or from a box that is already checked when the page loads, is not valid.

What a request for consent must contain

CASL section 10 sets out what a request for consent has to state. It must give:

In practice, that means the signup form itself has to say what the reader will receive and who is sending it. A generic subscribe box that names neither the sender nor the purpose does not meet the standard.

Keeping the consent valid

Express consent does not expire on its own. It holds until the reader withdraws it, so the request has to say that consent can be withdrawn, and every commercial message has to carry a working unsubscribe. If a form collects consent for more than one sender, each sender has to be identified in the request.

What a compliant disclosure contains

A compliant commercial message identifies the sender by name, gives a physical mailing address, and provides an unsubscribe mechanism that works without a login or a second step. The sender must be the person or business on whose behalf the message is sent, not an opaque trading name.

CASL does not require a specific unsubscribe wording. It requires that the mechanism be clearly and prominently set out and that it function for at least 60 days after the message is sent.

Unsubscribes must be honoured within 10 business days. A preference centre that only downgrades frequency is not an unsubscribe unless the reader can also stop all commercial messages from that sender.

If a sponsor's offer is the payload, the sponsor is a sender too. That means the sponsored issue needs the sponsor identified, and the consent must cover messages sent on that sponsor's behalf. Publishers who sell sponsorship should read FTC disclosure rules even though the FTC is a US regulator, because Canadian sponsors often ask for the same language.

Records to keep

An audit trail is the only thing that turns a complaint into a closed file. The CRTC asks for evidence of consent, and memory is not evidence. Keep the following for every subscriber:

CASL has no register or filing step. Consent records stay with you and surface only if the CRTC asks for them during an inquiry or a compliance audit.

Retention periods vary by province and by privacy law. A practical habit is to keep consent records for as long as the subscription is active plus two years, and to keep suppression lists permanently so a removed reader is never re-added.

What happens if you do not comply

CASL penalties are administrative monetary penalties, issued by the CRTC as a notice of violation. The Act sets the maximum amounts and sets a lower cap for individuals than for businesses, and the figures are indexed, so they change over time. Read the current maximums from the Act and from the CRTC's published notices of violation rather than from an old guide. A finding can also come with a compliance order and a demand for an independent audit of your list.

The consequences do not stop at the CRTC. A pattern of sending without consent damages deliverability, and mailbox providers in Canada and the United States treat complaint rates as a signal. A list that generates spam complaints loses inbox placement, which is the commercial cost that shows up first.

Where the rules differ by place

Ontario and British Columbia are the two provinces where consumer protection law adds its own layer on top of CASL. British Columbia's Business Practices and Consumer Protection Act is enforced by Consumer Protection BC, and Ontario's Consumer Protection Act, 2002 reaches consumer agreements, including the terms behind a paid newsletter. CASL's private right of action, which would have let individuals sue directly, was suspended before it came into force, so complaints still run through the federal regulators. Quebec adds language requirements under its Charter of the French Language, so a newsletter sold in Quebec often needs a French version of the unsubscribe and identification block.

Canadian privacy law runs alongside CASL. PIPEDA, the Personal Information Protection and Electronic Documents Act, governs how you collect and store subscriber data, and the Office of the Privacy Commissioner publishes guidance on consent and personal information that covers consent, access requests, and breach reporting.

Provincial health and financial regulators add sector rules. A newsletter covering investments in Ontario may need to consider securities advertising rules, and a health newsletter may face provincial advertising standards. Those are separate from CASL consent and are usually the reason a publisher needs a second legal review.

If your list is mostly American and you are adding Canadian readers, the two regimes are not interchangeable. A working comparison of the obligations is set out in CAN-SPAM compliance, which is worth reading before you merge a Canadian segment into a US sending domain.

Common questions